The SEC has made a significant mark with on cyber corporate governance by promulgating its cybersecurity rule and through enforcement activity. While the purported reason for the SEC's cyber-related rule and its mandatory disclosures (security incidents via 8-K; security program and governance disclosures via 10-K) is to inform investors, the SEC is looking to change behavior (with some teeth behind it). The new SEC's strategy is already causing major "ripple effects" concerning the role, status and risk of security professionals, incident response planning and materiality assessments, the nexus between core business objectives and cyber risk, and even how we talk about security internally and externally. This presentation explores these ripple effects and where they lead us; the positives, the negatives, and how security professionals, lawyers and organizations can manage them.