Executives realize that cybercrime is an existential threat to business, but increasingly they have something else to fear: that the Securities and Exchange Commission will lower the boom if their firms haven't taken adequate precautions or provided adequate disclosures related to those risks.

This past summer, the SEC hit Pearson and First American Financial with steep fines following data breaches, and the agency sanctioned eight investment firms over email takeovers. More recently, SEC Chairman Gary Gensler told the Senate his agency is developing a proposal on cybersecurity risk governance. He said it likely would address incident reporting and "cyber hygiene," the steps firms take to defend against cyberattacks and improve online security.