Good day. On Day Three of the RSA Conference 2023, my conversations were about how government rules and actions could affect how corporate cyber chiefs go about their work.

Case in point: Impending rules from the Securities and Exchange Commission for cybersecurity disclosures. For those speaking on a panel at RSA, the picture is still muddy.

Alan Berry, chief information security officer at health insurer Centene Corp., said the proposed reporting window for material cyber events–in itself a loose definition, he added–is four working days. Does that mean four days from the start of an event, or four days from the determination that a cyberattack is material?

“I think most of us would welcome clearer rules and understanding,” he said. The SEC is expected to issue its final requirements in the next few weeks.

The SEC risks overloading companies with rules that compete or conflict with those of other federal agencies, said Matthew Modica, CISO at healthcare provider BJC HealthCare. The Cybersecurity and Infrastructure Security Agency, for instance, is in charge of fleshing out federal breach reporting mandates for critical infrastructure operators, but those will be different from the SEC’s proposals.

Federal officials hope that rules will eventually align, but the independence of agencies such as the SEC mean that they can’t be forced to align.

As Eric Goldstein, CISA’s executive assistant director for cybersecurity, told me in an interview: “Many regulators are independent and reserve autonomy in issuing regulations that they see fit but we are optimistic that as we move towards issuing our proposed rulemaking we will have more regulators anchor to what we think the right answers are.” The SEC didn’t respond to a request for comment.

Talk of artificial intelligence is everywhere, from companies clamoring to debut integrations of ChatGPT bots and other generative AI, to lingering queries about how and when the government might step in with views on how AI applies to security. I spoke with Mr. Goldstein about the topic, along with the National Security Agency, which has some concerns about how companies are advertising their prowess–and the attention that might attract from bad actors. More on that here, and below.

Scroll down for more news.

• “Think about how AI plays games like Go and chess in a fundamentally inhuman way," Mr. Goldstein said. "Well, what does an AI red team or adversarial AI look like when it tries to execute an intrusion in ways the defenders never thought of before?” Read our full story.

Russian hackers are studying U.S. and European supply chains, NSA says. Rob Joyce, director of cybersecurity at the National Security Agency, told RSA Conference attendees Russia-backed hackers are gathering intelligence on the logistics capabilities of countries supporting Ukraine with military and humanitarian shipments. (CyberScoop)

Ransomware attack to-do list: The tech governance and auditing group known as Isaca, debuted a guide for responding to ransomware. Topics include how to assess damage from both business and technological viewpoints, and steps for containing the malware. It's pretty detailed and contains worksheets for a post-mortem. Download here.

AI study buddy: Cybersecurity professional association (ISC)2 launched a self-paced system powered by artificial intelligence, for studying for its certificate exams. The AI feature evaluates the student's knowledge and speed to tailor materials, (ISC)2 said. 

TikTok ban in Montana faces speed bump as governor seeks changes. Gov. Greg Gianforte is requesting amendments to the bill to broaden it to all social-media apps that provide certain data to foreign adversaries. (WSJ) 

Google dismantled digital infrastructure linked to the Cryptbot malware, which steals data and credentials from users of the Google Chrome browser. Cryptbot distributors are believed to be based in Pakistan, Google said in a blog post. (Bleeping Computer) 

As France readies infrastructure for the Paris 2024 Olympic Games, Bruno Marie-Rose, technology director for the event, predicts an onslaught of attempted cyberattacks. He is evaluating defenses at a test lab in Madrid, created with French tech vendor Atos SE. (Inside The Games)

Numbers behind the prep work: 

• Lab staff: 60
• Applications to test: 150
• Estimated hours of testing: 250,000

Further reading from WSJ Pro Cyber: Privacy Concerns Surround Plans for AI Camera Surveillance at 2024 Paris Olympics

The WSJ Pro Cybersecurity team is Deputy Editor Kim S. Nash (on Twitter @knash99), reporter James Rundle and reporter Catherine Stupp (@catstupp). Follow us on Twitter @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.