Breach & Security Incident Sales Triggers — SEC 8-K, Ransomware News & Outage Lead Feed

Find the companies that just got hit. This actor turns SEC 8-K cybersecurity disclosures, vendor status-page incidents, and global breach news into a clean, ranked trigger-event feed for reps selling security, IT, compliance, backup, and incident-response products. Every run returns typed JSON rows — company, ticker, severity, trigger score, source link, and a ready-to-send talk track — schema below. The Apify Store lists exactly one other breach-trigger actor; this is the only one built on SEC Item 1.05 — the legally mandated disclosure that makes the signal authoritative instead of scraped-and-guessed.

A breach is the single strongest buying signal in security sales: budget is unlocked, the board is asking questions, and the buyer is actively shopping. This actor puts those accounts in your CRM the day the signal lands.

Why agents use this actor

• Deterministic typed output. Every row matches the published dataset schema. Every field is nullable, so partial signals never break your pipeline.
• Per-event pricing. You pay per company-signal returned, so autonomous budgets are predictable before the run starts.
• No auth, no cookies, no proxy required. All four sources are public endpoints.
• Clear error semantics. Bad input fails fast with a descriptive message and exit code 1. A source that fails is recorded in the SUMMARY key-value record and the run continues on the remaining sources. Zero results is a hard failure, never a silent empty dataset.
• Rate-limit handling built in. SEC's required descriptive User-Agent, SEC request pacing, and GDELT's throttle window are all handled internally with backoff and retries.

Data sources

Source	Signal	Why it matters
SEC EDGAR full-text search	Form 8-K Item 1.05 material cybersecurity incident disclosures	The highest-authority signal that exists. US public companies are legally required to file it. Board-level, budgeted, dated.
Atlassian Statuspage feeds	Vendor incident feeds (/api/v2/incidents.json) across dozens of major SaaS vendors	Customer-visible outages — resilience and SLA conversations.
GDELT news index	Global breach/ransomware/data-leak coverage	Catches private companies that never file with the SEC.
Google News RSS	Second independent news source	Coverage depth and fresher publication times.

Modes

Mode	What it does	Typical use
discover	Finds any company with an incident in the lookback window across all enabled sources	Fill top of funnel with net-new accounts
monitor	Checks your named companies list for incidents in the window	Schedule daily against your target account list
company-history	Returns the full available incident history for the named companies	Account research before a call

Input schema

Field	Type	Required	Default	Description
mode	string enum	no	discover	discover, monitor, or company-history
companies	string[]	required for monitor / company-history	[]	Company names and/or domains. A domain also unlocks that vendor's status-page feed.
lookbackDays	integer	no	7	Incident window in days. Ignored in company-history.
sources	string[]	no	["sec","statuspage","gdelt","google-news"]	Which sources to query
keywords	string[]	no	[]	Extra terms ANDed into news queries in discover mode (industry, region)
minSeverity	string enum	no	low	Drop rows below low / medium / high / critical
statusPageDomains	string[]	no	[]	Override the built-in vendor status-page list
fetchFilingExcerpts	boolean	no	true	Fetch each 8-K and extract the Item 1.05 narrative into excerpt
maxItems	integer	no	100	Max rows returned, highest triggerScore first

Output schema

One row per company-incident, sorted by triggerScore descending. All fields nullable.

Field	Type	Description
company	string | null	Affected company name
companyDomain	string | null	Primary domain. Populated for status-page signals.
ticker	string | null	Stock ticker. SEC signals only.
cik	string | null	SEC Central Index Key. SEC signals only.
signalType	string | null	sec-8k-cyber, outage, breach-news, or ransomware
severity	string | null	critical, high, medium, low
signalDate	string | null	ISO 8601 incident timestamp
headline	string | null	One-line incident description
excerpt	string | null	Item 1.05 narrative (SEC) or latest status-page update. Null for news rows.
sourceUrl	string | null	Direct link to the filing, incident, or article
sourceName	string | null	Source label, e.g. SEC EDGAR, Google News / BleepingComputer
recencyDays	integer | null	Whole days since the incident
triggerScore	integer | null	0-100 lead priority: source authority + severity + recency decay
suggestedTalkTrack	string | null	Dated opening line keyed to the signal type
mode	string | null	Run mode that produced the row

Example — sec-8k-cyber row (real output)

{
  "company": "AMGEN INC",
  "companyDomain": null,
  "ticker": "AMGN",
  "cik": "0000318154",
  "signalType": "sec-8k-cyber",
  "severity": "critical",
  "signalDate": "2026-07-31T00:00:00.000Z",
  "headline": "AMGEN INC filed an 8-K Item 1.05 material cybersecurity incident disclosure",
  "excerpt": "Item 1.05 Material Cybersecurity Incidents. In July 2026, Amgen Inc. (the \"Company\") identified unauthorized activity involving data stored in cloud environments hosted by third-party cloud service providers. Upon detecting the activity, the Company activated its cybersecurity response plan, implemented containment measures, and engaged independent cybersecurity forensic experts...",
  "sourceUrl": "https://www.sec.gov/Archives/edgar/data/318154/000031815426000119/amgn-20260729.htm",
  "sourceName": "SEC EDGAR",
  "recencyDays": 15,
  "triggerScore": 90,
  "suggestedTalkTrack": "AMGEN INC disclosed a material cybersecurity incident to the SEC on 2026-07-31 — board-level scrutiny and remediation budget are active now.",
  "mode": "discover"
}

Example — outage row

{
  "company": "Snowflake",
  "companyDomain": "snowflake.com",
  "ticker": null,
  "cik": null,
  "signalType": "outage",
  "severity": "critical",
  "signalDate": "2026-08-14T17:29:49.607Z",
  "headline": "INC20000158",
  "excerpt": "This incident has been resolved. Customers may have experienced elevated error rates...",
  "sourceUrl": "https://stspg.io/4pz2gky6fxgz",
  "sourceName": "Atlassian Statuspage",
  "recencyDays": 1,
  "triggerScore": 84,
  "suggestedTalkTrack": "Snowflake posted a customer-visible service incident on 2026-08-14 — resilience, monitoring and SLA exposure are top of mind with their platform team.",
  "mode": "discover"
}

Example — ransomware news row

{
  "company": "Texas Hearing Institute",
  "companyDomain": null,
  "ticker": null,
  "cik": null,
  "signalType": "ransomware",
  "severity": "high",
  "signalDate": "2026-08-14T12:20:27.000Z",
  "headline": "Texas Hearing Institute Ransomware Attack Affects 30,000 Patients",
  "excerpt": null,
  "sourceUrl": "https://news.google.com/rss/articles/CBMiqAFBVV95cUxPa3...",
  "sourceName": "Google News / HIPAA Journal",
  "recencyDays": 1,
  "triggerScore": 79,
  "suggestedTalkTrack": "Texas Hearing Institute was publicly linked to a ransomware event on 2026-08-14 — recovery, backup integrity and detection gaps are open agenda items this quarter.",
  "mode": "discover"
}

Error semantics

• Invalid mode, or monitor/company-history without companies — the run fails immediately with exit code 1 and a message naming the missing field. Nothing is charged beyond actor-start.
• A single source failing — logged as a warning, recorded under failures in the SUMMARY key-value record, and the run continues with the remaining sources.
• Zero results after filtering — the run fails with exit code 1 and a message listing the mode, window, sources, and any source errors, so an agent can widen lookbackDays, lower minSeverity, or correct the company list and retry.
• Per-row pushes. Rows are pushed individually, so a run that fails late still leaves every row collected so far in the dataset.
• A machine-readable run summary is always written to the SUMMARY key-value store record: mode, window, per-source counts, pushed count, high-severity count, distinct companies, and failures.

Use from AI agents (MCP)

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?tools=apricot_blackberry/breach-signal-radar",
      "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" }
    }
  }
}

Works in Claude, Cursor, ChatGPT deep research connectors, and any MCP client; the input schema above is the tool's parameter schema.

Use from code

curl

curl -X POST "https://api.apify.com/v2/acts/apricot_blackberry~breach-signal-radar/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode":"discover","lookbackDays":90,"minSeverity":"medium","maxItems":50}'

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('apricot_blackberry/breach-signal-radar').call({
    mode: 'monitor',
    companies: ['Amgen', 'zoom.us', 'Navient'],
    lookbackDays: 30,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items.filter((i) => i.severity === 'critical'));

Python

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("apricot_blackberry/breach-signal-radar").call(run_input={
    "mode": "discover",
    "lookbackDays": 90,
    "minSeverity": "high",
    "maxItems": 50,
})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["company"], item["triggerScore"], item["suggestedTalkTrack"])

Use from automation platforms

• n8n / Make / Zapier — use the native Apify integration, pick "Run Actor", and choose breach-signal-radar by name. Schedule monitor mode daily and route new rows straight into HubSpot, Salesforce, or Slack.
• LangChain / LlamaIndex — wrap it with the Apify Actor tool wrappers; the input schema becomes the tool signature.
• Webhooks — Apify webhooks can fire on run completion (ACTOR.RUN.SUCCEEDED, etc.), so you can trigger a downstream pipeline the moment a scheduled monitor run finishes instead of polling.
• Apify Schedules — run monitor every morning against your account list and let the completion webhook push fresh triggers to your CRM.

Pricing

Pay per event. You are charged only for what a run actually produces.

Event	When it fires
actor-start	Once per run
company-signal	Once per company-incident row pushed to the dataset
high-severity-signal	Additionally, for each row with severity of critical or high — the premium leads

FAQ

What is an 8-K Item 1.05 and why does it matter for sales? Since December 2023, SEC rules require US public companies to disclose material cybersecurity incidents on Form 8-K under Item 1.05, within four business days of determining materiality. It is a legally mandated, precisely dated, board-approved admission that a company has a security problem. There is no stronger buying trigger in this market.

How do I find companies that were breached this week? Run discover mode with lookbackDays: 7. Enable all four sources and set minSeverity to high to keep only the premium rows.

Can I monitor my own target account list for breaches? Yes — that's monitor mode. Pass company names and/or domains in companies, set lookbackDays: 1, and schedule it daily. Passing a domain also checks that vendor's status page for outages.

Does this work for private companies? Yes. SEC filings only cover US public companies, but the GDELT and Google News sources surface private companies, hospitals, universities, and government bodies that never file with the SEC.

Do I need an API key or a proxy? No. All four sources are public. SEC's required descriptive User-Agent header is set for you.

How is triggerScore calculated? It combines source authority (SEC filings score highest, then ransomware coverage, then outages and breach news), incident severity, and an exponential recency decay. Rows come back sorted highest first, so the top of your dataset is the top of your call list.

How current is the data? Every run queries the sources live. SEC filings appear within minutes of being accepted by EDGAR; status-page incidents and news are near real-time.

Why do some news rows have no company domain or ticker? Domains and tickers are only available where the source provides them — status pages carry the domain, SEC filings carry the ticker and CIK. News rows carry the company name and the article link, which is what a rep needs to open the conversation.

Changelog

1.0 — Initial release. Four live sources (SEC EDGAR 8-K Item 1.05 full-text search, Atlassian Statuspage vendor feeds, GDELT, Google News RSS), three modes (discover, monitor, company-history), Item 1.05 narrative extraction from the filing itself, composite trigger scoring, per-signal talk tracks, typed dataset schema, and per-event pricing.