The early application of the regulatory agency’s new cybersecurity reporting rules reveal that materiality is in the eye of the beholder.