Four families: compliance timelines (SOC 2, ISO 27001, HIPAA), breach and incident fallout, security hiring movements, and growth triggers like funding rounds, enterprise wins, and M&A. All from public sources - we watch what a company does, not what it claims.