The question arises often enough in compensation committee meetings and tax counsel calls that it is worth answering directly: how many SEC enforcement actions have involved undisclosed executive perquisites since 2019?
The number is at least twelve named actions through the end of 2024, with settlements ranging from modest civil penalties against individuals to penalties exceeding $500,000 against companies. The pattern across those cases is consistent, the underlying failure modes repeat, and the dollar amounts involved are not trivial. More relevant for the current moment: security expenses and aircraft use, two categories that have grown substantially since late 2024, are at the center of the most recent enforcement focus.
This is not a survey of all cases. The purpose here is to answer what has changed since 2019, why security specifically has moved forward in the SEC's attention, and what companies with recently expanded security programs need to examine before the next annual proxy cycle closes.
What the SEC is actually looking for
The governing framework is Item 402(c) of Regulation S-K. Public companies must disclose the aggregate value of perquisites and personal benefits to each named executive officer when that aggregate exceeds $10,000. Individual items above $25,000 must be specifically identified.
The standard for classifying something as a perquisite is not whether the company had a business reason for providing it. The SEC uses a primary benefit test. If an item primarily serves the executive's personal interests, it is a perquisite regardless of any incidental business purpose. If it primarily serves the company's business interests, it is an ordinary business expense and need not be disclosed as compensation. Items that meaningfully serve both purposes require allocation.
The enforcement record since 2019 shows one consistent error: companies applying the ordinary-business-expense exception when the primary benefit was actually personal. That misapplication tends to compound over multiple proxy cycles before it surfaces, which is why settled amounts often reflect four or five years of undisclosed value.
The personal liability pattern
One feature of the post-2019 enforcement record that differs from earlier periods is the frequency of personal charges against individual executives, not just the companies.
In Gulfport Energy (2021), the company paid no penalty. The CEO paid a civil penalty of $88,248 personally. In ProPetro Holding (2021), the company paid no penalty. The former CEO paid $195,000 personally. In each case, the individual's involvement in the disclosure failure was the basis for personal liability, not just the company's failure of internal controls.
That pattern reflects a deliberate SEC enforcement posture. When an executive provides inaccurate expense information, uses corporate resources for personal purposes outside any documented approval structure, or fails to report to the compensation committee what is actually being spent on their behalf, the SEC treats that as a personal violation, not merely an organizational one.
For any company whose executives receive security benefits, this means the question of who is responsible for ensuring accurate disclosure is not academic. If the executive's personal security program runs through an informal channel, is paid through a corporate account without formal authorization, and does not surface in the proxy because no one in tax or legal was asked to review it, the exposure is not limited to the company.
Why security has moved to the front
The volume of executive security spending at U.S. public companies increased substantially beginning in late 2024. The event is well documented: in December of that year, a high-profile attack on the CEO of a major Fortune 50 company generated sustained media coverage, prompted board-level conversations at dozens of companies about whether existing security programs were adequate, and resulted in a rapid expansion of protective measures at many firms that had not previously maintained formal security programs.
The problem with rapid, reactive security spending is structural. A board that decides in January 2025 to expand the CEO's security program and begins paying for residential systems, ground transportation, and personal flights on company aircraft by February has a new perquisite disclosure question in its 2025 proxy. If the program was implemented quickly, without formal compensation committee authorization, without tax counsel involvement, and without a documented assessment of what qualifies as a business expense versus a personal benefit, the proxy filed in 2026 may not accurately describe the program.
That is the same condition that produced the Hilton, ProPetro, and National Beverage enforcement actions. The fact that the spending was reactive and well-intentioned does not resolve the disclosure question.
Aircraft use and security: the specific intersection
One of the most contested categories in the current enforcement environment is personal use of company aircraft justified on security grounds.
An executive's use of company aircraft for personal travel is ordinarily a perquisite. The entire value must be determined using the Standard Industry Fare Level (SIFL) methodology set out in Treasury Regulation §1.61-21(g). If the board has required non-commercial air travel for security reasons, and if a qualifying Independent Security Study has recommended it, the IRS provides a separate treatment: the executive includes a safe harbor airfare amount in income, computed at 200% of the SIFL rate plus the applicable terminal charge, and the excess is excluded as a working condition fringe benefit under §1.132-5(m).
What the IRS exclusion does not do is determine how the benefit is classified for SEC disclosure purposes. These are independent analyses. A company can have a fully compliant §1.132-5(m) program, exclude the security flights from the W-2 under the safe harbor, and still be required to disclose the value of those flights as a perquisite in the proxy under Item 402. The two tests ask different questions.
The enforcement risk arises when a company treats the IRS exclusion as resolving the SEC question. A board resolution and a qualifying ISS support the §1.132-5(m) position. Whether the benefit meets the primary purpose test for SEC perquisite classification is a separate determination, made under the Item 402 framework, and it requires separate analysis and documentation.
What changed after 2024 that companies need to address
For companies that expanded executive security programs starting in late 2024 or early 2025, four issues deserve review before the next proxy cycle closes.
Was the program authorized through the compensation committee? An informal board decision that the CEO needs more security is not the same as a formal compensation committee resolution authorizing a defined security program as part of the executive's compensation structure. The lack of formal authorization is a recurring fact pattern in enforcement actions.
Has each expense been analyzed under both the IRS and SEC frameworks? The §1.132-5(m) test and the Item 402 primary benefit test are not the same. Expenses that qualify for the IRS exclusion may still require SEC disclosure. A clean W-2 does not mean a clean proxy.
Does a qualifying Independent Security Study exist, and was it conducted by an actually independent firm? The Treasury Regulation requires that the study be conducted objectively and independently, specifically that the firm conducting it has no financial relationship with the vendors implementing the security measures. A study conducted by a firm that also sells security hardware or services is not independent within the meaning of the regulation.
Does the program as implemented match the study's recommendations? The most common audit finding in §1.132-5(m) examinations is not a defective study. It is a gap between what the study recommended and what the company actually implemented. That gap collapses the exclusion. The same gap can affect the SEC disclosure analysis if the factual basis for the business-purpose characterization rests on a study the company did not actually follow.
The practical question
Companies that expanded security programs in 2024 or 2025 without a formal review of the tax and disclosure implications are in a position that has produced enforcement actions before.
For security expenses specifically, the contemporaneous documentation generated by a formal ISS process is the most defensible foundation for both analyses. It does not replace SEC disclosure, but it establishes the factual predicate that makes a business-purpose argument sustainable if the question is ever asked.
If your company commissioned or expanded a security program recently and has not yet worked through the disclosure implications, that review is worth completing before the proxy cycle closes. We are glad to talk through the specifics.
This post is for informational purposes and does not constitute tax or legal advice. Readers should consult qualified tax counsel regarding the treatment of specific programs.