What a breach actually costs, and why the headline number is wrong

The average-cost-of-a-breach figures that circulate every year are useful for one thing: convincing a board that the number isn't zero. For deciding what to spend, they're close to useless, because your breach won't be average.

Where the money really goes

• Response. Forensics, counsel, overtime, the people pulled off their jobs. Front-loaded and visible.
• Disruption. The days a system is down and the revenue that doesn't happen. Usually larger than response, and usually underestimated.
• Obligations. Notification, credit monitoring, regulatory engagement, contractual penalties. Set by law and contract, not by you.
• Recovery. Rebuilding what was lost, and often rebuilding what should have been fixed years ago.
• The slow costs. Customers who leave quietly, deals that stall, insurance that costs more. Hard to attribute, real nonetheless.

How to get a number that's yours

Pick the three scenarios that would actually happen to your business. For each, walk the five categories above with the people who'd pay: operations, legal, finance, sales. Write down the range. It'll be rough. It'll also be the first number anyone in the room believes, because they helped make it.

What that number is for

Comparing it to what you're spending to prevent the scenario. If a plausible incident costs eight figures and the control that would stop it costs six, the conversation gets short. If it's the other way round, you've found something to stop spending on.

What it's not for

Precision. Anyone who gives you a breach cost to three significant figures is selling something. The value is in the order of magnitude and in the conversation that produced it.

If you'd like help building those scenarios with your leadership team, that's a day's work with lasting value.

Explore: More on cyber economics · Work with me