How we source incident cost figures

Primary sources

Calculation framework

In scope

• Per-incident cost figures with named primary-source citation.
• Tier bands for IR firms (Mandiant, CrowdStrike, Kroll, Coveware, Arete, Unit 42, Sygnia, NCC Group) where publicly disclosed.
• Industry and company-size segmentation of cost where the underlying source provides it.
• MTTD, MTTR, MTTC benchmarks from IBM CODB, Mandiant M-Trends, PagerDuty, and FireHydrant.
• Regulatory fine schedules with named statute or framework citation (GDPR Article 83, HIPAA Tier 1-4, PCI DSS card-brand fees).
• Public-incident retrospective in band form, sourced to SEC filings, 10-K disclosures, court settlements, or regulatory enforcement actions.

Out of scope

• Per-firm IR pricing where the firm has not disclosed it publicly. We name the band, not invented per-firm rates.
• Specific organisations' breach costs beyond what they have disclosed in SEC filings or court records. Where a public figure exists we cite it; where it does not we report band-only.
• Ransomware payment recommendations. We publish published guidance from US Treasury OFAC, FBI IC3, and CISA. We do not advise on whether to pay.
• Specific cyber-insurance broker or carrier recommendations. We publish market shape and claims-trend data; we do not steer to named brokers.
• Per-vendor SIEM/XDR/EDR/MDR pricing beyond named vendor list pricing. Negotiated enterprise rates are excluded.
• Loaded internal hourly rates. We use BLS OEWS occupation 15-1212 (Information Security Analysts) as the public anchor.

Refresh cadence

Every figure on the site is re-verified in the first business week of each month. The site has a single LAST_VERIFIED_DATE constant (lib/schema.ts) that drives every date stamp in the footer, the schema, and the per-page banners. Current verified date: June 2026.

Out-of-cycle refreshes are triggered by:

• New IBM Cost of a Data Breach Report edition (annual Jul-Aug)
• New Verizon DBIR edition (annual May)
• New Ponemon Cost of Insider Risks edition
• New Mandiant M-Trends edition
• Material movement in IR-firm public retainer pricing (greater than 10 percent across the tier)
• New ransomware-payment guidance from US Treasury OFAC or equivalent
• Major regulatory fine schedule change (GDPR, HIPAA, PCI DSS)

Cosmetic date bumps without underlying figure changes are not made. Where a correction shifts a published band by 10 percent or more we roll LAST_VERIFIED_DATE forward across footer, schema, and banners in a single commit so the change is auditable.

Limitations

• IBM and Ponemon are respondent-recall surveys. The cost figures are self-reported by organisations recalling breaches in the previous 12 months. Recall bias and selection bias both apply. Cross-checks against Verizon DBIR (action-frequency) and Mandiant M-Trends (dwell time) help triangulate but do not fully eliminate the bias.
• Over-statement risk for very small organisations. IBM CODB's sample skews toward organisations with formal incident response programmes. Pure SMB sub-50-employee figures are extrapolated; treat the SMB band ($120K-$1.24M on /by-size) as approximate.
• Under-statement risk for catastrophic-loss scenarios. The Change Healthcare $2.87B+ and CrowdStrike BSOD $5.4B+ events fall outside the IBM CODB / Ponemon distribution. Catastrophic outliers are covered on /famous-incidents in band form, not folded into the averages.
• IR firm public guidance drifts. Mandiant, CrowdStrike Services, and Kroll do not publish a formal rate card. Tier bands move with market conditions; we refresh on disclosed changes plus the monthly verification cycle.
• Regulatory fine schedules can shift mid-year. HIPAA penalty caps adjust annually; GDPR enforcement priorities evolve; PCI DSS v4 transition completed March 2025 with knock-on fee implications. Out-of-cycle refresh triggers apply.

Editorial position

This site is operated by Digital Signet, an independent AI-development studio. Digital Signet does not sell incident-response retainers, does not run a forensics practice, does not broker cyber insurance, and does not accept paid placements from any IR firm, MDR provider, SIEM vendor, or cyber insurer. See /about for the operator and the wider portfolio.

Editorial direction is set by Digital Signet's editor. Drafts are produced via Digital Signet's autonomous AI development methodology and reviewed against the editorial framework before publication. Where a figure is derived rather than quoted, the inputs and the calculation are visible on the source page (most prominently /how-to-calculate).

Corrections process

For corrections, methodology questions, or scenarios that do not fit cleanly: [email protected]. We aim to acknowledge correction requests within five business days. Where a correction shifts a published band by 10 percent or more we roll LAST_VERIFIED_DATE forward across footer, schema, and banners in a single commit so the change is auditable. For the interactive calculator that translates a hypothetical scenario into a budget figure, see sister site incidentcostcalculator.com.