The Cost of an Incident

The speaker works as a cyber risk engineer, supporting insurance underwriters who are not cyber specialists. Drawing on claims work, the talk argues that security staff struggle to win budget from leadership, and suggests a more persuasive approach: study what similar organizations lost in their own bad days and present those figures in dollars rather than security jargon.

The talk sorts incident costs into several groups. Direct costs cover containment, rebuilds, incident response firms, ransom payments, negotiator and cryptocurrency fees, and equipment that is cheaper to replace than recover. Compliance costs grow quickly when sensitive data is involved, since locating affected people in messy, poorly labeled data takes time, and notification alone can cost about a dollar per person before credit monitoring is added. Business interruption is often the largest concern, with short ransomware recoveries lasting weeks and some taking more than a year, and supplier outages can halt operations too. Regulatory investigations, legal settlements, fines, reputational damage and required upgrades, known as betterment, come later and are often not covered by insurance.

The practical takeaways focus on reducing those costs before an incident happens. Segmenting networks makes response easier, and well-meaning staff should not wipe suspect machines without responder guidance. Backups should be resistant to ransomware, stored separately, and actually restored in practice. Organizations should arrange retainers with responders and negotiators, keep a paper copy of the response plan and contacts, rehearse critical processes without the network, and prepare crisis communications. The speaker's central advice is to keep only the data needed for compliance and the business, and to plan and practice every step.