We’ve built a practical model that turns public breach data into actionable financial insight. Using the VERIS Community Database (VCDB)—a transparent, incident-level dataset curated by the cybersecurity community—we estimated how much cyber risk costs in dollars per year and identified which security controls deliver the best return on investment. For financial businesses in North America, the most cost-effective risk reducers were Server hardening, Media handling, and Error-proofing. External monitoring added value only when priced below its marginal risk reduction.
This work is designed for business owners who want clarity, not complexity. Cybersecurity is no longer just a technical concern—it’s a financial exposure that affects customer trust, regulatory posture, and operational resilience. Our model helps you answer three essential questions: How much cyber risk are we carrying in dollars each year? Which controls reduce that risk most efficiently? And where should we invest first to get the best ROI?
To build the model, we filtered VCDB to incidents in the finance and insurance sector across the US, Canada, and Mexico, focusing only on cases with confirmed data disclosures. We then modeled three components: incident frequency (how often breaches happen), disclosure likelihood (which types of incidents are most likely to expose data), and event cost (the recovery cost per impacted customer, capped at your total customer base). The formula is simple: Expected Annual Loss (EAL) equals incidents per year multiplied by disclosure likelihood, multiplied by expected event cost.
Five incident traits consistently increased the odds of confirmed data exposure: server involvement, external actors, paper or physical media, human error (such as mis-delivery or misconfiguration), and evidence of infiltration. These are the levers that controls must address to reduce risk.
We tested control bundles that reduce these risk factors and found clear patterns. Server hardening delivered the highest risk reduction per dollar. Media handling—especially for paper and physical assets—also showed strong ROI. Adding Error-proofing controls, such as change approvals, safer defaults, and targeted awareness, provided meaningful additional benefit. External monitoring helped, but only when its cost was below the model’s calculated break-even point. In short, start with Server and Media controls, layer in Error-proofing, and treat External monitoring as a negotiable add-on based on price and incident rate.
To ensure the model is business-ready, we used per-customer costing rather than inflated “dollars per record” estimates. We capped losses at the customer base, included year effects to account for reporting drift, and calibrated probabilities to behave realistically. We also built sensitivity bands so you can see how results shift with different assumptions—perfect for budget planning or board review.
For business owners looking to take the next step, we’ll be publishing a white paper that walks through the methodology, results, and control ROI in detail. We’re also offering a live demo of the model, where you can input your own incident rate, customer count, and recovery cost to see your expected annual loss and compare investment options side-by-side.