Wade Baker

#InfoSec researcher and data storyteller; Cyentia Institute (Cyentia Institute (npub1w85…x42a)) co-founder; Virginia Tech professor; Verizon DBIR and VERIS creator; Advisor for RSA Conference and FAIR Institute; Star Wars fanboi; Coffee addict; Beer and cocktail snob; Father of 5.  I use this account on occasion to share and discuss research findings I consider informative and/or useful. Typically more active on LinkedIn: https://www.linkedin.com/in/drwadebaker

Last Notes

2025-06-12 17:32:09 UTC

Are #cybersecurity incidents growing more costly?
Cyentia Institute's recent Information Risk Insights Study points to a 15-fold increase in the cost of #incidents and #databreaches over the last 15 years.
The chart on the left shows the distribution of known/reported financial losses from incidents across the time period of the study. The typical (median) incident costs about $600K, while more extreme (95th percentile) losses swell to $32M. Note that the chart uses a log scale, so the tail of large losses is a lot longer than it appears.
The chart on the right trends the escalating costs of cyber events over time. Median losses from a security incident have absolutely exploded over the last 15 years, rising 15-fold from $190K to almost $3 million! The cost of extreme events has also risen substantially (~5x). So, yeah—cyber events are definitely growing more costly.
That said, this picture looks a lot different among different types and sizes of organizations. How are financial losses and other #cyberrisk factors trending for orgs like yours?
Download the full IRIS 2025 to find out!
Free with no reg req'd - though you can join Cyentia's free membership forum for bonus analytical content related to the report.
https://www.cyentia.com/iris2025/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/671/579/755/610/377/original/14198c66a4c9dcaf.png

2024-11-20 19:57:48 UTC

- reply

Would def be interesting to look at a long time horizon like that. It's often hard to see forward progress in this field, but that could show investments making a difference.

2024-11-20 15:55:15 UTC

I'm fascinated by the concept of measuring attacker-defender advantage in software, devices, and even entire IT environments. What do I mean by "attacker-defender advantage?" Lemme sum up and then share a chart.
Let's say you could measure the speed at which defenders remediate various types of security vulnerabilities across all relevant assets. Then say you could detect and measure the speed at which attackers find/exploit those vulnerable assets across the target population of organizations using them. Finally, plot those curves (across time and assets) to see the delta between them and derive a measure of relative advantage for attackers and defenders. That relative value is what I mean by attacker-defender advantage.
Since a picture is worth a thousand words, here's a visual example of the concept. The blue line represents defenders, measuring the speed of remediation. Red measures how attacker exploitation activity spreads across the target population. When the blue line is on top, defenders have a relative advantage (remediating faster than attackers are attempting to exploit new targets). When red's on top, the opposite is true. The delta between the lines corresponds to the relative degree of advantage (also expressed by the number in the upper left).
This chart comes from prior Cyentia Institute research in which we were able to combine datasets from two different partners (with their permission). Unfortunately, those datasets/partners are no longer available to further explore this concept - but maybe this post will inspire new partnerships and opportunities!
Any surprises in the attacker-defender advantage results depicted in the chart? Has anyone measured this or something similar?
#cybersecurity #vulnerabilities #cyberattacks #infosec #exploitation
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/516/092/496/764/298/original/b192b5542662d394.png