Methodology

Public sources only

Every analysis is built from the public record: breach notifications, regulatory filings, court documents, vendor disclosures, and reporting from named outlets. Every claim carries a citation. No analysis uses information from inside any organization, including any I have worked for, and no post is informed by non-public knowledge of the incident it covers. If a fact is not in the cited sources, it is not in the post.

Estimates are estimates

Each post models loss with FAIR, run as a Monte Carlo simulation over stated inputs. The assumptions behind every figure are disclosed in the post: event frequency, loss magnitude, threat profile, and the controls tested. Results are reported as ranges and probabilities, never a single number, because a single number claims a precision the data does not support. A loss exceedance curve shows the chance that losses exceed any threshold you choose; read it at your own tolerance. The inputs are published so you can rerun the analysis with your figures and reach your own answer.

Views are my own

Bailey GRC is a personal venture. The views on this site are mine and represent no employer, client, or organization. Analyses of public incidents are commentary on the public record, not findings against any company named and not advice specific to your organization. Treat each one as a worked example to rerun with your own numbers.