Twenty-six of the 27 material incidents disclosed between 1 August and 12 September 2026 published no dollar loss. The single exception came from a criminal prosecution, not a company statement. One manufacturer went as far as warning that a cyberattack could cause it to miss quarterly and full-year guidance, without quantifying the figure.
For a board, that creates a practical problem. The headline metric everyone reaches for, cost, is almost never available at the time it would be useful, and the numbers that are available, records exposed and attacker claims, are not comparable across incidents. This piece sets out what can be measured instead.
Contents
- Why the loss number is almost never there
- What disclosure actually contains
- Benchmarks, and how to use them honestly
- Four questions that reveal exposure
- Metrics worth putting in a board pack
- The disclosure clock is a governance risk of its own
- Long-life data belongs on the risk register
- How to brief the board after someone else's incident
- Frequently asked questions
Key Takeaways
- Only one of 27 incidents carried a confirmed loss figure, and it came from court proceedings.
- Attacker claims, such as an unverified assertion of 284 million records, are not evidence of scale.
- IBM's 2026 benchmark puts the global average breach cost at US $4.99 million, useful as context, never as an estimate of your exposure.
- The most informative board metrics are time to detect, time to revoke a connection, blast radius per credential and data shelf life.
- Report exposure and response capability, not a single risk score.
Why the loss number is almost never there
At the moment of disclosure, the loss is genuinely unknown. Incident response is still running, legal exposure is unresolved, notification volumes are unconfirmed, restoration costs are open-ended and business interruption has not finished. Publishing a number early creates securities and litigation risk if it changes.
So companies disclose what they can defend: what was accessed, roughly how many people are affected, and whether operations continued. The only firm figure in this register, more than US $9.5 million in victim losses, appeared because prosecutors established it in a criminal case.
Key Insight
No disclosed loss is not the same as no loss. It usually means the organization is still inside the period where the cost is accumulating and cannot yet be defended in public.
What disclosure actually contains
Disclosed measures differ in both reliability and comparability. A confirmed dollar loss is highly reliable when court-established, but it is rare, so it is nearly useless for comparison. People or records affected is moderately reliable and often revised upward later, and is comparable only within similar data types. Attacker claims of volume are low in reliability, frequently inflated or recycled, and not comparable. A ransom demand is factual, but a demand is not a payment, so it indicates attacker valuation only. Operational impact is highly reliable because it is observable by customers, and is comparable within a sector. And guidance or earnings impact is highly reliable because it is regulated speech, making it the strongest signal available.
The last measure deserves attention. When a listed company links a cyberattack to guidance risk, it has moved the event from the security report into the financial statements. In this register, exactly one company did that.
Benchmarks, and how to use them honestly
IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at US $4.99 million, a 12% year-on-year increase and a record high, and the average cost of an AI model inversion attack at US $6 million. It also reports that organizations using AI and automation extensively in security saw materially lower costs than those using none.
Benchmarks like these are useful for scale-setting and budget conversations. They are not estimates of your exposure: averages mix industries, sizes, regulatory regimes and data types. Presenting an industry average as the expected cost of your next incident is the most common error in board-level cyber reporting, and a well-informed director will spot it.
Four questions that reveal exposure
Rather than asking what a breach would cost, ask four questions whose answers are knowable today.
1. How long would we take to notice? In this register, disclosures ranged from about 40 hours after an exposure to roughly ten months after the original access. Intrusions that use valid credentials do not trigger malware alerts, so the honest answer often depends on an audit or a third-party notification.
2. How fast can we cut a connection? When a supplier discloses an incident, exposure continues until the connection is severed. If the answer involves a change window, exposure is measured in days.
3. What does one stolen credential reach? This is the blast-radius question, and it is answerable today with an access review rather than a breach. In the largest case here, credentials without multifactor authentication opened cloud data at more than 165 organizations. One compromised cloud key elsewhere exposed backups for over 1,000 charities.
4. How long must our data stay secret? Identity documents, genetic data and sealed records stay sensitive for decades, which links directly to q-day and harvest now, decrypt later.
Key Insight
Boards are usually given a risk score and asked to accept it. The more useful request is a rehearsal: show me how long it took, last time we tried, to cut one supplier connection and prove it was cut.
Metrics worth putting in a board pack
- Mean time to detect and to contain, split between intrusions found internally and those reported by outsiders.
- Time to revoke a supplier or machine credential, measured in a rehearsal rather than estimated.
- Coverage: percentage of cloud-facing accounts with multifactor authentication, and percentage of machine credentials with an owner, a scope and an expiry.
- Blast radius: what the most privileged machine identity can reach.
- Third-party concentration: suppliers ranked by the data and operations reachable through their connection.
- Data shelf life: volume of data that must remain confidential beyond ten years.
- Automated response ratio: how much containment happens without a human decision.
Each of these is measurable before an incident, which is what makes them governance metrics rather than post-mortem ones. They also survive contact with a sceptical director, because every one of them can be demonstrated rather than asserted.
The reporting cadence matters as much as the metrics. A quarterly pack that shows the same seven numbers over time tells a board whether exposure is falling. A new framework each quarter tells them nothing, and it usually signals that the previous numbers were uncomfortable. Our piece on the real cost of a trust failure covers the downstream costs that rarely appear in the security report at all.
The disclosure clock is a governance risk of its own
Under the US Securities and Exchange Commission's cybersecurity disclosure rules, registrants must disclose material cybersecurity incidents, and describe their risk management, strategy and governance in annual filings. The practical consequence is that materiality has to be assessed quickly, often while facts are still moving.
That is a board-level capability, not a security one. It requires a defined materiality process, a named decision-maker, and enough evidence from systems to support the judgment. Several incidents in this register were disclosed months after the intrusion window began, which is exactly the situation the process exists to handle.
Long-life data belongs on the risk register
Most cyber risk registers measure impact in the current financial year. For data with decade-long sensitivity, that understates the exposure by design. A stolen archive of identity documents or genetic records remains a liability long after the incident response invoice is paid, and anything encrypted with today's public-key cryptography can be stored until it becomes readable.
Boards should ask for that data to be quantified separately: how much the organization holds, where it goes, and whether it is protected with quantum-safe encryption in transit and at rest.
How to brief the board after someone else's incident
When a peer or a supplier is breached, directors will ask whether it could happen here. A useful briefing answers four things in one page: whether we use the affected product or a similar one, whether the entry path exists in our environment, what we would have detected, and what we have changed as a result. Avoid probability scores; they invite debate about the number rather than the exposure.
Conux exists to change the answers to questions two and three. As the cybersecurity gateway every connection passes through, it governs machine identities, enforces policy per connection, applies quantum-safe encryption to long-lived data, blocks in seconds rather than escalating, and logs the evidence that materiality assessments and regulators require. It deploys in front of existing systems, so the board gets the control without a rebuild programme.
To review these metrics against your own environment, talk to our team.
