01 Five incident types, five different mechanisms A data breach, a wave of bad reviews, and a media scandal don't damage revenue the same way, so we don't pretend they do. Each incident type pulls its range from a separate named study, listed in full further down this page. Source: full breakdown in "What the Five Incident Types Measure" below
02 Reach and crisis readiness move the range A local incident and a national one aren't the same exposure, so reach applies a multiplier — 0.5x local, 1.0x regional, 1.8x national. A documented crisis plan cuts the modeled impact by roughly 30%, based on response-speed research. Source: Hot Paper Lantern, Crisis Response Index (80 companies, 105 crises)
03 A range, not a fake-precise number Reviews and media scandals come from elasticity and stock-price studies that genuinely measure cause and effect. Data breach and disinformation figures are global dollar averages rescaled to your revenue — directionally useful, not a guarantee. Source: IBM, Cost of a Data Breach Report (600 organizations)
04 One honest gap, stated upfront Competitor attacks don't have a single dedicated study behind them the way the other four categories do, so that range is treated conservatively and labeled as an analyst estimate rather than dressed up as sourced research. Source: analyst estimate, not a named study