Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've seen data on the cost of a breach including lot of surveys and research by Verizon and the Ponemon Institute. But in terms of an actual vulnerability, what are the factors to consider to determine the cost?

Few things I had in mind are:

  1. Risk factor: SQL Injection vs Reflected XSS
  2. Cost to detect manually or by automated scanners
  3. Cost to fix in terms of developer hours
  4. Costs associated with vulnerability leading to failing a compliance audit

How do you security and risk management professionals determine the cost of a vulnerability?

share|improve this question

3 Answers 3

The cost is not from the vulnerability but from the risk. Namely:

  • A vulnerability is that which can potentially be exploited to put at risk your information assets (e.g. a buffer overflow).
  • A threat is a context element which will try to snoop on or damage your information assets (e.g. an existing group of attackers who would benefit from such actions in some way).
  • A risk is when a threat meets a vulnerability, and they get along well, and marry, and have offspring.

The cost is something applied to whatever you do with the risk. For instance, the cost of ignoring the risk is, roughly, the cost of the damage resulting from the actualization of the risk. On the other hand, the cost of fixing a buffer overflow is purely development & deployment cost, since it removes the vulnerability. The art of risk management is to strike the right balance between corrective actions and acceptance (the "right balance" being relative to the risk management goals, which depend on the organization).

Bottom-line: cost is about what you do, and depends on a lot of contextual elements, in particular threats. You cannot estimate any meaningful notion of cost without taking the context into account. You cannot attach a cost to a vulnerability, or even to a risk; the cost is a property of a set of actions (since "doing nothing" is such a set, some cost is always incurred).

share|improve this answer

Pinning a cost on an exploit is usually going to involve (many) meetings with business users and in the end it's just an educated guess. You might be able to estimate the cost of a 4 hour business disruption due to a denial of service attack however for something like a website defacement you would have to have a chat with management and/or public relations people to determine the damage done to the reputation and the cost of fixing it. Another thing to look at is not only the cost of the attack but the frequency. If it's an easy attack it could happen every day or every hour so you would have to multiply the cost of the attack by the frequency to get a real cost.

I would not include the cost of detecting a vulnerability as a cost of a breach. You should be actively searching for security holes regardless so that should be in a different money bucket like IT or one specifically for Information Security

share|improve this answer

Depends on who is doing the estimating.

If you're the software producer, the cost is the cost to fix the vulnerability. If you're striving for a mature risk management practice, add in the cost of lost business if the vulnerability is going to damage your sales. Ignore the costs in the next paragraph unless there is some insurance or regulatory regime that will assign those costs to you.

If you're the consumer then a standard, simplistic probability x impact may be adequate (albeit coarse and inelegant, but adequate). Figure out the cost of the breach - what would happen if the vulnerability were to be exploited by the adversary (this will be a range, depending on worst case and most likely case). Then the probability that the adversary will be able to take advantage of the vulnerability. For example, even the worst vulnerability is of limited impact if it only occurs on one airgapped server. Multiply the dollar value x probability to calculate a range of risk exposure.

If you're striving for a mature risk management practice, then you should have (or be actively collecting) data to support the analysis in the prior paragraph.

If you're in the health or safety community, you should already have established methods to calculate this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.