Security
Cyber security and incidents
A breach is a story within hours and a document within weeks, and only the document settles anything. This domain is about the distance between the two - and about what the distance is worth.
Cyber incidents look like the least researchable events on the board, because the facts arrive through attackers, journalists and lawyers rather than through a statistical agency. They are more researchable than they look. Disclosure is regulated with hard deadlines, incident base rates are published annually by named institutions, and the financial consequence is visible in a price series anyone can pull. What is missing is not data but a method for turning it into an estimate.
Each entry here answers a different part of the same question. One works a live case end to end - the GTA 6 leak, its cost to Take-Two, and what it changes for the developers who build the game. One sets out the disclosure rules that decide when an incident becomes an official fact. One supplies the base rates from ransomware economics. One covers the vendors who are paid when incidents rise, including the case where the vendor was the incident. And the last one hands over the method itself, step by step, so the analysis is something you run rather than something you read.
The recurring lesson across all five: the loudest number is usually the least durable one. A market-capitalisation loss quoted from the trough, a ransom demand quoted from the leak site, a breach quoted from an attacker's claim - each is the largest defensible figure available and the one least likely to survive a week.
The GTA 6 leak
A leak is not a delay, a lawsuit is not a loss, and a share price that falls on a Wednesday is not a verdict. This entry separates the three, because a market about any of them settles on a different thing.
Open entryBreach disclosure
A breach becomes tradeable at the moment it becomes a document. Everything before that is reporting, and reporting is not what a market settles on.
Open entryRansomware
Most ransomware coverage reports the demand. The demand is the least informative number in the whole incident, and it is the only one the attacker chooses.
Open entryExploited vulnerabilities
Tens of thousands of vulnerabilities are published each year and a small fraction are ever used against anyone. One federal catalogue is the closest thing to an official record of which ones - and it is short.
Open entrySupply chain attacks
The most efficient way into a thousand organisations is not a thousand break-ins. It is one compromised account belonging to someone all thousand of them already trust.
Open entryCloud outages
The internet is far less distributed than it looks. When it breaks, the cause is almost never an attacker - and the record of what happened is published by the company that broke it.
Open entryCyber security vendors
The trade everyone reaches for after a breach - buy the security vendors - is the one with the least evidence behind it. What actually drives this sector is a budget cycle, not a news cycle.
Open entryRunning the analysis yourself
A risk analysis is two estimates and one multiplication. Everything difficult about it is in deciding what exactly you are estimating - which is why the method starts with a definition and not with a number.
Open entry
How these markets resolve
- A filing with a named regulator, most often a Form 8-K under Item 1.05, timestamped in a public register.
- A statement by the company itself, published on its own channels - frequently the first artefact anyone can cite.
- A customer-observable consequence with a duration: a service outage, a halted operation, a delayed release.
- A named law-enforcement or court action: an indictment, a seizure, a subpoena granted on the docket.