Ponemon Institute
Research institute specialised in the economics of information security and privacy. Produces numerous studies on breach cost, cyber resilience and the cost of insider threats, some commissioned by technology vendors. A reference methodology for self-reported cost quantification.
Structured-interview surveys of security and compliance professionals. Results rest on self-reporting and a proprietary activity-based costing method; they are sensitive to sample composition and to the study sponsor.
Use for cost orders of magnitude and to understand the method underlying the IBM study. Always cross-check against actual claims data before any pricing use.