Nevada Published a $1.5 Million Incident Response Bill

Reporting on Nevada’s after-action account records the state spending approximately $1.5 million on incident response.

This database is full of modelled averages: $3.54 million for retail at 25-0808, $6.08 million for financial institutions at 25-0616, $5.08 million for law firms at 25-0910, $1.3 million recovery for manufacturers at 25-1204.

Every one is a survey average across organisations of wildly differing size, which this desk has repeatedly said no individual organisation should plan against. Nevada published what it actually spent, on a named incident, with a scope anyone can inspect.

A statewide compromise of sixty agencies with a 28-day outage cost less in response than the sector averages this corpus quotes for a single mid-sized company breach.

The likeliest explanations are that pre-negotiated vendor agreements at 25-0921 avoided emergency rates, that no ransom was paid, and that the $1.5 million counts response rather than total cost — excluding staff time, service backlog and the reconstruction of the unrecovered 10%.

The corpus should not read it as evidence that state incidents are cheap. It should read it as evidence that "cost of a breach" figures are measuring different things and rarely say which.

A company disclosing its response spend hands a plaintiff’s firm a starting figure — the litigation constraint at 25-1107. A state publishes because public money was spent and somebody will ask.

So the only reliable incident costs in this corpus come from organisations that had no choice but to publish them. Every other figure here is an estimate produced by a party with an interest in the number.