A few years back, I was working with a company that wanted to assess the risk of data compromise across its AWS infrastructure. When we started discussing magnitude, or how much an incident would cost, the initial approach seemed straightforward: find some industry data on breach costs, adjust and validate it with SMEs, and then move on to the modeling.