The Breach

What this pack runs.

Someone got in and took something, and the company knows. That is a technical incident for about a day; after that it is a decision, because the people whose data it is, the regulators whose rules run in days, and the market each have a claim to hear about it. Telling has a price the meeting can add up: the people told at what telling one costs, the customers who leave, and the fine for the breach itself, which is paid whichever route is taken once the breach is known. Hiding has a fee, the intruder's price, and behind the fee a bet on the chance it never surfaces, which no one in the meeting has stated as a number, because no one puts a share on their own concealment being found out. So the meeting prices the telling route whole and the hiding route as a fee, and the smaller number wins by default. This pack prices both routes the same way. What hiding costs is the intruder's price plus the chance it surfaces times everything you would have paid anyway plus the price of the hiding itself, which counsel has never been asked for because counsel prices the breach and not the concealment. Set the two routes equal and the decision reduces to the break-even surfacing chance, how likely the intrusion must be to surface on its own before telling is cheaper, and to one clock: what each day undecided costs, against the days the tightest rule leaves before it reads the silence as concealment. It stops on two halts: no one has stated the chance, and no one has priced the hiding itself.

The casebooks these cases come from.

The pack reads nine sourced decisions through the framework. They are drawn from these casebooks, each one a set of verified records on a single decision type.

A verified record has passed a mechanical claim-versus-source check, a second model's read, and human approval. The count is what exists today, not a target.