Yes, but (always but!) we also need to take into account what we're aiming at, which is an impact on stock performance. So the company needs to be (1) listed on a stock exchange and (2) have a significant publicly disclosed incident. And it turns out that such cases aren't as common as one might think. :)
As a side note, one can learn a lot from Verizon's DBIR. People familiar with it might even recognize my inspiration.
Nice work, but only 30 incidents is a very small sample to learn from
I was about to say the exact same thing! This could easily go 10x to 100x for better info.
Yes, but (always but!) we also need to take into account what we're aiming at, which is an impact on stock performance. So the company needs to be (1) listed on a stock exchange and (2) have a significant publicly disclosed incident. And it turns out that such cases aren't as common as one might think. :)
As a side note, one can learn a lot from Verizon's DBIR. People familiar with it might even recognize my inspiration.