Question

A retailer's e-commerce platform experiences credential-stuffing attacks. Currently, each successful breach costs an average of $50,000, and the company suffers about 6 successful breaches per year. A proposed multi-factor authentication and bot-mitigation solution costs $120,000 annually and is expected to reduce the frequency of successful breaches to 1 per year. Based purely on a quantitative cost-benefit analysis, what should the risk manager recommend?

Accepted Answer

Implement the solution, because it produces a net annual benefit of $130,000

Answer

Reject the solution, because its annual cost of $120,000 exceeds the single loss expectancy of $50,000

Answer

Reject the solution, because the residual ALE of $50,000 still represents unacceptable risk

Answer

Implement the solution, because it reduces the annualized rate of occurrence to zero