Incident Cost vs Prevention Cost

When does prevention pay? The math that's defensible to leadership.

Expected cost

Probability × impact. Multiply for the expected value.

Same incident might be expected $500/year (rare) or $50k/year (frequent).

Prevention cost

Engineering time × rate.

Some preventions are free (configuration); some are months of work.

Decide

If prevention < expected cost: invest.

If prevention > expected cost: accept the risk.