Cyber security · Interactive model
The Breach Blast Radius
"We only store a bit of customer data" is where most breach denial begins. Pick what a system actually holds, then breach it — and watch the blast radius: what attackers chain each data type into, who you're legally required to notify, and what it costs. Data you collect isn't an asset sitting still. It's liability waiting for a bad day.
What does this system store?
Blast radius
—est. cost
—must notify
—severity