Cost of incidents

Incident cost is genuinely hard to establish, which is why the figures quoted publicly vary so wildly.

Direct response, lost revenue, regulatory action, customer loss, staff time, legal fees, and the projects that stopped for three months. Most of it is diffuse and some of it never appears in any ledger. That difficulty is exactly why business cases lean on published averages that may bear no relation to your situation.