How We Verify

Every FIR Risk Tuesday edition and every INTEL brief is built to be used in a real risk assessment, a budget discussion or a board meeting. That only works if you can trust the figures. This page explains how we get them right, and what we do when we don’t.

1. Every figure goes back to the primary source  

We work from the original report, not from press coverage, vendor summaries or social posts about it. Each figure we publish is checked against the primary document, down to the page or table it comes from, before it goes out.

• Exact attribution. When a report says “58% of events,” we don’t write “most attacks.” When a figure applies to a subset (for example, only the costliest events, or only incidents with a known cause), we say so.
• The source’s words, not ours. When we quote, it’s the report’s exact wording. When we interpret, we label it as FIR’s reading.
• What we leave out. If a figure can’t be traced to the source, conflicts within the report itself, or rests on too small a sample, we don’t use it.

This is how every edition is produced today. Some earlier editions were written before we adopted this process; we are reviewing them against their sources and correcting them as we go.

2. One report is a data point. Several are a signal.  

Threat and risk reports come from organizations with different data and different incentives. Many are written by companies that sell a product to fix the problem they describe. That doesn’t make them wrong, but it’s a reason to check.

• We compare findings across independent sources, and where we can, against a source with nothing to sell, such as the Verizon Data Breach Investigations Report or loss data used by insurers.
• When reports measure different things (breaches, incident response cases, insured losses), we compare their direction, not their numbers.
• In our annual report, a finding becomes a “signal” only when several independent sources agree over more than one year.

3. Dates, scope and limits are stated  

Cyber data often trails the present. Loss studies can run a year or more behind, because the full cost of an incident takes time to surface. We tell you when the data was collected, what it covers and what it doesn’t, so you can judge how much weight to give it.

4. How we use AI  

We use AI models, including Anthropic’s Claude and the FIR Risk Platform, to search our research library, read long reports and draft. AI does not get the final word: figures are checked against the primary source documents, and Bruce Bird reviews, edits and approves every piece before it is published.

5. Guidance, not fear  

Our job is to help leaders prioritize, not to alarm them. We focus on what the evidence supports and what an organization can do about it. Board-level guidance is framed as questions and direction, not mandates, and none of it is legal, compliance or security advice for a specific organization.

6. Corrections  

If we get something wrong, we fix it on the page and note what changed and when. If you spot an error, tell us at [email protected] and we’ll check it against the source.

Who is behind this  

FIR Risk Advisory is led by Bruce C. Bird, CMA, CFM. Bruce has spent four decades in accounting, audit, risk and fraud: at Arthur Andersen and KPMG, as a public-company controller, fourteen years leading audit and risk work at Focal Point Data Risk, and building Shutterstock’s global fraud and risk compliance function. Audit taught the habit this page describes: follow the number back to where it came from.