Hacker News new | ask | show | jobs
by 0xad 1 day ago
Yes, but (always but!) we also need to take into account what we're aiming at, which is an impact on stock performance. So the company needs to be (1) listed on a stock exchange and (2) have a significant publicly disclosed incident. And it turns out that such cases aren't as common as one might think. :)

As a side note, one can learn a lot from Verizon's DBIR. People familiar with it might even recognize my inspiration.