Loss measurement is the practice of estimating the direct and indirect financial impact of a cyber incident. Direct losses can include ransom payments, incident response, system recovery, fraud, legal fees, and regulatory costs. Indirect losses are harder to see but often larger: downtime, missed sales, customer churn, higher insurance premiums, and damage to trust.
In cyber security, loss measurement matters because it turns an attack from a technical event into a business risk that can be compared, prioritized, and funded. Security teams use it to justify controls, choose between competing defenses, and estimate the value of resilience measures such as backups, segmentation, and detection. Attackers also influence loss measurement by creating uncertainty; the longer an incident remains unclear, the harder it is for leaders to calculate business impact. Good loss measurement depends on accurate logs, asset inventories, and recovery data, so organizations can explain what was lost, what was contained, and what still remains uncertain.