Two kinds of number appear in your deliverables — the risk benchmarks behind the math, and the vendor prices behind the recommendations. Both are sourced and dated here, so when an auditor asks 'where did this come from?', the answer is one page.
The breach-cost and probability benchmarks behind the ALE math. Refresh cadence per source noted; stale-source warnings render in the PDFs. Each card's as-of date is the honest record of when that source was last verified — a vintage stays pinned and cited as-is until the newer edition is ingested and re-validated.
IBM publishes annual benchmarks per industry + per region. CyberTwin uses the US healthcare figure for HIPAA-scoped engagements; the EU figure for GDPR-scoped engagements.
IBM Security Cost of a Data Breach Report — ibm.com ↗
Median recovery cost + downtime days per industry. Powers the do-nothing scenario ALE for ransomware-heavy industries.
Sophos State of Ransomware — sophos.com ↗
Aggregate BEC loss + median per-incident loss. Anchors the BEC risk class in the ALE model.
FBI IC3 Internet Crime Report — ic3.gov ↗
All ATT&CK techniques + sub-techniques referenced in threat-actor mappings. Updated quarterly when MITRE publishes new techniques.
MITRE ATT&CK Enterprise — attack.mitre.org ↗
Vulnerabilities with confirmed active exploitation. Cross-referenced when surfacing vendor patching priorities.
CISA KEV — cisa.gov ↗
TSC 2017 revised criteria. Compliance scoring crosswalks every CC + Privacy criterion to a control mapping.
AICPA — aicpa-cima.com ↗
Annex A 2022 controls. CyberTwin maps each control to an engine capability + an evidence-collection workflow.
ISO — iso.org ↗
v4.0.1 requirements with March 2025 effective dates. Scope-reduction analysis honors the v4 service-provider categories.
PCI Security Standards Council — pcisecuritystandards.org ↗
ECC v2 controls plus the data-sovereignty + cloud-controls extensions.
Saudi National Cybersecurity Authority — nca.gov.sa ↗
See the per-vendor sourcing manifest at /docs/sources for the publisher URL + the refresh cadence per vendor.
Per-vendor (publisher list price or partner-attested)
Display-only conversion. Stripe charges USD regardless. Stale-rate threshold: 14 days.
SAMA (SAR), CBUAE (AED), ECB (EUR), BoE (GBP) — sama.gov.sa ↗ · centralbank.ae ↗ · ecb.europa.eu ↗ · bankofengland.co.uk ↗
CyberTwin auto-fills the questionnaire from tenant data; the canonical question shapes come from the carriers' published forms.
Carrier-published forms (the major cyber-liability carriers)
99+ vendor products across 37 vendor plugins, each carrying a provenance label.
When a vendor publishes a per-seat / per-endpoint list price publicly, that's the source we use. Microsoft, AWS, Cloudflare, and many SaaS vendors fall here. Refresh cadence: quarterly. The source URL is recorded for every entry.
When a vendor sells exclusively through resellers + does not publish list price, we use a partner-attested rate (i.e., a number a current reseller has confirmed in writing). Used for most appliance vendors (Palo Alto, Fortinet, Cisco). Refresh cadence: semi-annual. We flag these entries in the PDF with a "partner-attested" provenance label.
When neither list price nor partner attestation is available, we use the median price across recent public RFP awards (gov, education) for the same SKU. Refresh cadence: annual. These entries carry the most cautious "estimate" provenance label.
A sample of the catalog's current pricing pass — every list price was captured and dated in one pass, and each product records that date as last_priced_at. The source type is shown per vendor; the authoritative per-product source URL lives in the manifest and is cited in your report.
| Priced as of | Vendor / product | Source |
|---|---|---|
| 2026-05-06 | Microsoft Defender for Endpoint P2 | Per-user list price, verified from Microsoft published pricing |
| 2026-05-06 | CrowdStrike Falcon Insight XDR | Quote-based — unit price from analyst / partner benchmark |
| 2026-05-06 | Fortinet FortiGate 100F | Appliance list price, verified from public reseller listings |
| 2026-05-06 | AWS GuardDuty / Detective | Usage-based — unit price from AWS published pricing |
| 2026-05-06 | Okta Workforce Identity Cloud | Per-user list price, verified from Okta published pricing |
Every catalog entry carries its full per-vendor manifest — source URL and refresh date included — inside the engine, and each recommendation in your report cites it.
Honest freshness note: the dated pass above is the most recent one, and it is currently past the quarterly target. Until the next pass lands, last_priced_at is authoritative — products older than 6 months trigger the in-report stale-pricing warning, and we recommend re-checking vendor pages before procurement.