Two kinds of number appear in your deliverables — the risk benchmarks behind the math, and the vendor prices behind the recommendations. Both are sourced and dated here, so when an auditor asks 'where did this come from?', the answer is one page.
The breach-cost and probability benchmarks behind the ALE math. Refresh cadence per source noted; stale-source warnings render in the PDFs. Each card's as-of date is the honest record of when that source was last verified — a vintage stays pinned and cited as-is until the newer edition is ingested and re-validated.
IBM publishes annual benchmarks per industry + per region. CyberTwin uses the US healthcare figure for HIPAA-scoped engagements; the EU figure for GDPR-scoped engagements.
IBM Security Cost of a Data Breach Report — ibm.com ↗
Median recovery cost + downtime days per industry. Powers the do-nothing scenario ALE for ransomware-heavy industries.
Sophos State of Ransomware — sophos.com ↗
Aggregate BEC loss + median per-incident loss. Anchors the BEC risk class in the ALE model.
FBI IC3 Internet Crime Report — ic3.gov ↗
All ATT&CK techniques + sub-techniques referenced in threat-actor mappings. Updated quarterly when MITRE publishes new techniques.
MITRE ATT&CK Enterprise — attack.mitre.org ↗
Vulnerabilities with confirmed active exploitation. Cross-referenced when surfacing vendor patching priorities.
CISA KEV — cisa.gov ↗
TSC 2017 revised criteria. Compliance scoring crosswalks every CC + Privacy criterion to a control mapping.
AICPA — aicpa-cima.com ↗
Annex A 2022 controls. CyberTwin maps each control to an engine capability + an evidence-collection workflow.
ISO — iso.org ↗
v4.0.1 requirements with March 2025 effective dates. Scope-reduction analysis honors the v4 service-provider categories.
PCI Security Standards Council — pcisecuritystandards.org ↗
ECC v2 controls plus the data-sovereignty + cloud-controls extensions.
Saudi National Cybersecurity Authority — nca.gov.sa ↗
See the per-vendor sourcing manifest at /docs/sources for the publisher URL + the refresh cadence per vendor.
Per-vendor (publisher list price or partner-attested)
Display-only conversion. Polar charges USD regardless. Stale-rate threshold: 14 days.
SAMA (SAR), CBUAE (AED), ECB (EUR), BoE (GBP) — sama.gov.sa ↗ · centralbank.ae ↗ · ecb.europa.eu ↗ · bankofengland.co.uk ↗
CyberTwin auto-fills the questionnaire from tenant data; the canonical question shapes come from the carriers' published forms.
Carrier-published forms (the major cyber-liability carriers)
99+ vendor products across 37 vendor plugins, each carrying a provenance label.
When a vendor publishes a list price on its own pricing page, or lists the SKU on a cloud marketplace (AWS, Azure, Google Cloud), that is the source we use. Microsoft, CrowdStrike, Cloudflare and most SaaS vendors fall here. Every line records the source URL and the date we accessed it, and each product carries the date of its last pricing pass.
When a vendor sells only through the channel and publishes no price, we use the SKU price a major reseller lists publicly (CDW, SHI, AVFirewalls and similar) — most firewall hardware, Fortinet included, falls here — or, failing that, the median of real deals on Vendr, labelled as a benchmark rather than a list price. Each line names its source URL and as-of date.
When no vendor, marketplace, reseller or Vendr benchmark price can be verified — a quote-only product with no deal benchmark, hardware the vendor no longer takes orders for, a figure we could only estimate — the line says not priced, with the reason and the date we checked, and stays out of every total instead of counting as $0. The one modeled case is usage-priced cloud services: computed from the provider's published unit rates, method stated, labelled an estimate.
A sample of the catalog's current pricing pass — every list price was captured and dated in one pass, and each product records that date as last_priced_at. The source type is shown per vendor; the authoritative per-product source URL lives in the manifest and is cited in your report.
| Priced as of | Vendor / product | Source |
|---|---|---|
| 2026-09-25 | Microsoft Entra ID P1 / P2 | List price rose to $7 / $10 per user per month — verified on Microsoft published pricing |
| 2026-09-25 | Okta Workforce Identity | Per-feature pricing retired — priced at the Core Essentials suite from Okta published pricing |
| 2026-09-25 | Fortinet FortiGate 100F / 200F / 600F | End of order reached — no longer recommended or priced; an installed unit is still recognised |
| 2026-09-25 | AWS GuardDuty + Security Hub | Usage-based — the total is a model on AWS published unit rates, now labelled an estimate |
| 2026-09-25 | Wiz (100-workload tiers) | Marketplace list price, re-verified on the vendor’s own AWS Marketplace listing |
| 2026-09-25 | Nightfall AI | The vendor removed every published price — now shown as not priced, never a stale figure |
Every catalog entry carries its full per-vendor manifest — source URL and refresh date included — inside the engine, and each recommendation in your report cites it.
Honest freshness note: the dated pass above is the most recent one, and it is currently past the quarterly target. Until the next pass lands, last_priced_at is authoritative — products older than 6 months trigger the in-report stale-pricing warning, and we recommend re-checking vendor pages before procurement.