## 6 Modeling Data Breach Probability  
The organization's data breach probability relies on some factors: internal [vulnerabilities (if any) that could contribute to a data breach and if they are still open, which would mean that there is inadequate protection], external (attacker motivation and capabilities), or Bayesian (previous breaches can indicate weaker security unless security is dramatically improved as a result of a breach). It is worth noting that some factors that are considered by the Ponemon Institute to influence cost can also be considered to influence likelihood, such as BCM team and data encryption. There are two main factors to predict the data breach probability: number of affected records, lost or stolen, and industry classification of organizations that is considered a factor under the classification of data types of breach. We extracted the probability data from the 2015 Ponemon report [40]. We find that the probability is computed from the size of the data breach and from the country as shown in (Figures 5 and 6). The expression for the probability of data breach based on the breach size as given in (12) is based on the data points in Figure 5 using a trend line for the data. In (12), the probability \(\mathrm{P_{A}}\) represents the annual data probability calculated over a period of 12 months or a year. \[\mathrm{P_{A}}=\ \alpha\mathrm{e}^{(-\beta\mathrm{x})} \tag{12}\]  
where, \(\alpha\) = 0.4405, \(\beta\) = 4 \(\times\) 10\({}^{-5}\), and x is the breach size. After studying the probability of data breach, we found that most researchers estimate the probability based on limited methods, such as surveys and collecting experts' opinions like the Ponemon estimation. Some researchers do not discuss how the probability is computed. Figure 5: Data breach probability based on the breach size (Ponemon data 2015) [36]. Ponemon calculators (Symantec and IBM) use a survey with questions that we identify in this paper as factors to examine the cost and probability incurred by organizations after experiencing data breach incidents. We calculate the probability of data breaches for different periods. The probability of a breach of data type i (P\({}_{\text{i}}\)) calculates the data breach probability (13) for the organization in the next 12 months:  
\[\text{P}_{\text{i}}=\text{F}_{\text{C}}\times\text{F}_{\text{BCM}}\times\text {F}_{\text{I}}\times\text{F}_{\text{BC}}\times\text{F}_{\text{E}}\times\text{ F}_{\text{P}}\times\alpha\text{e}^{(-\beta\text{x})} \tag{13}\]  
where \(\alpha=0.4405\), \(\beta=4\times 10^{-5}\), \(\text{x}\) is the breach size, and the F factors are the six factors that impact the data breach probability. In (13), many probability factors are considered and discussed for calculating the P\({}_{\text{i}}\) in different data types. These factors are the country of the organization that had a data breach F\({}_{\text{C}}\), the organization's business continuity management team involved in the data breach incident response process F\({}_{\text{BCM}}\), the organization's industry classification F\({}_{\text{I}}\), and the most likely cause of a data breach F\({}_{\text{BC}}\), the sensitive data encrypted on all laptops or removable storage F\({}_{\text{E}}\), and the organization's privacy and availability of data protection program F\({}_{\text{P}}\). The factors are multiplied with the probability obtained using (12). Each factor has a default value that is equal to one as well. Each of these factors is discussed below. Probability Factor of Organization's Country (F\({}_{\text{C}}\)): Like the data breach cost, the probability of a data breach is impacted by the country where the data are located. The country-based probability factor data are taken from the 2015 Ponemon report [40]. We take the USA as the default choice. Then, we use a weighted factor for the rest of the countries based on the probability for the US, increasing each year by a small percentage (0.2-0.3%), as presented in [6]. France and Brazil have a relatively higher probability of a data breach.