Community

The fact is that there is no single source of hard data for an analyst firm to use to develop estimates such as those Gartner recently developed for phishing losses. As an analyst, one has to make assumptions based on the best available market data and what seems reasonable. The problem is that what is reasonable to one analyst is not to another, and some firms do go for the headline grabbing numbers. Numbers can then become "institutionalized" to a certain extent as they are cited again and again in media reports. At some point you may see that the WSJ or some other credible news source cites phishing losses at $3.2B - the Gartner number. At that point, no one is really questioning who originally developed the number or the associated methodology for doing so - it is all viewed as fact - whether the numbers are realistic or not.

Gary's point and Paul's are important for users of analyst firms and their market research products to understand. Numbers such as phishing loss estimates are not hard facts; the methodology varies and should be questioned. Sound methodology makes for well-supported estimates that can lead to better understanding of and planning to address business needs.