A newer version of this article will be available for download here in December 2023
An earlier version of this paper was published as a CISSM Working Paper.
Immature classification methods for cyber events prevent technical staff, organisational leaders, and policy makers from engaging in meaningful and nuanced conversations about the threats they face. This paper provides a new taxonomy of cyber effects that is used to analyse over 2,431 publicised cyber events from 2014 to 2016. Industry sectors vary in the scale of events they are subjected to, the distribution between exploitive and disruptive event types, and the method by which data is stolen or by which organisational operations are disrupted. These results highlight significant differences by sector and demonstrate that strategies may vary based on deeper understandings of the threat environment.