Interesting point of view
Interesting discussion, but I would argue lack of reputational damage is primarily due to lack of competition. If it was easy to switch (and government policies were built around doing everything possible to reduce barriers to entry and switching costs) to other options, reputational damage would likely have far more severe consequences.
I like to use the 2013 Target breach case. They lost $1 billion due to the attack, their stocks dropped significantly after the attack, had several lawsuits, they closed a few stores, and changed the CEO and CIO. But a few months later, all was forgiven, their stocks recovered, and life went on.
Don’t get me wrong, the risks of a cyber attack have to be taken seriously. But I feel that I have overestimated the impacts of reputational damage my whole life, as an infosec professional. My thinking was always like this: if you get reputational damage, you are done, no chance to recover, it is the end of it.
I’m following the Crowdstrike case, but I would bet that they will lose some market share (mostly prospects), perhaps some layoffs, but stocks will come up eventually.
