Victim Counting Methodology

What Victim Counting Methodology Actually Decides

Victim counting methodology is the rule set that determines how many victims a report says exist when claims overlap, entities repeat, or related organisations are grouped together. It is less about the incident itself than about the unit of analysis used to count it.

This matters because two reports can describe the same events yet produce different totals if one counts every public claim and another counts unique organisations. The methodology therefore shapes the apparent scale, trend line, and comparability of the resulting number.

Why Counting Rules Change the Meaning of the Number

The same underlying events can support several valid but different counts. A report may count each disclosed victim separately, collapse subsidiaries into a parent group, or treat repeated claims as a single case. Each choice answers a different question, so the number is only meaningful when the unit of analysis is stated clearly.

That distinction is especially important in sectors with holding companies, franchise structures, affiliates, and rebranded entities. Without a clear methodology, a “victim total” may mix operationally distinct organisations with legally related ones, which can distort severity, repetition, or concentration analysis.

Common Counting Approaches and Their Trade-Offs

Most methodologies fall into a few recurring patterns: unique organisation counting, public claim counting, disclosed entity counting, and group-level counting. Unique organisation counting tries to prevent inflation from duplicate announcements, while claim counting preserves the number of public assertions made by victims, researchers, or intermediaries.

Group-level counting can be useful when the analysis is about corporate exposure, but it may understate how many separate business units were affected. Conversely, claim-based counts can overstate the underlying blast radius when the same incident is reported multiple times. A good methodology explains which cases are merged, which are excluded, and why.

Method choice also affects longitudinal comparisons. A report that changes its counting rules over time can create an artificial rise or fall even when the underlying activity is stable. That is why consistent definitions, explicit edge-case handling, and reproducible inclusion criteria are essential to the credibility of the figure.

How Practitioners Should Read and Use Victim Counts

Readers should treat the number as a measurement convention, not a neutral fact detached from the reporting rules. The key question is whether the count supports the intended analysis: operational impact, public disclosure volume, legal entity exposure, or campaign scale.

When the methodology is unclear, the safest interpretation is to compare only like with like. If one source counts subsidiaries separately and another rolls them up to a parent, the totals are not directly comparable even when they appear to describe the same threat landscape.

Risk and Threat Considerations

Counting choices can create reputational and analytical risk when they make an incident look larger, smaller, or more repetitive than it really is. In threat reporting, that can skew prioritisation, distort trend analysis, and mislead readers about the true scope of a campaign.

Failure mechanism: Duplicate disclosures, overlapping claims, or inconsistent grouping rules can inflate counts, suppress counts, or break comparability across reports, especially when entities are part of the same corporate family.

Impact: Decision-makers may overestimate campaign scale, underestimate concentration risk, or draw incorrect conclusions about attacker volume, sector exposure, or control effectiveness.

Practitioner Guidance

What to watch for: The most useful victim counts state the unit of analysis, explain whether duplicates were deduplicated, and show how parent companies, subsidiaries, and affiliates were handled. If that explanation is missing, the number should be treated as a reporting artefact rather than a precise measurement.

Governance implication: Teams that publish or consume victim metrics should standardise counting rules up front so the figure can be reproduced, compared, and audited over time.

Related resources from NHI Mgmt Group

• When does risk-based prioritisation work better than simple vulnerability counting?
• How should security teams build identity risk into a risk management methodology?
• How do you know if a risk management methodology is actually reducing identity exposure?
• Why does clustering methodology matter in blockchain investigations?