When calculating potential losses from cyberincidents, statistical data is just as important as its interpretations.