Has someone else already articulated this?

[Rich Kulawiec <rsk () gsp org>]

If nobody else has, then (in the same wry spirit as Olbermann's
labeling of the Keith Number) I'm gonna slap my name on it.
But if someone has, then I'll give credit where it's due.

        XXX iceberg principle: for every breach reported by an
        organization, there are ten more they're aware of.
        For every breach an organization's aware of, there are
        ten more they don't know about. 

where "breach" may or may not be the right word; I intend for this to
cover privacy disclosures, security incidents, exploitable holes, etc.

---Rsk
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.