A Data Breach Now Costs $4.99 Million on Average. What Leadership Must Do Before Launch

01What the Rules Require

If your app handles personal data of people in the EU, GDPR applies. Many organizations in the EU also fall under NIS2, and companies that sell digital products in the EU now have reporting duties under the Cyber Resilience Act. This overview isn’t legal advice, but it will tell you what to ask your lawyer. If your app uses AI, the AI Act adds its own obligations, covered in The AI Act Wasn’t Delayed.

GDPR

1. Report a personal data breach to your data protection authority within 72 hours of becoming aware of it. If the risk to people is high, tell them too.
2. Keep records of processing activities and have data processing agreements with every vendor that touches the data: hosting, email delivery, analytics, AI services, and support tools.
3. Security has to match the risk (Article 32).
4. For high-risk processing (health data, large-scale monitoring, profiling), you need a data protection impact assessment (DPIA) before launch.

NIS2

The directive covers medium and large organizations, and some smaller ones such as DNS providers and domain registrars, in sectors such as energy, transport, health, digital infrastructure, ICT service management, and digital providers like online marketplaces, search engines, and social networks, and each EU country enforces it through its own national law (NIS2 Directive). It requires risk management measures including incident handling, business continuity, supply chain security, and multi-factor authentication.

Even if you’re not covered directly, NIS2 can reach you through your customers. If you sell software to a hospital, an energy company, or a government agency, they have to manage supply chain security, including their suppliers’ secure development practices, so expect those requirements in your contract. Expect audits, incident reporting deadlines, and secure development requirements.

Cyber Resilience Act

The EU regulation fully applies from December 11, 2027. The duty to report actively exploited vulnerabilities and severe incidents, though, started on September 11, 2026 (European Commission), and it also covers products you placed on the market earlier (Better Regulation).

The CRA covers products with digital elements, meaning software and hardware you sell or distribute: mobile apps, desktop software, plugins, themes, or firmware. A pure web service (SaaS) is usually out of scope, but remote data processing that a product can’t work without is covered. If you ship a mobile app or installable software alongside your web app, check with a lawyer.

Outside the EU

In the US, breach notification rules are set mostly by individual states and by industry regulators, so deadlines vary. If you have customers in several jurisdictions, map out every deadline that applies to you in advance.

02Your Incident Response Plan

The worst damage in an incident happens in the first hours, when nobody knows what to do. Reporting clocks start the moment you become aware of the incident, and the shortest one is just 24 hours.

What the plan needs

1. A decision maker. One person, plus a backup, who can take the service offline, lock accounts, or roll back a deploy, even at 3 a.m.
2. Contacts in one place that stays reachable when company systems are down: developers, hosting, cloud, DNS, legal counsel, your data protection officer, your insurer, and PR.
3. Playbooks for the most common scenarios: a leaked key, a compromised admin account, a database leak, ransomware, DDoS, and a malicious dependency version.
4. Kill switches: maintenance mode, a way to sign out every user, and switches to turn off signups or a specific feature without a new deploy.
5. An inventory of every secret and a way to rotate them all at once.
6. Evidence rules. Copy logs and disk snapshots before restoring, or you’ll never know what happened.
7. Prewritten templates for customers and regulators. Writing them under pressure is slow and error-prone.

Run the plan once as a tabletop exercise. An hour around a table with the scenario “on Friday night, a customer sends us a link to our database on a hacker forum” will quickly show you where the plan breaks.

A channel for vulnerability reports

Ethical hackers will find bugs in your app too. If they don’t know who to tell, they’ll post about it on social media or say nothing.

1. Publish a /.well-known/security.txt file following RFC 9116. It requires a contact and an expiration date. There’s a generator at securitytxt.org.
2. Set up an address like security@yourcompany.com that someone actually reads.
3. Publish a short vulnerability disclosure policy: what researchers may test, how fast you’ll respond, and a promise not to take legal action if they follow the rules. For makers of products under the Cyber Resilience Act, such a policy is mandatory.

How to test it

Ask a colleague outside engineering what they’d do if a data breach alert came in overnight. If they don’t know, you don’t have a plan.

03Penetration Testing: When, How Much, and What to Watch For

Automated tools find known bugs cheaply and repeatedly. A penetration tester finds flaws in logic and permissions that no scanner can. You need both. Schedule the test two to four weeks before launch, so there’s time for fixes and a retest.

What it costs

A web app or SaaS pen test typically runs $5,000 to $30,000, and a standard commercial engagement $10,000 to $35,000 (Blaze Information Security). Price depends mainly on the number of user roles, endpoints, and applications in scope, and on whether a retest is included. Next to an average breach cost of $4.99 million, it’s a small line item.

What to agree on with the testing firm

1. Scope: web app, API, mobile app, admin panel, and every user role.
2. A gray-box test. The tester gets test accounts for each role and your API documentation. A black-box test at the same price will find less.
3. Methodology: the OWASP Web Security Testing Guide, or verification against the OWASP ASVS standard.
4. A report with severity ratings (CVSS), reproduction steps, and recommended fixes.
5. A retest after fixes, included in the price.
6. A test environment that mirrors production, and written approval from your hosting or cloud provider if they require it.

After launch

Consider a private bug bounty program through HackerOne, Intigriti, or YesWeHack. Start with a few invited researchers. A public program will flood your team with reports in the first weeks and only makes sense once someone can handle them. Repeat the pen test once a year and after every major change.

04What to Ask Your Vendor

If an agency or freelancer builds your app, you still own the responsibility for a data breach. Regulators and customers won’t care who wrote the bug. Ask these questions before you sign, and get the answers in writing.

Questions for choosing a vendor

1. What standard do you follow for secure development? A good answer mentions OWASP ASVS, or at least the OWASP Top 10:2025, plus specific tools.
2. What automated security tests run in your pipeline? Ask to see sample output.
3. Who reviews code and how, including code written by AI?
4. How do you manage secrets, and which of your people will have production access?
5. How fast will you patch a critical vulnerability in a library if it’s disclosed after handover?
6. Who arranges the penetration test, and who pays to fix the findings?

What to put in the contract

1. Security requirements as part of the spec, for example by referencing a checklist or an OWASP ASVS level.
2. An independent pen test before handover, with critical and high findings fixed at the vendor’s cost.
3. Deadlines for fixing vulnerabilities after launch, such as critical within 48 hours, and how long that commitment lasts.
4. An obligation to notify you of a security incident within 24 hours at the latest. With GDPR and NIS2 deadlines, you can’t afford to wait.
5. A data processing agreement under GDPR if the vendor touches personal data.
6. Handover of all access, source code, documentation, and the secrets inventory when the engagement ends. Cloud, domain, and repo accounts should be yours from day one, with the vendor only granted access.
7. A list of third-party components (SBOM) and their licenses.
8. If NIS2 applies to you, the supply chain security requirements your national rules call for.

Red flags

“Don’t worry, we handle security” with no specific tools behind it. A vendor who wants the domain and cloud on their own account. A proposal that never mentions testing or security. Pushback on an independent pen test.

05Leadership Checklist

Before launch

• You know whether NIS2 applies to you.
• You know whether the Cyber Resilience Act covers your product.
• GDPR records of processing and data processing agreements are in place, plus a DPIA for high-risk processing.
• The incident plan names a decision maker and includes contacts, playbooks, and kill switches.
• Reporting deadlines (GDPR 72 hours, NIS2 and CRA 24 hours) are in the plan with named owners.
• A pen test is done, and critical and high findings are fixed and retested.
• The vendor contract includes security requirements, fix deadlines, and incident reporting.
• Cloud, domain, and repo accounts belong to the company.
• A security.txt file exists, and the address in it works.
• The team knows who’s on call for the first days after launch.

Ongoing

• A tabletop exercise once a year.
• A pen test once a year and after major changes.
• A quarterly review of production access and a backup restore test.
• Regular security training for the team.

The technical items for developers and ops are in Change One Number in the URL, One npm install Was All It Took, and They Already Know Your Staging Server.

06The Full Web App Security Series

The five-part series covers your whole app, from code to servers to leadership:

• The 105-point checklist for your whole app
• Code flaws that leak data
• API keys, dependencies, and npm attacks
• Servers, HTTPS, cloud, backups, and logging
• What leadership must do: GDPR, NIS2, CRA, and pen tests (you are here)

07FAQ

08Sources

All figures are current as of September 27, 2026.

• SecureWorld: IBM 2026 Cost of a Data Breach Report
• GDPR (EUR-Lex)
• NIS2 Directive (EUR-Lex)
• European Commission: Cyber Resilience Act reporting obligations
• Better Regulation: EU Cyber Resilience Act, Preparing for Vulnerability and Incident Reporting
• Blaze Information Security: Penetration testing cost 2026
• securitytxt.org