The two big buckets of incident costs are direct and indirect costs. “The direct incident costs are the things that the organization does to immediately get out of that incident,” Draeger said ...