Question 1

What is OT cyber risk quantification and why does it matter?

Accepted Answer

It converts the security posture of an industrial control environment into financial terms — the likelihood and size of loss from a cyber incident — so security spending and insurance decisions can be justified with numbers.

Question 2

How is OT cyber risk quantification different from IT cyber risk quantification?

Accepted Answer

IT models draw on decades of breach data. OT lacks that history and its losses are physical: halted production, equipment damage and safety events. OT models therefore need to account for downtime, replacement, recovery and cascading physical effects.

Question 3

What does “inside-out” data mean in the context of OT risk quantification?

Accepted Answer

Facility-specific telemetry from within the industrial environment — device inventories, scan results, control posture, network architecture, and controller and historian configurations — that shows what a site looks like at a given time.

Question 4

What does “outside-in” data mean and why is it necessary?

Accepted Answer

External information such as threat intelligence, sector attack statistics, adversary techniques, public incidents and vendor vulnerability disclosures. It shows the attacker's capabilities and combines with inside-out data to give a fuller risk picture.

Question 5

Why can't you just use CVSS scores to quantify OT cyber risk?

Accepted Answer

CVSS measures a vulnerability's technical severity, but not how likely exploitation is in a given environment, what it would cost, whether patching is feasible or how far an attack could spread. Quantification requires modelling the full attack path and its financial consequences.

Question 6

What financial outputs should OT risk quantification produce?

Accepted Answer

At minimum, Annual Expected Loss (the probability-weighted yearly loss) and Value at Risk at a high confidence level. Loss exceedance curves and control rankings by expected loss reduction per dollar are also useful for prioritising remediation.

Question 7

What is bottom-up portfolio risk aggregation and why does it matter for industrial operators?

Accepted Answer

Each facility is modelled on its own data and the results are then aggregated to the portfolio level. This shows which sites drive the most exposure — far more useful than averaging risk across a portfolio.

Question 8

How does OT cyber risk quantification support cyber insurance decisions?

Accepted Answer

It gives insurers and operators structured evidence — expected loss, Value at Risk and documented control posture — so coverage can be negotiated on facts rather than on a narrative questionnaire.

Question 9

How often should OT cyber risk quantification be updated?

Accepted Answer

Continuously, or at least quarterly. Threats, environments and incident data change over time, so a one-time annual assessment quickly becomes outdated.

Question 10

What is the difference between a risk score and a quantified risk number?

Accepted Answer

A risk score is a relative ranking that indicates priority but not absolute exposure. A quantified number is a dollar figure with an associated probability that boards and CFOs can use directly for reserves and insurance sizing.

Question 11

Why do OT environments need different cybersecurity frameworks than IT environments?

Accepted Answer

OT systems have different architectures, operational constraints and risk profiles. They prioritise availability, run for decades without patching and often cannot host security software, so IT frameworks do not fit them well.

Question 12

What is NIST CSF and is it appropriate for OT environments?

Accepted Answer

NIST CSF organises security into core functions and gives boards a common management language, but it lacks the OT-specific technical detail needed to implement controls. Organisations usually pair it with IEC 62443 for the technical layer.

Question 13

What is IEC 62443 and why was it developed specifically for industrial environments?

Accepted Answer

IEC 62443 is the international standard series for securing industrial automation and control systems, built around availability, long asset lifecycles, operational patching windows and the physical consequences of security failures.

Question 14

What is MITRE ATT&CK for ICS and how does it differ from the Enterprise matrix?

Accepted Answer

A knowledge base of adversary tactics aimed at industrial control systems, where attackers typically aim to manipulate or destroy physical processes rather than steal data. It includes tactics with no Enterprise equivalent, such as Inhibit Response Function and Impair Process Control.

Question 15

What is NIST SP 800-82 and how does it relate to IEC 62443?

Accepted Answer

NIST SP 800-82 is a US guide for securing OT across critical infrastructure. It complements IEC 62443, which has greater international recognition and is better suited to certification; many organisations map to both.

Question 16

Is ISO 27001 sufficient for industrial environments?

Accepted Answer

No. ISO 27001 was designed for IT information security and its controls do not fit environments where availability is critical and assets last decades. Organisations usually apply it to IT and IEC 62443 to OT.

Question 17

What is NERC CIP and who does it apply to?

Accepted Answer

A mandatory set of cybersecurity standards for bulk electric system operators in North America that meet specific impact thresholds. Energy organisations often implement it alongside IEC 62443 for deeper technical coverage.

Question 18

What is NIS2 and which organizations does it affect?

Accepted Answer

The EU's Network and Information Security Directive, effective October 2024. It requires essential and important entities in 18 sectors to implement security measures and report significant incidents; regulators recognise IEC 62443 as an appropriate way to demonstrate OT compliance.

Question 19

How do these frameworks relate to each other in practice?

Accepted Answer

They work at different levels: NIST CSF and ISO 27001 provide governance, IEC 62443 the OT technical controls, MITRE ATT&CK for ICS the threat vocabulary, and NIST SP 800-82, NERC CIP and NIS2 sector-specific or mandatory requirements.

Question 20

How does DeNexus map its risk outputs to these frameworks?

Accepted Answer

DeRISK outputs align with NIST CSF, ISO 27001 and the proprietary DNX CSF, based on IEC 62443 and NIST principles. Attack scenarios follow MITRE ATT&CK for ICS, and control assessments can be mapped to NIS2 or NERC CIP requirements.

Question 21

What does OT risk management mean in practice?

Accepted Answer

The continuous process of identifying OT cyber risks, quantifying their financial impact, prioritising mitigation, implementing controls within operational limits and transferring residual risk, for example through insurance.

Question 22

Why can't OT environments simply adopt IT security practices?

Accepted Answer

OT assets cannot follow IT patch schedules, availability is the top priority, endpoint agents often cannot be installed on controllers, IT log tools cannot ingest process data and IT-style segmentation can disrupt deterministic traffic.

Question 23

What is the relationship between OT risk management and cyber insurance?

Accepted Answer

Risk management reduces the likelihood and size of losses through controls; insurance transfers what remains. Quantified figures from risk management help size coverage correctly and negotiate better terms.

Question 24

How should OT risk be prioritized when resources are limited?

Accepted Answer

By the greatest expected loss reduction per dollar spent — not by CVSS scores, checklist completion or backlog size. A segmentation project that cuts more expected loss can be worth more than a scanning tool that closes more CVEs.

Question 25

What is the role of asset inventory in OT risk management?

Accepted Answer

It is the foundation: assets that are unknown cannot be assessed or modelled. Undocumented legacy devices and contractor-installed equipment are common gaps to close before Crown Jewels assessments can be done.

Question 26

How do you manage OT cyber risk across a portfolio of facilities?

Accepted Answer

Model each facility on its own data, then aggregate to see portfolio metrics, tail-risk drivers and where investment reduces loss most. Managing to the average hides the worst sites.

Question 27

What is the IT/OT boundary and why is it the most critical risk surface?

Accepted Answer

The interface between corporate IT and industrial OT networks — historians, remote access tools, dual-connected engineering workstations and DMZs. Most recent OT attacks have crossed it, so protecting it is often the highest-return control investment.

Question 28

How does OT risk management change as environments become more connected?

Accepted Answer

Cloud links, remote monitoring, vendor access and enterprise integration create new paths into control networks. Each new connection needs assessment, boundary monitoring must continue and the risk model must reflect the new architecture.

Question 29

What does good OT risk governance look like at the board level?

Accepted Answer

A defensible financial figure such as Annual Expected Loss, reviewed quarterly, with peer comparisons, worst-case scenarios and evidence that specific controls are maintained — with the CISO translating technical risk into financial terms.

Question 30

How does OT risk management relate to operational resilience?

Accepted Answer

It protects the ability to keep critical processes running through disruption. Process-centric threat models, which start from what the organisation must protect, tend to be more effective than asset-centric vulnerability lists.

Question 31

What is DeRISK CRQ?

Accepted Answer

The cyber risk quantification product of the DeRISK Platform. It converts OT cyber exposure into dollar figures at facility and portfolio level, powered by the URMS engine.

Question 32

How does DeRISK CRQ collect data about a facility?

Accepted Answer

Inside-out data comes from passive monitoring integrations such as Dragos, Claroty, Nozomi, Forescout and Tenable. Outside-in data comes from the DeNexus knowledge base: threat intelligence, incident data, MITRE ATT&CK for ICS TTPs and firmographics.

Question 33

What financial outputs does DeRISK CRQ produce?

Accepted Answer

Annual Expected Loss, Value at Risk, loss exceedance probability curves and ranked action points — every output with a traceable evidence chain back to its inputs.

Question 34

What sectors and environments does DeRISK CRQ support?

Accepted Answer

Four sectors today: Power Generation, Electrical Transmission & Distribution, Manufacturing, and Hyperscale / Data Centers — each with its own model reflecting its assets, processes and threats.

Question 35

How is the risk model calibrated and what makes it defensible?

Accepted Answer

The URMS engine is calibrated on more than 300 real industrial deployments. It is defensible because every output can be traced to the specific inputs that produced it.

Question 36

How does DeRISK CRQ support investment prioritization?

Accepted Answer

What-if simulation estimates how much a proposed control — segmentation or endpoint detection, for example — would reduce Annual Expected Loss, so projects can be ranked by loss reduction relative to cost.

Question 37

How does DeRISK CRQ handle the challenge of limited OT incident data?

Accepted Answer

It combines sector-specific modelling, MITRE ATT&CK for ICS adversary data and DeNexus's proprietary incident and loss data, and reports confidence ranges rather than only point estimates.

Question 38

How does DeRISK CRQ support peer benchmarking?

Accepted Answer

Site- and portfolio-level comparisons of AEL, VaR and control posture against same-sector peers, giving CISOs and CFOs a reference point for board discussions.

Question 39

What does the deployment process for DeRISK CRQ look like?

Accepted Answer

SaaS on AWS. Integration with existing OT security tools typically takes one to two weeks per site, and the platform runs 50 million simulations per site every week.

Question 40

Who uses DeRISK CRQ and for what decisions?

Accepted Answer

CEOs and boards for risk reporting, CFOs for capex and insurance sizing, CISOs for remediation priorities and CROs for risk transfer — replacing judgement-based decisions with evidence-based financial ones.

Question 41

What is DeRISK QVM?

Accepted Answer

The OT vulnerability management product that ranks each CVE by its expected financial impact rather than its CVSS score, and outputs a remediation roadmap sequenced within operational constraints.

Question 42

Why is traditional vulnerability management inadequate for OT environments?

Accepted Answer

CVSS ranks technical severity without environment-specific exploitability or financial consequence, and OT patching depends on maintenance windows and vendor coordination — so severity-ordered work can leave high-consequence vulnerabilities open.

Question 43

How does DeRISK QVM rank vulnerabilities differently from CVSS?

Accepted Answer

It calculates each CVE's expected reduction in Annual Expected Loss from exploitability, attack paths, asset criticality and financial consequence. A flaw giving access to a critical controller can outrank a higher-CVSS flaw on an isolated device.

Question 44

What does “constraint-aware sequencing” mean?

Accepted Answer

The remediation plan respects real operational limits — maintenance windows, vendor patch availability, uptime requirements and staffing — so it can actually be executed.

Question 45

How does DeRISK QVM integrate with existing OT security tools?

Accepted Answer

Through the same connectors as DeRISK CRQ — Dragos, Claroty, Nozomi, Forescout and Tenable — adding a financial prioritisation layer on top of their data rather than replacing them.

Question 46

How does QVM help CISOs communicate with CFOs?

Accepted Answer

It turns remediation requests into financial terms — expected AEL reduction and implementation cost per prioritised project — so the conversation is about capital allocation, not CVE lists.

Question 47

What governance framework outputs does DeRISK QVM produce?

Accepted Answer

Remediation outputs mapped to NIST CSF, ISO 27001 and the DeNexus DNX CSF framework, supporting regulatory reporting and audit preparation.

Question 48

How does DeRISK QVM handle end-of-life assets?

Accepted Answer

It models them as an explicit risk factor instead of recommending impossible patches, then recommends compensating controls such as isolation, enhanced monitoring or access restrictions.

Question 49

Is DeRISK QVM a standalone product or does it require DeRISK CRQ?

Accepted Answer

It can be used on its own, but it shares infrastructure, connectors and the risk model with DeRISK CRQ. Most deployments include both with no extra integration effort.

Question 50

How does DeRISK QVM improve over time?

Accepted Answer

The risk model is updated continuously as new CVEs, threat intelligence and incident data enter the DeNexus knowledge base, so shifts in the threat landscape flow into prioritisation.

Question 51

What is DeRISK UWA?

Accepted Answer

An agentic AI platform for industrial cyber insurance underwriting. It accepts submissions in any format and produces Expected Loss, Maximum Foreseeable Loss, an OEP curve and a structured program with binding conditions in 10–20 minutes.

Question 52

Who is DeRISK UWA designed for?

Accepted Answer

Insurers, reinsurers and brokers underwriting industrial cyber risk. Actuaries, Chief Underwriting Officers and Chief Risk Officers at industrial operators also use its outputs.

Question 53

How does the five-agent pipeline work?

Accepted Answer

Five agents run in sequence — Ingestion, IT Risk, OT Risk, CTI and Financial Logic — normalising the submission, evaluating IT and OT controls, injecting threat intelligence and performing the actuarial calculation.

Question 54

What is the “Sound of Silence” methodology and why does it matter?

Accepted Answer

Unanswered questions are treated as risk signals, not neutral gaps. UWA scores IT and OT confidence separately and flags strong IT disclosure paired with missing OT answers.

Question 55

What questionnaire formats does DeRISK UWA support?

Accepted Answer

It is pre-trained on formats from several major brokers and carriers plus generic OT/ICS and ransomware supplementals, can be configured for proprietary carrier formats, and its Ingestion Agent accepts many file types.

Question 56

How does DeRISK UWA handle the OT-specific complexity that generic AI tools miss?

Accepted Answer

A dedicated OT Risk Agent evaluates OT posture against IEC 62443 and NIST SP 800-82, recognising that strong IT controls do not guarantee good OT security.

Question 57

What does the actuarial output look like?

Accepted Answer

Expected Loss, Maximum Foreseeable Loss at set confidence levels, an OEP curve, an insurance program with coverage terms and a premium indication — with every number traced to its inputs and missing data flagged.

Question 58

How does DeRISK UWA protect customer data?

Accepted Answer

In-context learning in isolated sessions, so submission data never trains models. The platform is SOC 2 Type II certified, uses TLS 1.3 and AES-256 encryption, and offers single-tenant or private deployment.

Question 59

How does DeRISK UWA integrate with existing underwriting systems?

Accepted Answer

Through APIs and sidecar integrations including Guidewire and Rulebook, with SSO and RBAC via identity providers such as Okta and Azure AD, and full access logging for audit.

Question 60

What regulatory requirements does DeRISK UWA cover?

Accepted Answer

Outputs are mapped to 28 regulatory requirements across the US (NAIC), UK (FCA), the Lloyd's market and the EU (EIOPA).

Question 61

How does DeRISK UWA support cyber insurance accumulation modeling?

Accepted Answer

It produces structured, comparable outputs for every submission, including scenario-level loss data, which feed directly into portfolio accumulation models through EL, MFL and OEP outputs.

Question 62

What is Agentic AI and how is it different from generative AI?

Accepted Answer

Generative AI responds to a prompt and stops. Agentic AI perceives its environment, sets sub-goals, uses tools and completes multi-step workflows — for example reading a submission, querying intelligence, running the calculation and flagging gaps.

Question 63

What does a multi-agent architecture mean and why does it produce better results than a single model?

Accepted Answer

Specialised roles are assigned to separate agents and orchestrated together. Specialisation reduces hallucination, improves consistency and lets each agent be calibrated and validated independently.

Question 64

What is RAG (Retrieval Augmented Generation) and why does it matter for industrial cyber insurance?

Accepted Answer

RAG lets an agent retrieve current information from a curated knowledge base at inference time — essential because threat intelligence changes often and OT equipment detail is not in public training data.

Frequently Asked Questions

Browse by topic

Still have questions? Our team has answers.