DeRISK™ Consultant Add-on
DeRISK™ Consultant automates what senior OT security consultants do by hand: it evaluates control posture and produces a prioritized, defensible mitigation plan — ranked by the loss each project removes and written in the framework your team already uses.
Roadmap · Combined-cycle plantIllustrative
Next best recommendation
Privileged access management
Cuts the most loss of 12 options considered
Ranked by loss reduced per year
Gap to target · PAM
Aim & language
Target mode
Plan written in
Same recommendation, in your team's framework
< 1 hour
from assessment to a ranked plan, not weeks
Pennies
not tens of thousands of dollars for consultants to visit every facility every 1–3 years
103
control subcategories behind every recommendation
6
OT security frameworks on one scale
The Consultant chooses the few mitigations that cut the most risk from the full option space, the way a senior OT consultant would, and ranks them by the loss each one removes.
Set the target from the threat and impact your site faces, from the framework you report to, or from the posture an underwriter needs to bind. The finding is the gap to that target, not a raw score.
Recommendations arrive as a sequence across people, process and technology. A control is only recommended once its prerequisites work, so no step depends on one that has not happened yet.
The control, the gap and the target are expressed in whichever framework you run, requirement to requirement. Every translation records its source, direction and rigor.
A control earns a level only when every requirement of it is met. Missing evidence is shown as Unknown with a prompt for what to provide, never as a silent zero or a confirmed gap.
Three parts, one loop. The Assessor scores where you are, the Consultant chooses what to fix and in what order, and the risk engine puts a number on what each fix removes.
See DeRISK Consultant in action
From the assessment to the next-best fix, in less than one hour.
Not the next checkbox. The few mitigations that cut the most risk, ranked by the financial loss each one reduces.
Every gap, target and step expressed in the framework you already report against, so one recommendation serves the auditor, the regulator and the board.
The few improvements that remove the most risk from this submission, in order. Send them back to the applicant as conditions to bind, and offer better terms or a higher limit once they are in place.
Your policy renews on one date each year, but projects finish when the plant allows. Some land months after the last renewal, others are planned for the year ahead, so the market rarely sees the work in time. Line them up on the policy year: what was done since the last renewal, and what is committed before the next one. Your company sets the dates.
One add-on, sold separately, for the premium levels of DeRISK CRQ and the premium tiers of DeRISK UWA.
One add-on, the same in DeRISK CRQ and DeRISK UWA. It turns the assessment into the next-best fix and a roadmap to the target.
Priced separatelyAdded to the premium level or tier you already run
Talk to salesIncludes:
DeRISK CRQ
DeRISK UWAComing soon
Sold separately and added to the premium level or tier you already run. It never attaches to a free level or tier.
What operators and underwriters ask before they act on a recommendation — how it chooses, what it aims for and where it runs.
Talk to salesIt turns an assessment into a plan. The Consultant automates what senior OT security consultants do by hand: it takes the control posture scored for your site, selects the mitigations that remove the most loss, ranks them and lays them out as a multi-step OT cyber roadmap across people, process, technology, maturity and security level.
The assessment tells you where you stand; the Consultant tells you what to do about it. The same agent does both jobs: assessing is included on every paid tier or premium level, and recommending — the next-best recommendation and the roadmap — is the part sold separately as the DeRISK™ Consultant.
It is an add-on for DeRISK CRQ premium levels, Level 3 Board-Grade and above, and for DeRISK UWA Professional and Enterprise. It is coming soon to both. It does not attach to the free levels or to Standard.
It encodes the judgment of senior OT practitioners with more than 20 years of field experience each, and applies it across the full set of possible mitigations to pick the few that cut the most risk — repeatably, and the same way every time.
Those projects are then valued by the risk engine downstream, which attaches the financial loss each one removes — so every step on the roadmap carries a figure you can weigh against its cost.
The one you choose. Risk-based targets come from your site's threat and impact context. Compliance-based targets come from the framework you select. Insurance-based targets aim at the control posture an underwriter requires for binding, coverage or better terms.
Your team's. Every control, gap and target can be expressed in the framework you already work in, including NIST CSF 1.1 and 2.0, CIS, ISA/IEC 62443 and AESCSF, using only published, authority-authored mappings. The recommendation stays the same whichever language it is written in.
Not easily. Each control is scored on three independent axes — where it sits, how technically strong it is and how mature the process running it is — and the three are never averaged. A control only earns a level when every requirement of that level and all below it is met.
Negative indicators such as tribal knowledge or no executive owner override optimistic evidence, missing evidence shows up as Unknown rather than a silent zero, and every ranked item links back to the evidence that produced it.
The loop closes. Once a project is implemented, the site is re-scored, residual risk drops and the roadmap updates to the next-best step. Re-running as evidence changes is part of the product, not a fresh engagement.
In an underwriting pipeline the Consultant runs against an insurability target: it prescribes the controls that would make a risk insurable, or an insurable risk cheaper to cover. That turns a decline or a heavy load into a concrete set of binding conditions the insured can act on.
Separately, and à la carte. The DeRISK™ Consultant is one of five premium add-ons and is never bundled into the tier or level price. Pricing is quoted rather than published — talk to sales for a figure against your sites or your submission volume.
No. The agents are stateless consumers of your data — nothing you supply becomes part of any model, so there is nothing learned from it to remove.
Inference runs privately inside DeNexus’ own cloud environment: outputs are not used to train or improve any model. Invocation logging is disabled in our environment. Your data persists only in DeNexus's own governed storage, where standard deletion controls apply.
Add the DeRISK™ Consultant to DeRISK CRQ from Level 3 Board-Grade, or to DeRISK UWA Professional and Enterprise. Coming soon to both.