Turn OT cyber risk into a number you can defend

No. Levels 1 and 2 run on public company data and a short questionnaire — no network feeds, no agents, nothing installed. Level 3 Board-Grade adds a 50-question control assessment and still needs no telemetry. OT network data enters only at Level 4 Evidence-Grade, for sites that already produce it.

Estimate and Baseline, Levels 1 and 2, are free and share one run allowance between them. Level 3 Board-Grade and Level 4 Evidence-Grade are premium, sold in named tiers.

Pricing is quoted rather than published, because the right tier depends on how many sites you are quantifying and how often. Talk to sales and you will get a figure against your own footprint.

FAIR and FAIR-MAM, the open standards risk teams and insurers already work to, with an OT loss model underneath them: a consequence model, zones and conduits, control evidence and threat context. Each evaluation runs 10,000 Monte Carlo simulations and returns expected loss, value at risk and a loss exceedance curve.

Whichever one your team already runs. The 50-question instrument is available in the DeRISK Control Model, NIST SP 800-82r3 and IEC 62443. You pick one — the analysis underneath is the same, so the choice is about the language your assessors already speak, not about the answer you get.

Board-Grade. Around 80% of industrial sites have no OT telemetry to share, and Board-Grade is built for exactly that case: a full control assessment, facility-level scope and the five role-based reports, with nothing to install.

Level 4 Evidence-Grade is the depth play for the instrumented minority. You can start free at Estimate or Baseline first and move up without redoing anything — the method does not change between levels.

Every result comes with a range, not a single point. The model is the same at every level. A free Level 1 Estimate rests on public data and assumptions, so its range is wide. Your answers at Level 2 and Level 3, and your sites’ OT network data at Level 4, replace those assumptions, and the range narrows.

Each evaluation runs 10,000 Monte Carlo simulations, so you see the spread of possible losses, not only the expected figure.

A score ranks you. A quantification tells you how much money is at stake, at which facility, and what a given remediation is worth. The output is expected annual loss and value at risk in your own currency — a figure a CFO can put in a budget and an underwriter can price, not a letter grade.

Five reports from one assessment, each framed for the person who has to act on it: a board brief, a security posture and remediation report, a financial exposure report the CFO uses to allocate capital, an operational resilience report, and a risk transfer evidence bundle. Every one answers a single question and deliberately leaves out what that reader does not need.

All five unlock at Level 3 Board-Grade.

Separately, and à la carte. Five capabilities attach to any premium level — DeRISK Davy, the DeRISK Consultant, the DeRISK Scenario Simulator, the Threat-Intel Premium Feed and Threat-Intel: Bring Your Own. You take the ones you need and none of them is bundled into the tier price.

None attach to the free levels. And the two CTI add-ons extend the threat intelligence that ships as standard with every level, including the free ones — they never replace it.

No. The agents that run your quantification are stateless consumers of your data — nothing you supply becomes part of any model, so there is nothing learned from it to remove.

Inference runs privately inside DeNexus’ own cloud environment: outputs are not used to train or improve any model. Invocation logging is disabled in our environment, so no copies of requests or responses are created as a side effect. Your assessment persists only in DeNexus's own governed storage, where standard deletion controls apply.