OT Cyber Risk in Production Days

You own the plants, their output, their safety and their uptime. You are paid on the same things. Recruiter guidance ties plant manager bonuses to three to five metrics such as safety, schedule, quality, cost and OEE, with no cyber metric among them,² and among S&P 500 CEO incentive plans with governance metrics, only 5% include cybersecurity.³ Each plant plans its own outages, turnarounds and maintenance around those targets, coordinated only so that shared resources are not stretched across sites. An outage happens when it protects the plan or raises reliability, output or capacity. Nobody hands a plant a window; every job in one earns its place.

Cyber risk is measured somewhere else. Only 6% of organizations name the COO as ultimately responsible for OT security; the CISO has become the most common owner.⁴ Yet the consequences stay with you: the stopped line, the missed orders, the safety exposure. So does the call to stop. Shutting a plant down out of caution is an operations decision, made with whatever is known at the time. When Colonial Pipeline's control room shut the pipeline down in 2021, its CEO said later, "you don't know what you have at that point in time."⁵

Five kinds of operations leader read this paper. The COO who owns OT engineering and OT security, and needs to know where to start. The COO beside a CISO who owns OT security, negotiating every outage and patch across two org charts. The operations head in a business-unit model, who cannot compare plants that each run their own way. The leader of acquired or autonomous plants, who bought the plant and did not get a map of its network. And the operator of regulated infrastructure, for whom reliability is the license to operate and cyber is now part of reliability.

Whichever one you are, you own the consequence of a risk that is measured somewhere else, in units you don't use.

Security findings arrive as vulnerability lists, framework scores and network diagrams. None of them says which line stops, for how long, what that costs in output, or what the fix will disrupt. In SANS's 2022 survey of ICS/OT practitioners, 47.7% named "IT staff does not understand OT operational requirements" as a top challenge, and three of the top four challenges were about fitting IT and OT together, not about adversaries.⁶

So the briefing and the plant talk past each other. The briefing counts criticals. The plant counts hours. A control that adds steps at shift change or blocks a vendor at two in the morning gets worked around: in one vendor survey, about a third of industrial organizations said they switch off security software when it affects production.⁷ Being vulnerable costs nothing until the line stops, which is why reliability and availability topped practitioners' business concerns in every SANS survey from 2019 to 2022.⁶

"Don't tell me about protocols. Tell me which line stops, and for how long." The findings cannot answer that. The question they cannot answer is the only one that fits the operations review: which plant, how long, what it costs, and what the fix will disrupt.

Each figure below names who produced it and when. Company incidents come from the companies' own filings and statements, as DeNexus™'s OT Losses research records them.⁸

How stops start

In Waterfall and ICSSTRIVE's public dataset of attacks with physical consequences, 72% of the consequences from 2010 to 2023 came through the indirect path: precautionary shutdowns, dependence on crippled IT, or a supplier's outage. Every attack that deliberately targeted OT was attributed to hacktivists or nation states, not criminal ransomware. The 2025 edition put the indirect share near 90% for 2024.¹ Waterfall sells OT security, and the dataset counts consequences, not attacks, but the direction is the same across editions.

Clorox fell back to manual ordering at a reduced rate for weeks after its August 2023 attack, and its net sales fell 20% in the quarter.⁹ No public source says its plant control systems were compromised. One supplier's system failure stopped every Toyota plant in Japan: a virus infection shut down Kojima Industries' systems, and Toyota halted 28 lines at 14 plants for a day.^{10 11} Toyota was down one day; Kojima was still restoring systems a month later. Colonial Pipeline shut its pipeline to contain an IT attack, in case OT was compromised; CISA and the FBI later said there was no indication its OT networks were directly affected.^{5 12}

What a day costs

In Siemens' 2024 survey of large plants, an idle line in a large automotive plant costs about $2.3 million an hour, and in consumer goods about $36,000 an hour. The average large plant loses 27 hours a month to unplanned downtime from all causes, and Siemens puts the cost to the world's 500 largest companies at about 11% of revenue.¹³ Siemens sells automation, and it calls its cross-sector totals indicative only, but your own line rate and margin give you the same number for your plant.

How long recovery runs

Jaguar Land Rover's vehicle production was suspended for about five weeks in 2025 after it shut its systems down as a precaution. Manufacturing restarted on a phased basis from 8 October, production returned to normal by mid-November, and JLR reported GBP 196 million and GBP 64 million of cyber-incident costs in successive quarters.^{14 15} The Cyber Monitoring Centre modeled the loss to JLR's UK manufacturing at GBP 108 million a week.¹⁶

JLR figures updated 3 November 2026. Expect new information after this date to change this analysis.

Recovery outlasts the attack. Nearly one in five incidents in SANS's 2025 survey took more than a month to remediate,¹⁷ and 30% of Dragos's incident response cases in 2025 began as an unexplained operational problem, while in its tabletop exercises 82% of asset owners lacked clear criteria for when an odd process event should trigger a cyber investigation.¹⁸ In one measured case, 17 days of malware on Victoria's road safety cameras led to about seven months of degraded service as lapsed certifications queued up.¹⁹ Norsk Hydro ran its plants manually after its 2019 attack, with staff on pen and paper and retired employees coming back to help; its Extruded Solutions business was at 70 to 80% a week later, and the total cost came to around NOK 800 million, about 0.5% of that year's revenue.^{20 21}

None of those plants was stopped by a controller. Each stopped because something it depended on failed, and each paid in days.

The missing number costs operations three times, and the first is the worst.

It costs you on the bad day. The call to stop is yours, made in the first hour with almost nothing known, and the cost of stopping is as real as the cost of not stopping. "When I shut a plant down out of caution, I'm spending millions on a guess."

It costs you in the outage calendar. Every planned outage has more work than slots, and cyber work arrives with no number that says what it protects. In one vendor survey, 85% of OT organizations said they don't patch regularly because of downtime concerns.²² That is not negligence. It is a scorecard doing what it was built to do, with cyber nowhere on it.

It costs you after the stop. The lost output lands on the plant's numbers whatever caused it, and the briefing that might have changed the order of work was in a language the plant never used. Two org charts met at that outage window, and neither had a number the other could set against the plan.

Expected loss is two questions with numbers attached. How often does a loss event happen, and how bad is it when it does? Those are frequency and magnitude, and expected loss is the one multiplied by the other, per facility. For operations, "how bad" has a natural unit: how many days of production are exposed, and at which plant.

"How bad" for a plant is not a data breach. It is the line that stops, the precautionary shutdown, the manual workaround, the equipment that has to be checked or replaced before restart, the recovery tail that runs long after the event, the missed deliveries, and in the worst cases the safety and environmental consequences. DeNexus built its OT loss taxonomy from how industrial incidents cost money rather than from how data breaches do: more than 40 loss types across 20+ perils and 80+ cost drivers.²³ The JLR, Clorox and Toyota stops above are those loss types with a plant's name on them.

How often does an incident happen? That question has a known problem. Public evidence on OT losses is thin and actuarial data is limited. Few companies disclose what an incident cost, and fewer still disclose how it happened. Simulation is the practical way through. A model takes what is known about the company (its sector, its facilities, its revenue, its controls, its threat environment) and runs the plausible incident paths many thousands of times to produce a distribution of outcomes: an expected annual loss, and the loss in a bad year, the 1-in-20 or the 1-in-100. The result is a range with its assumptions and data sufficiency stated, and it narrows as better data about the environment comes in. As more OT incidents are disclosed with their financial impact, that evidence calibrates and validates the model. DeNexus quantification is FAIR-based, with its own implementation and OT loss taxonomy, and fills the gaps FAIR and FAIR-MAM leave in OT. The method is set out in the DeNexus methodology paper.²³

Told in days, the number does three things on the floor.

First, it ranks the plants. Days exposed per facility, with the recovery tail included, shows which plants carry the risk and which single points of failure, a shared IT service, a supplier link, a remote access path, could stop several at once. Those are exposure ranges, not forecasts of the next outage.

Second, it sequences the work. Each fix carries the days it removes, so it can be set against the production target like any other job in the outage, and the order of work can be built around operations rather than against it.

Third, it ends the two scorecards. The CISO's ranking and the plant's priorities become the same list in the same units. "The CISO and I want the same thing. We just keep score differently." With one number, you don't.

DeRISK CRQ puts cyber risk in the operations review's units: facilities, days, and the order of work.

The Operational Resilience & Facility Risk report is four pages, built for the monthly operations review, with no methodology section to wade through. It opens with the exposure per facility, stated in dollars and in days of revenue, the dollar loss divided by the plant's daily revenue, which you can set against your own line rates. It ranks the facilities, maps their posture on a heatmap, and takes the hotspot plant apart: where its risk comes in and what it would lose. It names the entry points operations controls, such as vendor and remote access, and lays out an execution sequence built around production. The DeRISK Consultant add-on names the projects, their scope and their order in less than one hour, and DeRISK CRQ puts the loss each one removes beside it, so the plant sees the scope and the number together. A continuity payoff page shows what the last round of work bought.

You can start without new monitoring. The first result comes from public data about the company and a handful of questions. A Board-Grade result adds about 50 questions and brings the facility-by-facility view, with no OT network data needed to start. Each step narrows the range.

Ask your CISO to bring it in plant terms. If they don't have the number yet, the first result is free, on the COO page at denexus.ai.