OT Cyber Risk in the Boardroom

The board's job is oversight, not operations. You see what management brings you, in the minutes it has, and the law lets you rely in good faith on what officers report.³ Cyber is getting more of that time. In PwC's 2023 survey of 619 public-company directors, 64% said their board had given it more agenda time, and 87% rated management's cyber pre-reads effective.⁴ In the Fortune 100, 78% of companies place cyber oversight with the audit committee, and 86% disclose cyber as an expertise a director has or the board is seeking.⁵

OT gets far less. Only 16% of organizations with OT give their boards OT security reports,¹ and NACD's 86-page handbook on cyber-risk oversight mentions operational technology three times, each time inside a list.²

Five readers sit around this table, and each needs one sentence. The CEO of an industrial company, for whom cyber is one risk among many and the incident calls are theirs. The audit committee chair, with a crowded agenda and a duty to show diligent oversight. The risk committee member, who needs cyber beside the other enterprise risks. The director who has run plants and knows production, not cyber. And the EU board member, who under NIS2 approves and oversees the measures and can be held liable for them.⁶

Whichever seat is yours, the question is the same. Is this a big risk or a small one, compared with the others, and is it getting better? The board can only oversee what it can compare.

A heat map puts cyber on a grid of likelihood and impact and colors the cell. It cannot be ranked against the credit risk, the commodity risk or the safety risk beside it, because those carry numbers. A peer-reviewed study of risk matrices found that they can give very different risks the same rating, and can rank a smaller risk above a larger one.⁷ A maturity score is a grade for the program, not a measure of what the company could lose.

The briefing makes it worse by arriving from several directions. The CISO brings scores, the COO brings downtime, the CFO brings budgets, and nobody brings one shared figure. NACD's handbook says many boards still get cyber updates that are "overly technical" or "disconnected from business objectives," and it tells boards they may ask for "quantified exposure in financial terms" for their top scenarios.² So the question the color cannot answer is the one the board is there to ask: compared with the other risks we oversee, how big is this one, and is it shrinking?

Each figure below names who produced it and when. None is merged with another.

Where cyber ranks

In the Allianz Risk Barometer 2026, a survey of 3,338 risk experts in 97 countries, cyber incidents are the top global business risk for the fifth year running, with 42% of responses. Business interruption ranks third at 29%, and only 3% of respondents call their supply chains very resilient.⁸ Five years at the top is the direction of travel.

What the market does

Across 44 extreme cyberattacks on listed companies between 2000 and 2021, shares underperformed by 8.9% after one year and 14% after two, and the gap widened through the second year. Ransomware's market impact was roughly 23 times that of data breaches, and the study found no sign that markets are getting used to attacks.⁹ Those are averages across extreme events, not a forecast for any one company.

What management is telling you

CISOs report that board alignment with them fell from 84% in 2024 to 64% in 2025, in Proofpoint's survey of more than 1,600 CISOs.¹⁰ In NACD's own 2025 survey, 43% of public-company directors rated better cyber reporting very or extremely important.² Both sides of the table are saying the briefing isn't working.

What one event did

Two incidents from DeNexus™'s OT Losses research show what a board hears when the loss is told in money.¹¹

Jaguar Land Rover shut its systems down around 1 September 2025 after detecting an attack, and its vehicle production was suspended for about five weeks. Manufacturing restarted on a phased basis from 8 October, and production returned to normal levels by mid-November.^{12 13} JLR reported GBP 196 million of cyber-incident costs in its second quarter and GBP 64 million in its third, together about 1.1% of its revenue for the year, which fell 20.9% to GBP 22.9 billion.^{12 13 23} The Cyber Monitoring Centre put the impact across the UK economy at GBP 1.9 billion, with more than 5,000 organizations affected,¹⁴ and the UK government guaranteed a loan of up to GBP 1.5 billion so JLR could support its supply chain.¹⁵ Insurance market sources told The Insurer that JLR had not finalized a cyber insurance deal when it was hit; JLR declined to comment.¹⁶

Updated 3 November 2026. Expect new information after this date to change this analysis.

Norsk Hydro was hit by ransomware on 19 March 2019. Its leadership isolated the plants, ran them manually where it could, paid no ransom, and held daily press conferences while it rebuilt from backups. Hydro puts the total cost at around NOK 800 million, about 0.5% of its 2019 revenue.^{17 24} It is still the example boards are pointed to for how to communicate through a bad month.

Both boards heard the loss in money, after the event. The argument of this paper is that they can hear it before.

The cost of the wrong unit reaches the board in three ways, and none of them waits for an attack.

The first is the clock. A US public company files an 8-K within four business days of deciding an incident is material, and describes its cyber oversight in the annual report.¹⁸ That materiality decision needs a credible estimate of financial impact, fast, and a company that has never put a number on its OT cyber risk will be estimating from nothing in the worst week to do it.

The second is accountability. Under NIS2, EU management bodies approve and oversee cyber risk measures and can be held liable for them.⁶ In Delaware, directors face oversight liability for bad faith: no reporting system at all, or red flags ignored. In the 2022 SolarWinds derivative case, a "subpar" system was not enough for liability, and the court called cybersecurity "mission critical" for that kind of business.¹⁹ This is a summary, not legal advice. The point for a board is that the reporting system has to exist, and a color is a thin one.

The third is the decisions only you and the CEO can make. Shut the plant down or keep it running. Pay or don't pay. Disclose now or wait. NACD's handbook asks plainly, "Who decides whether to pay a ransom?" and tells boards to settle escalation thresholds in advance.² Insurance may not carry the answer: Lloyd's requires its standalone cyber-attack policies to exclude state-backed attacks,²⁰ and cyber policies typically exclude physical damage.²¹

You will make those calls with whatever number you have. Today, for most boards, that number is a color.

Expected loss is two questions with numbers attached. How often does a loss event happen, and how bad is it when it does? Those are frequency and magnitude, and expected loss is the one multiplied by the other, in dollars. A board also needs "how bad" answered for a bad year: the loss in a 1-in-20 or 1-in-100 year, set against earnings and the balance sheet.

"How bad" for an industrial company is not a data breach. It is the production that stops, the equipment replaced or re-validated, the response and recovery, the contracts missed, the market's reaction, and in the worst cases the safety and environmental consequences. DeNexus built its OT loss taxonomy from how industrial incidents cost money rather than from how data breaches do: more than 40 loss types across 20+ perils and 80+ cost drivers.²² The JLR figures above are what those loss types look like in a quarterly report.

How often does an incident happen? That question has a known problem. Public evidence on OT losses is thin and actuarial data is limited. Few companies disclose what an incident cost, and fewer still disclose how it happened. Simulation is the practical way through. A model takes what is known about the company (its sector, its facilities, its revenue, its controls, its threat environment) and runs the plausible incident paths many thousands of times to produce a distribution of outcomes: an expected annual loss, and the loss in a bad year, the 1-in-20 or the 1-in-100. The result is a range with its assumptions and data sufficiency stated, and it narrows as better data about the environment comes in. As more OT incidents are disclosed with their financial impact, that evidence calibrates and validates the model. DeNexus quantification is FAIR-based, with its own implementation and OT loss taxonomy, and fills the gaps FAIR and FAIR-MAM leave in OT. The method is set out in the DeNexus methodology paper.²²

Three things change for the board once the number exists.

First, cyber sits in the register beside everything else. Expected loss and the bad-year loss are the units the risk committee already uses, so cyber can be ranked, given an appetite, and funded like the other risks. That is what NACD's handbook asks management for.²

Second, the trend becomes the briefing. One number a quarter, up or down, and what the spending changed, replaces the deck that ran out of time.

Third, the decisions get made before the bad day. With a bad-year figure in hand, the board can set its escalation thresholds, its appetite for retained loss and its view on insurance while there is time to think.

DeRISK CRQ gives the board one quarterly view of OT cyber risk in dollars, and gives management the same numbers in their own units.

The Cyber Risk Brief is three pages, once a quarter. It opens with the headline risk position: expected annual loss and the loss in a bad year. It shows the trend since the last brief, a solvency check that sets the bad year against revenue and the balance sheet, and where the risk sits, facility by facility. It closes with what the security program removed since the last brief, and a short note on method so the audit committee can see how the figure was built. It leaves out attack-vector detail, loss curves, control tables and facility drill-downs on purpose. Those belong in the reports the CISO, the CFO, the COO and the risk manager receive, and all of them draw on the same numbers, so the board hears one figure from everyone.

Management can start with no OT network data. The first result comes from public data about the company and a handful of questions. A Board-Grade result adds about 50 questions and brings the facility view and the role reports. Each step narrows the range, and the brief says how much data sits behind the number.

Ask your CISO for the number, not the colors. If they don't have one yet, the first is free, on the CEO & Board page at denexus.ai.