DeNexus Learn

How Certain Is a Cyber Risk Quantification Result?

DeNexus — Sat, 14 Nov 2026 10:03:05 GMT

A cyber risk quantification (CRQ) result arrives as a range: a most likely loss, a band of probable losses, and a tail of rare but severe ones. This article is about cyber risk quantification uncertainty: where it comes from and how to read it.

The OT Cyber Insurance Gap: Why Standard Policies Miss Cyber-Physical Loss

Donovan Tindill — Thu, 06 Aug 2026 15:03:31 GMT

The OT Cyber Insurance Gap: Why Standard Policies Miss Cyber-Physical Loss

In August 2025, a cyberattack shut down Jaguar Land Rover's UK plants for roughly five to six weeks. The economic impact rippled across some 5,000 organizations in its supply chain and ran to an estimated £1.9 billion [1]. The company's cyber insurance coverage for it: about £25 million. The UK government stepped in with a £1.5 billion loan guarantee to prevent a cascade of supplier bankruptcies [2].

Cyber Risk Quantification for Insurance: How Industrial Risk Managers Turn CRQ Evidence Into Better Coverage Terms

Donovan Tindill — Thu, 06 Aug 2026 15:02:43 GMT

Cyber Risk Quantification for Insurance: How Industrial Risk Managers Turn CRQ Evidence Into Better Coverage Terms

At renewal, the two sides of the table arrive with very different tools. The insurer brings a model: loss estimates, portfolio benchmarks, a view of your sector's tail. You, the asset owner, bring a completed questionnaire. One side is quantifying the risk. The other is describing it. That asymmetry is why so many industrial renewals feel like something being done to the operator rather than negotiated with them.

What Underwriters Need to Know About OT vs. IT Cyber Risk Before Binding

Donovan Tindill — Thu, 06 Aug 2026 15:02:33 GMT

What Underwriters Need to Know About OT vs. IT Cyber Risk Before Binding a Policy

You have a submission, a deadline, and a decision to make. The applicant runs industrial operations — a manufacturing plant, a utility, a pipeline, a data center — and somewhere in the file is an OT cyber exposure you're being asked to put capacity behind. The question in front of you isn't academic. It isn't "what is operational technology?" It's narrower and more urgent: what do you need to believe about this OT environment before you bind?

Why Missing Data Is a Risk Signal, Not a Blank Field: Underwriting OT Cyber Submissions

Donovan Tindill — Thu, 06 Aug 2026 15:02:04 GMT

Why Missing Data Is a Risk Signal, Not a Blank Field: Underwriting OT Cyber Submissions

A submission lands on your desk. The IT section is complete: MFA everywhere, EDR deployed, backups documented, a tidy incident-response plan attached. Then you reach the OT section, and it thins out. Segmentation: blank. Remote access into the plant: blank. Recovery testing: blank. Roughly seven in ten OT questions are unanswered.

MITRE ATT&CK for ICS Explained: Tactics, Techniques, and Cross-Domain Attack Paths

DeNexus — Mon, 22 Jun 2026 12:25:57 GMT

The MITRE ATT&CK framework is the most widely adopted catalog of adversary behavior in cybersecurity. Most IT security teams have used MITER ATT&CK for Enterprise for years to structure threat models, organize detection coverage, and describe how attackers operate. Fewer security teams have worked with the version built specifically for industrial control systems (ICS) — and even fewer have grasped how the Enterprise and ICS matrices actually relate to each other in a real industrial environment.

IEC 62443 Explained: The Cybersecurity Standard for Industrial Control Systems

DeNexus — Mon, 22 Jun 2026 12:25:43 GMT

ISO 27001 is a well-understood standard. It is also insufficient for operational technology environments — and not because it is poorly designed, but because it was not designed for them. ISO 27001 is built around information assets: the confidentiality, integrity, and availability of data and the systems that process it. In an industrial control system environment, the primary asset is a physical process — a power generation unit, a chemical reactor, a water treatment facility — and the consequences of a security failure are physical, not informational. IEC 62443 exists because industrial environments needed a security standard that started from that reality.

What is OT Cyber Risk Quantification? A Practical Guide for Industrial Operators

DeNexus — Mon, 22 Jun 2026 12:25:31 GMT

If you've ever sat in a board meeting trying to explain why your organization needs $1.4 million more for cybersecurity — and felt the question coming about how much risk does that actually reduce — you already understand why this discipline exists. OT cyber risk quantification is the practice of translating the security posture of an industrial control system environment into financial terms. Specifically, the probability and magnitude of loss that a cyber incident could cause, expressed in dollars.

OT vs IT Cybersecurity: Why Industrial Networks Need a Different Approach

DeNexus — Mon, 22 Jun 2026 12:25:21 GMT

If you've ever tried applying a standard IT security control to an operational technology environment — and watched it fail — you already understand the core problem this article addresses. OT and IT networks are not variations of the same thing. They are fundamentally different systems, built for different purposes, governed by different constraints, and exposed to different categories of risk. Security approaches designed for one do not transfer to the other, and treating them as equivalent has caused real damage: unplanned downtime, physical equipment failures, and, in documented cases, harm to people.