Buildings OT Cyber Risk Quantification

Most building owners can't say what an OT cyber incident would cost

HVAC, access control, elevators and power are OT, and they are increasingly connected. Few owners can put a number on what a compromise would cost.

Connected buildings, vendor-managed systems

Building management systems span the portfolio, are often run by third parties and connect to the internet for remote service.

One building · its systems, managed remotely

1
Building systemsHeating, cooling, blinds, access, power and water
2
Remote control centerMany buildings managed over remote access

Unmonitored siteMonitored siteRemote management link

92%without OT monitoring

24buildings

2with OT monitoring

One incident, many kinds of loss

Tenant disruption, damaged equipment, life-safety events and lease penalties hit at once. The DeRISK Consequence Model counts each cost exactly once.

Loss from one event · $4.3M

Tenant and operational disruption$2.2M

Equipment damage$1.0M

Life-safety systems$0.6M

Lease and SLA penalties$0.5M

100,000residents in 600+ apartment buildings lost heat when FrostyGoop malware targeted heating controllers in winter 2024.

A color can't be budgeted

Boards, regulators and insurers need a number. A heat map can't go into a budget or a renewal; an Expected Annual Loss can.

Heat map

Office towers High
Healthcare campuses High
Retail and mixed use Medium

DeRISK · EAL

Office towers $3.1M
Healthcare campuses $2.6M
Retail and mixed use $1.2M

Quantify, reduce and transfer
OT cyber risk in buildings

Put a dollar figure on every building, from chiller plant to access control

DeRISK™ CRQ quantifies OT cyber risk site by site and rolls it up to the portfolio, so the board, the CFO and the CISO work from the same Expected Annual Loss.

Expected Annual Loss, Value at Risk and loss exceedance (OEP/AEP), site by site and across the portfolio
A 50-question assessment in the DeRISK Control Model, NIST SP 800-82r3 or IEC 62443
Five role-based reports at Level 3 Board-Grade, from the Cyber Risk Brief to the Risk Transfer Evidence Bundle

Explore DeRISK CRQ →

Built around how buildings actually run

DeRISK™ CRQ models your operation the way you run it: segment by segment, site by site, chiller plant to access control.
Each site’s Expected Annual Loss traces to the losses that matter here: tenant disruption, damaged equipment, life-safety events.
Every site rolls up into one portfolio view your CFO and insurers read the same way.