solutions/industries/water-waste

Most utilities can't say what a treatment outage would cost

Regulators are pushing water utilities to manage OT cyber risk. Few can say what a compromise at one plant would cost.

Spread-out sites, small security teams

Treatment plants, pump stations and lift stations run on legacy PLCs and SCADA, often with remote access and no OT monitoring.

One city · treatment to tap

1
Treatment plantNo OT monitoring · legacy PLCs
2
Distribution networkPumps and mains to homes, business and industry

Unmonitored siteMonitored siteWater main

92%without OT monitoring

24plants and stations

2with OT monitoring

One incident, many kinds of loss

Service interruption, regulatory penalties, damaged pumps and emergency response hit at once. The DeRISK Consequence Model counts each cost exactly once.

Loss from one event · $4.0M

Service interruption$1.8M

Regulatory penalties$0.9M

Equipment damage$0.8M

Emergency response$0.5M

2026malicious targeting of over a dozen water utilities across the US resulted in disruption and boil water notices.

A color can't be budgeted

Boards, regulators and insurers need a number. A heat map can't go into a budget or a renewal; an Expected Annual Loss can.

Heat map

Water treatment High
Wastewater High
Waste-to-energy Medium

DeRISK · EAL

Water treatment $2.4M
Wastewater $1.9M
Waste-to-energy $1.3M

Quantify, reduce and transfer
OT cyber risk in water and wastewater

Put a dollar figure on every site, from intake to outfall

DeRISK™ CRQ quantifies OT cyber risk site by site and rolls it up to the portfolio, so the board, the CFO and the CISO work from the same Expected Annual Loss.

Expected Annual Loss, Value at Risk and loss exceedance (OEP/AEP), site by site and across the portfolio
A 50-question assessment in the DeRISK Control Model, NIST SP 800-82r3 or IEC 62443
Five role-based reports at Level 3 Board-Grade, from the Cyber Risk Brief to the Risk Transfer Evidence Bundle

Explore DeRISK CRQ →

Built around how water actually runs

DeRISK™ CRQ models your utility the way you run it: segment by segment, site by site, intake to outfall.
Each site’s Expected Annual Loss traces to the losses that matter here: service interruption, damaged pumps, regulatory penalties.
Every site rolls up into one portfolio view your CFO and insurers read the same way.