The biggest scenarios
Each scenario’s own 1-in-100 year loss.
Quantify · Problem-solving Use-Case
Answer “are we exposed?” the day it matters.
When a director asks in the boardroom, answer from your own results on the spot, with the chart behind the answer.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data. With Level 3 Board-Grade and DeRISK Davy, you can ask your results in plain language.
DavyAsk your DeRISK data
Working in CRQ · Board-GradeLoss by facility
Which site carries the most expected loss?
Refinery North: $3.1M of your $7.4M expected annual loss.
Refinery North$3.1M
Gas Plant East$2.2M
Terminal West$1.2M
Loss by facility
Ask DeRISK or @ mention a section
Loss by facility
AI-generated content may be inaccurate. Check figures against the report.
DavyAsk your DeRISK data
Working in UWA · EnterpriseEvaluation
What does this submission still need?
Three items before it can be priced:
- OT network segmentation
- Backup recovery test
- Vendor remote-access MFA
Evaluation · Controls
Ask DeRISK or @ mention a section
Evaluation
AI-generated content may be inaccurate. Check figures against the report.
DavyAsk your DeRISK data
Working in CRQ · ConsultantRoadmap
What should we fix first to cut the most loss?
Privileged access management cuts the most loss of the 12 options considered.
Privileged access−$0.62M
Backups & recovery−$0.41M
Endpoint hardening−$0.27M
Consultant · Roadmap
Ask DeRISK or @ mention a section
Roadmap
AI-generated content may be inaccurate. Check figures against the report.
What you face
You’re in a rare quarterly meeting, and the board wants the answer today.
Board time is scarce. A question that can’t be answered in the room waits a full quarter.
£1.9 billion
One incident, a whole economy.A cyberattack stopped Jaguar Land Rover’s UK vehicle production for about five weeks. The Cyber Monitoring Centre put the UK-wide impact at £1.9 billion.1Cyber Monitoring Centre, statement on the Jaguar Land Rover cyber incident
41%
Boards often hear only after.In one US study, only 35% of those responsible for ICS/OT security reported to the board. Of those, 41% did so only when a security incident occurred.2Ponemon Institute for Dragos, 2021 State of Industrial Cybersecurity
64%
Cyber takes more board time.In a survey of public-company directors, 64% said their board had given cyber more time on the agenda.3PwC, 2023 Annual Corporate Directors Survey
The question comes in the room.A peer’s incident is in the news, and a director asks “could that happen to us?” The board wants the answer before the meeting ends.
The answer takes days to build.Each one-off question sends analysts back into spreadsheets for days. By the time the number is ready, the meeting is over.
The follow-up waits a quarter.The first answer raises a second question. Without a fast way to answer it, it waits for the next quarterly meeting.
How DeRISK solves it
From the question to an answer, in the room.
Ask your own results first. Test the scenario if it is new. Keep the threat picture current, so the answer reflects what attackers are doing.
Ask your own results
Ask a question in plain language. The answer comes from your own analysis, with the chart and the section it came from. In the example, a 1-in-100 ransomware year could cost up to $41M.
Example company. The figures an answer draws on: each scenario’s own 1-in-100 year loss.
Test the new scenario
If the headline describes something new, compose it: the threat, the site, the entry point and the controls in place. See what it would cost, as is and with one more control.
Compose a scenario, see what it would cost
DeRISK Intelligence PlatformDeRISK CRQDeRISK UWAScenario Simulator
Compose an OT cyber scenario
ThreatRansomwareSiteGas plant · Train 2Entry pointRemote accessControls
Network segmentationMFA on remote access Option B
Comparing
A · as isCurrent controls
B · with MFA+ MFA on remote access
Runs on your scored risk profileSimulate
Financial impact
A · as isB · with MFA
Expected loss / yr
A$2.4M
B$1.5M
Tail loss
A$9.6M
B$6.1M
Saved scenarios
Ransomware · gas plant2 options
Insider · substation1 option
Third-party access · OEM3 options
Example scenario. Ransomware at one plant, as is and with one more control.
Keep the threat picture current
Threat intelligence tracks who is attacking industrial systems, what they target and how. It ties how often each scenario happens (frequency) to real campaigns, including threat feeds you already pay for.
The live threat picture
Live threat pictureElectrical T&D · Europe
Detected threatsscanning
Exploited flaw in protection-relay firmwareWhat: relay firmware · Listed in KEV
Mediumjust now
Remote-access campaign on substation HMIsWho: tracked group · How: ATT&CK for ICS
High2 min ago
Scanning of exposed SCADA gatewaysHow: active scanning · Europe
Medium4 min ago
DeduplicatedMapped to ATT&CK for ICS
Example threats. Campaigns seen against industrial targets, mapped to MITRE ATT&CK for ICS.
What you get
Ask the question in the room. Get the answer from your own results.
- Ask about any result in plain language
- Get the answer with the figures it came from
- Ask the follow-up without starting again
Directors ask. DeRISK answers from your own results, with the evidence behind each answer.
DeRISK Davy add-on
Davy is the voice; the score, the decision and the report come from DeRISK. Davy runs on frontier AI models, privately inside DeNexus’ own cloud environment. Guardrails at the model boundary. No training on your data. Your conversation history stays in your account, and you can delete it at any time.
DavyAnswers from your Level 3 Board-Grade results
Board director
Could what happened at that manufacturer happen to us?
Ransomware with data exfiltration is our biggest scenario. A 1-in-100 year of it could cost up to $41M, and it drives $8.8M of our $18.4M expected annual loss.
Ask DeRISK…
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Where to start
Start free. Add the answers when the board asks.
Level 1 and Level 2 are free and need no OT data. Level 3 Board-Grade opens the add-ons: DeRISK Davy answers questions from your results, and the DeRISK Scenario Simulator prices a new scenario.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Keep going
For your role
In your industry
Related problems
Sources
- 1.Cyber Monitoring Centre. “Cyber Monitoring Centre Statement on the Jaguar Land Rover Cyber Incident.” Cyber Monitoring Centre, 22 Oct. 2025, cybermonitoringcentre.com.
- 2.Ponemon Institute. 2021 State of Industrial Cybersecurity. Sponsored by Dragos, 2021.
- 3.PwC. 2023 Annual Corporate Directors Survey. PwC Governance Insights Center, Oct. 2023, p. 16.
Answer the board in the meeting, from your own results.
Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss and a company report, with no OT network data needed. Level 3 Board-Grade adds the five executive reports and opens the add-ons that answer questions and price new scenarios.
No credit card. No OT network data needed to start.