Headline risk position
$18.4MA typical year (expected annual loss)
$64MA bad year (1 in 20)
$112MA severe year (1 in 100)
Quantify · Problem-solving Use-Case
Report OT cyber risk to every executive, in their terms.
One assessment gives the board, CFO, CISO, COO and Chief Risk Officer the same number, each in the units they decide in.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data. The five executive reports begin at Level 3 Board-Grade, which takes about 50 questions and no OT network data.
One assessment, five reportsLevel 3 Board-Grade · five owners
One assessment
$4.2MExpected annual lossCyber Risk BriefQuarterly · 3 pages
CEO / BoardCyber Risk Brief
$4.2MCISOSecurity Posture & Remediation
$4.2MCFOFinancial Exposure
$4.2MCOOOperational Resilience & Facility Risk
$4.2MChief Risk OfficerRisk Transfer Evidence Bundle
$4.2MWhat you face
Each executive needs our OT risk in a different language.
The board, the CFO, the CISO, the COO and the risk team each decide in different units. One security report can’t serve all five.
16%
Boards rarely see OT risk.Only 16% of organizations with OT give their boards OT security reports.1World Economic Forum with Accenture, Global Cybersecurity Outlook 2026
75%
Security tools don’t speak business.75% of CISOs say their security tools cannot produce insights that executives and boards can use to understand business risk.2Dynatrace, “Mind the Gap,” survey of 1,300 CISOs, 2024
40%
Finance wants risk in dollars.40% of finance leaders say a bigger security budget is easier to justify when the risk reduction is quantified.3Expel, The CISO-CFO Disconnect, 2026
Written for engineers.Security reports speak in findings and scores. Each executive translates them alone, or skips them.
Five views, five numbers.Each function builds its own risk view, so the figures never match. Meetings go to arguing about the number.
Weeks of work each quarter.Pulling the reports together by hand takes weeks every cycle. By the time they land, the data is already aging.
How DeRISK solves it
One assessment, five reports, on a steady cadence.
The same run feeds every report. Each executive reads the same number in the units they decide in.
Run once, get one number
One assessment produces one expected annual loss, with a bad-year (1-in-20) and a severe-year (1-in-100) figure. Every executive starts from that same result, so the numbers match.
Example company. The board’s view: a typical year, a bad year and a severe year.
Report in each reader’s units
Each executive gets a report in the units they decide in. The board reads a typical, bad and severe year. The CFO reads an exposure statement and the COO reads loss by plant. The CISO reads priorities, and the Chief Risk Officer reads the loss anchors for renewal.
Which plants carry the risk
Houston, TX$4.4M · 24%
Baton Rouge, LA$3.2M · 17%
Chicago, IL$2.0M · 11%
Pittsburgh, PA$1.7M · 9%
Tulsa, OK$1.4M · 8%
Share of company expected annual loss. Seven more plants: $5.7M (31%).
Example company. The same $18.4M, read by the COO plant by plant.
Keep a steady cadence
Run it again each quarter for the board and CFO, each month for the CISO and COO, and at renewal for the Chief Risk Officer. Each run adds a point to the risk trajectory. An operator with over 7 GW quantified 60+ facilities, cut expected annual loss by 18.2% and saved $1.4M a year.
Risk trajectory
Past assessmentsForecast as the planned projects are done
Expected annual loss. The forecast follows the order of the planned projects.
Example company. Each quarterly assessment adds a point to the trajectory.
What you get
One exhibit from each sample report, each with its own example data and in its reader’s units.
Cyber Risk Brief: solvency check
3 · Solvency check — stress test
Revenue Stress Test — Modeled Loss Against Materiality Thresholds
10% of revenue — $143M25% of revenue — $357M50% of revenue — $715M
Annual Expected Loss
$62.4M 4.4% of revenue
1-in-20 year (VaR 95th)
$172M 12.0% of revenue
1-in-100 year (VaR 99th)
$246M 17.2% of revenue
$10.0M$100.0M$1.0B
Annual loss (log scale) vs. revenue materiality thresholds
Security Posture & Remediation: attack surface priorities
2 · Attack surface priorities
Annual Expected Loss by FAIR Scenario Method
Ransomware with Data Exfiltration$44,500,000 · 71.37%
Remote Service Exploitation$6,100,000 · 9.78%
Supply Chain$4,200,000 · 6.74%
System Outage$3,900,000 · 6.26%
Data Exfiltration$3,650,000 · 5.85%
$0$10.0M$20.0M$30.0M$40.0M$50.0M
The largest FAIR scenario Method exposure is Ransomware with Data Exfiltration at $44,500,000 — 71.37% of company Annual Expected Loss.
Financial Exposure: cost of loss structure
4 · Cost of loss structure
Annual Expected Loss by FAIR Scenario Effect
Business Interruption$316,000 · 64.89%
Hardware Bricking$116,000 · 23.82%
Proprietary Data Loss$55,000 · 11.29%
$0$70K$140K$210K$280K$350K
Operational Resilience & Facility Risk: facility posture heat map
3 · Facility posture heatmap
Facility Maturity by IEC 62443 Foundational Requirement
| Facility | FR 1 | FR 2 | FR 3 | FR 4 | FR 5 | FR 6 | FR 7 | Avg. |
|---|---|---|---|---|---|---|---|---|
| Example Facility 4 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 | 2.00 | 2.00 | 1.29 |
| Example Facility 2 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |
| Example Facility 5 | 2.00 | 2.00 | 2.00 | 3.00 | 2.00 | 2.00 | 3.00 | 2.29 |
| Example Facility 3 | 2.00 | 2.00 | 2.00 | 2.00 | 2.00 | 2.00 | 3.00 | 2.14 |
| Example Facility 1 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 | 2.00 | 1.14 |
Risk Transfer Evidence Bundle: layer-sizing anchors
Exhibit 1 · Modeled loss picture — layer-sizing anchors
| Metric | Loss | Days of rev. | % of revenue |
|---|---|---|---|
| Annual Expected Loss | $1,630,000 | 0.5 | 0.14% |
| VaR 95th (1-in-20) — attachment anchor | $6,120,000 | 1.86 | 0.51% |
| VaR 99th (1-in-100) — limit-sizing anchor | $10,650,000 | 3.24 | 0.89% |
Facility Annual Loss Exceedance Curve
Exceedance Probability
Annual Expected Loss $1,630,000VaR 95th: $6,120,000VaR 99th: $10,650,000
Download the sample Cyber Risk Brief (CEO & Board)Download the sample Security Posture & Remediation report (CISO)Download the sample Financial Exposure report (CFO)Download the sample Operational Resilience & Facility Risk report (COO)Download the sample Risk Transfer Evidence Bundle (Chief Risk Officer)
Answer the follow-up
Every report raises a question. Get the answer in plain words.
- Run the assessment once
- Ask a question in plain words
- Get the answer with the chart behind it
Executives ask. DeRISK answers from your own results.
DeRISK Davy add-on
Davy is the voice; the score, the decision and the report come from DeRISK. Davy runs on frontier AI models, privately inside DeNexus’ own cloud environment. Guardrails at the model boundary. No training on your data. Your conversation history stays in your account, and you can delete it at any time.
DavyAnswers from your Level 3 Board-Grade results
Audit committee chair
Is OT cyber risk going up or down?
Down. Expected annual loss fell from $21.3M to $18.4M over the last two quarterly assessments.
Ask DeRISK…
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Where to start
Start free. Level 3 sends the five reports.
Level 1 and Level 2 are free and need no OT data. Level 3 Board-Grade unlocks the five executive reports, and DeRISK Davy answers each follow-up question.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Keep going
For your role
In your industry
Related problems
Sources
- 1.World Economic Forum and Accenture. Global Cybersecurity Outlook 2026. World Economic Forum, Jan. 2026.
- 2.Dynatrace. “Mind the Gap.” Dynatrace, 2 May 2024.
- 3.Expel. The CISO-CFO Disconnect. Expel, Jan. 2026.
Send every executive the same number, in their terms.
Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss and a company report, with no OT network data needed. Level 3 Board-Grade adds the five executive reports, and an add-on answers their follow-up questions from your own results.
No credit card. No OT network data needed to start.