Risk quality evidence
Security management3.0
Network security2.5
Physical security2.0
Hardware security1.5
Software security1.0
01234
Control maturity by NIST SP 800-82r3 layer, 2.0 of 4.0 overall, with confidence stated.
Transfer · Problem-solving Use-Case
Prepare your cyber insurance application package.
Send your insurer modeled loss and control evidence with the application. The underwriter then prices the risk you actually carry.
Your first result is a DeRISK™ CRQ estimate built from public data, the first piece of the package. DeRISK never fills in the insurer’s questionnaire. The package goes with it.
What you face
Every renewal means another questionnaire, and answers we can’t prove.
Security, operations and finance each hold a piece of the evidence. The underwriter sees only the form.
11%
Assessors check OT controls.OT control red flags improved by 7% across one broker’s assessed clients, and by 11% in the industrial sector. Gains came in OT segmentation, MFA for OT remote access and endpoint protection in OT. The data is self-assessed.1Aon, Global Cyber Risk Report 2025
Effectively mandated
Insurers expect basic controls.MFA and immutable backups are “effectively mandated” by insurers. A form that asks only yes or no leaves the underwriter to take your word for how well they work.2Howden, Cyber Insurance 2024
More than a third
Basic controls link to fewer attacks.In a survey of 1,200 firms, those with basic controls reported attack frequency lower by more than a third. Insurance acts on this through cyber hygiene requirements.3Howden, Cyber Insurance: Rebooting Growth
Yes or no on OT controls.Long questionnaires ask yes or no about segmentation, remote access and backups. A yes says little about how well a control works.
Doubt gets priced in.When an underwriter cannot check an answer, the uncertainty goes into the terms. The cost of an unchecked questionnaire is doubt priced in.
Evidence takes weeks.Gathering it pulls in security, operations and finance. The work starts over at every renewal.
How DeRISK solves it
From scattered answers to one package.
The same model runs at every level. Each new run refreshes the package, so it is current at every renewal.
Assemble the evidence
Bring the modeled loss picture, a check of each loss against annual revenue, and the risk quality evidence behind it. Together they show the underwriter the loss you carry and the controls that shape it.
Modeled loss picture
$18.4MExpected annual loss
$64MAttachment anchor (1 in 20)
$112MLimit-sizing anchor (1 in 100)
Example company. Expected annual loss of $18.4M, up to $64M (3.5% of annual revenue) in a 1-in-20 year and up to $112M (6.1%) in a 1-in-100 year.
Show the scenarios behind it
Break the number into the scenarios that drive it, by cost type. The underwriter sees what sits inside the loss and where your controls change it.
Scenario decomposition
Business interruption$8.4M
Cyber extortion$6.1M
Information privacy loss$2.2M
Proprietary data loss$1.7M
What the expected annual loss is made of.
Example company. The scenarios behind the number, by cost type.
Show what improved
Show the loss removed since the last renewal and the projects you commit to over the policy year. The timeline marks each renewal, so every one shows what changed since the one before.
Improvement and commitments, on the policy year
Assessed each quarterForecast on your planned datesRenewal date
Done since the last renewal
- Q1Removed direct internet access to HMIs
- Q2Patched the plant historian servers
- Q3Replaced shared operator accounts
Assessed: $23.0M at the last renewal, $18.4M now, down $4.6M.
Planned over the next year · your dates
- 1Segment the remote access pathbefore the next renewal−$4.1M
- 2Back up and test controller configurationsnext policy year, Q2−$2.3M
- 3Restrict removable media on operator stationsnext policy year, Q3−$0.9M
Forecast: $14.3M if project 1 lands before the renewal; $11.1M once all three are done.
Example company. Done since the last renewal, and planned over the next policy year on your own dates.
What you get
More exhibits that go with the application: loss against revenue, control maturity by plant and the biggest scenarios. Shown from the Chief Risk Officer, COO and CEO & Board sample reports.
Severity realism
0%25%
1-in-20 year 3.5%1-in-100 year 6.1%10% threshold
Loss as a share of annual revenue, against thresholds you set.
Control maturity by plant
| Plant | Firewalls | Malware prevention | Vulnerabilities | Access controls | Detection | Incident response | Backups | Average |
|---|---|---|---|---|---|---|---|---|
| Houston | 1.0 | 2.0 | 1.5 | 1.5 | 2.0 | 2.0 | 1.5 | 1.6 |
| Baton Rouge | 2.0 | 2.5 | 1.5 | 2.0 | 1.5 | 2.0 | 1.5 | 1.9 |
| Chicago | 2.5 | 2.5 | 2.0 | 2.5 | 2.0 | 2.0 | 2.5 | 2.3 |
| Pittsburgh | 2.5 | 2.0 | 2.0 | 2.0 | 2.0 | 1.5 | 2.5 | 2.1 |
| Tulsa | 1.5 | 1.5 | 1.0 | 1.5 | 1.0 | 1.0 | 1.5 | 1.3 |
Scale 0 to 4; lighter is weaker. Tulsa scores weakest, but Houston carries more loss: rank by loss, not by score. Also available in IEC 62443, NIST SP 800-82r3 or the DeRISK Control Model.
The biggest scenarios
Ransomware with data exfiltration$41M
Remote service exploitation$24M
Privileged abuse$15M
Each scenario’s own 1-in-100 year loss.
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Where to start
Start free. Add evidence the underwriter can check.
Level 1 and Level 2 are free and need no OT data. Level 3 Board-Grade builds the package. Level 4 Evidence-Grade adds evidence from facility OT network data, beyond self-reported answers.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Keep going
For your role
In your industry
Related problems
Sources
- 1.Aon. Global Cyber Risk Report 2025. Aon, Jan. 2026.
- 2.Howden. Cyber Insurance 2024. Howden, June 2024.
- 3.Howden. Cyber Insurance: Rebooting Growth. Howden, Sept. 2025.
Start your package before the questionnaire arrives.
Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss and a company report, with no OT network data needed. Level 3 Board-Grade adds the five executive reports and opens the add-ons.
No credit card. No OT network data needed to start.