Where the loss lands
Expected annual loss by loss type.
Quantify · Problem-solving Use-Case
Understand what drives your OT cyber loss.
See where the risk comes in and where the loss lands, so you fix the causes and plan for the costs.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data, with the attack methods and loss types behind it. Nothing connects to your OT network.
What you face
We know the total, but not what drives it.
A single loss figure is a start. To act on it, you need to know which attacks cause it and which costs make it up.
70%
Most OT loss is indirect.A model built on insurance claims puts indirect costs in roughly 70% of breaches that affect OT. These are the business interruption and long-term losses that act like a “blank check.”1Dragos and Marsh McLennan, 2025 OT Security Financial Risk Report
87%
A few doors let most attacks in.In one insurer’s claims, 87% of ransomware claims began through a VPN or a remote desktop connection.2At-Bay, InsurSec Report 2026
921 incidents
IT loss data has no broken plants.A widely cited study of 921 cyber incidents with public costs sorts them into data breaches, compromised systems, privacy violations and illicit access. None of those types covers physical damage.3Journal of Cybersecurity, 2016, as tabulated by the Swiss Re Institute
One total hides the few causes.A handful of attack methods and loss types usually make up most of the expected loss. A single total can’t show which ones.
Security and finance see different halves.Security talks about attack paths. Finance talks about costs. Neither sees how one leads to the other.
IT loss models miss the plant.Loss models built for IT leave out the physical side of an OT incident, such as damaged equipment, plus wasted goods and products.
How DeRISK solves it
From one number to the causes behind it.
DeRISK splits the expected loss two ways: by how the attack gets in, and by where the cost lands. Then it shows which scenarios and loss drivers matter most.
Find where the risk comes in
Each attack method is placed by how often it happens (frequency) and how large the loss can get (magnitude). In the example, ransomware with data exfiltration drives $8.8M of the $18.4M expected annual loss.
Risk matrix and loss by attack method
Frequency
Ransomware with data exfiltrationPhishing
Remote service exploitation
Privileged abuse
System outage
Magnitude
Where the risk comes in
- Ransomware with data exfiltration
$8.8M - Remote service exploitation
$3.9M - Privileged abuse
$2.4M - System outage
$2.0M - Phishing
$1.3M
Expected annual loss by attack method.
Example company. Attack methods by frequency and magnitude, with the expected loss each one drives.
See which controls set it
The control gaps decide how often an attack succeeds. Each security layer gets a score, so you can see which gaps let the top attack methods through.
Controls by NIST SP 800-82r3 security layer
Security management3.0
Network security2.5
Physical security2.0
Hardware security1.5
Software security1.0
01234
Overall 2.0 of 4.0, Developing. Also available in the DeRISK Control Model or IEC 62443.
Example company. Control scores by security layer, in NIST SP 800-82r3.
Rank the scenarios that matter
Each scenario gets its own loss in a bad year (1-in-20) and a severe year (1-in-100). The DeRISK Consequence Model sorts each loss into more than 40 loss types, including physical ones such as damaged equipment.
Security Posture & Remediation: value at risk by scenario
4.2 Per-Scenario VaR and Contribution
AELVaR 95thVaR 99th
$250.0M$200.0M$150.0M$100.0M$50.0M$0
S1
S2
S3
S4
S5
Per-Scenario VaR (USD)
From the CISO sample report. Each scenario’s expected annual loss and its 1-in-20 and 1-in-100 year values.
What you get
From the sample Risk Transfer Evidence Bundle: the scenario register. For each scenario, it lists the threat, the asset, the attack method, the effect and why it matters.
Risk Transfer Evidence Bundle: FAIR scenario register
Exhibit 5 · FAIR scenario analysis
5.1 FAIR Scenario Register
| ID | Threat | Asset | Method | Effect | Relevance |
|---|---|---|---|---|---|
| S1 | Nation-State | Business Process Generating Revenue | Remote Service Exploitation | Business Interruption | Unpatched Modicon PLCs with known remote-code-execution flaws, reachable via connected HMIs and a protocol gateway, give nation-state actors a viable path to disrupt the entire control layer simultaneously. |
| S2 | Sabotage Actors | Physical Assets & Facilities | Malware | Hardware Bricking | A flat, homogeneous network of unpatched Modicon PLCs—all sharing the same critical vulnerabilities and reachable from HMIs and a protocol gateway—enables a sabotage actor to brick every controller in a single coordinated attack. |
| S3 | Cyber Criminals | Business Process Generating Revenue | Ransomware without Data Exfiltration | Cyber Extortion | Nine unpatched Modicon PLCs interconnected without segmentation, accessible through Windows-based HMIs, let ransomware actors lock the entire production floor and leverage costly OT recovery time to pressure payment. |
| S4 | Privileged Insider | Product or Service | Data Corruption | Business Interruption | Insiders with legitimate HMI access can use authorized engineering tools to push corrupted logic to all nine interconnected, unpatched Modicon PLCs, causing process upsets or shutdowns without needing to exploit any vulnerability. |
| S5 | Hacktivists | Business Process Impacting Third-Party Revenue | System Outage | Reputation Damage | Publicly documented, unpatched vulnerabilities across all Modicon PLCs—reachable via HMIs and a protocol gateway—lower the barrier for hacktivists to halt operations and publicize the outage, causing reputational and supply-chain damage. |
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Where to start
Start free. See the drivers in your first result.
Level 1 and Level 2 are free and need no OT data. Both show the attack methods and loss types behind the number, and Level 2 adds value at risk for each scenario. Level 3 Board-Grade adds your own control answers.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Keep going
For your role
In your industry
Related problems
Sources
- 1.Dragos and Marsh McLennan. 2025 OT Security Financial Risk Report. Dragos, Aug. 2025.
- 2.At-Bay. InsurSec Report 2026. At-Bay, 2026.
- 3.Romanosky, Sasha. “Examining the Costs and Causes of Cyber Incidents.” Journal of Cybersecurity, vol. 2, no. 2, 2016, pp. 121–35, as tabulated in Swiss Re Institute, Cyber: Getting to Grips with a Complex Risk, sigma No. 1/2017, Table 2.
See what drives your number before you decide what to fix.
Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss, the attack methods and loss types behind it, and a company report, with no OT network data needed. Level 3 Board-Grade adds the five executive reports and opens the add-ons.
No credit card. No OT network data needed to start.