Headline risk position
$18.4MA typical year (expected annual loss)
$64MA bad year (1 in 20)
$112MA severe year (1 in 100)
Quantify · Problem-solving Use-Case
Know whether your OT cyber risk is material.
See OT cyber risk in dollars and as a share of revenue. Then executives and counsel can judge materiality and report on oversight.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data, with each loss shown as a share of annual revenue. DeRISK informs the materiality decision; your executives and counsel make it.
What you face
We may have to call materiality fast, with no dollar view of OT.
Rules now put cyber on the executive agenda. The call is a legal judgment, but it starts from numbers.
4 business days
The disclosure clock is short.US public companies must disclose a material cyber incident within four business days. The clock starts when they decide it is material. Each year they also describe their cyber risk management and board oversight.1US Securities and Exchange Commission, cybersecurity disclosure rules
Article 20
EU boards answer for cyber.Under NIS2, management bodies must approve and oversee cyber risk measures. They can be held liable, and they must take training.2Directive (EU) 2022/2555 (NIS2), Article 20
8.9%
Markets keep score.Across 44 extreme cyberattacks on listed companies, the victims’ shares ended 8.9% below their expected return after one year, and 14% below after two. Against the S&P 500 market, they trailed by 11% after one year and 18% after two.3Australian Journal of Management, 2025
The clock starts early, in the US and the EU.In the US, a material incident must be disclosed within four business days of deciding it is material. Under NIS2, an incident that can cause severe disruption or financial loss needs an early warning within 24 hours and a fuller notice within 72 hours. Both calls need a fast estimate of the financial impact.1,2
Oversight is personal.NIS2 makes management bodies approve and oversee cyber risk measures. Directors want evidence that they asked the right questions.
OT has no dollar view.Materiality calls are made under time pressure, often with no figure for what an OT incident could cost.
How DeRISK solves it
From a dollar figure to a defensible call.
DeRISK puts OT cyber risk in the same units as every other risk the board reviews: dollars, and a share of revenue. The call stays with your executives and counsel.
Size it against revenue
Get the expected annual loss and the bad-year and severe-year figures, each as a share of annual revenue. In the example, a 1-in-100 year could cost up to $112M (6.1% of annual revenue).
Solvency check
0%25%
1-in-20 year 3.5%1-in-100 year 6.1%10% threshold
Loss as a share of annual revenue, against thresholds Finance sets.
Example company. Loss as a share of annual revenue, against a threshold Finance sets.
Size the scenarios in advance
Each main scenario gets its own severe-year loss before any incident. When one happens, the materiality discussion starts from a modeled range, not a blank page.
The biggest scenarios
Ransomware with data exfiltration$41M
Remote service exploitation$24M
Privileged abuse$15M
Each scenario’s own 1-in-100 year loss.
Example company. Each scenario’s own 1-in-100 year loss.
Keep a record of oversight
Run the assessment every quarter. Each run adds a point to the trend, so the board has a record of the risk it reviewed and how it changed.
Risk trajectory
Past assessmentsForecast as the planned projects are done
Expected annual loss. The forecast follows the order of the planned projects.
Example company. Quarterly assessments, then the forecast as planned projects are done.
What you get
From the sample Financial Exposure report: the exposure statement, in dollars and in days of revenue, for a typical, a bad and a severe year.
Financial Exposure: exposure statement
1 · Exposure statement
Anchored to facility revenue of $15.42M:
| Metric | Loss | Days of revenue |
|---|---|---|
| Annual Expected Loss | $487,000 | 11.53 |
| Rare scenario — 1 in 20 years (VaR 95th) | $1,280,000 | 30.29 |
| Extreme scenario — 1 in 100 years (VaR 99th) | $1,900,000 | 44.97 |
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Where to start
Start free. Bring a number to the materiality discussion.
The Level 1 Estimate is free and gives a first look, with each loss shown as a share of annual revenue. Level 3 Board-Grade is recommended: the number holds up for the board, the CFO and counsel.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Keep going
For your role
In your industry
Related problems
Sources
- 1.U.S. Securities and Exchange Commission. “SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies.” Press release 2023-139, 26 July 2023, sec.gov.
- 2.European Parliament and Council of the European Union. Directive (EU) 2022/2555 (NIS2 Directive), Articles 20 and 23. Official Journal of the European Union, L 333, 27 Dec. 2022, pp. 80–152, eur-lex.europa.eu.
- 3.Ryan, Matthew, Glenn Withers, and Frank den Hartog. “The Impact of Extreme Cyberattacks on Market Valuations: An In-Depth Economic Analysis.” Australian Journal of Management, 2025, doi.org/10.1177/03128962251383120.
Bring a number to the materiality discussion.
Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss, each loss as a share of annual revenue, and a company report, with no OT network data needed. Level 3 Board-Grade adds the five executive reports and opens the add-ons.
No credit card. No OT network data needed to start.