Loss removed, project by project
- Expected annual loss now
$18.4M - Segment the remote access path
−$4.1M - Back up and test controller configurations
−$2.3M - Restrict removable media on operator stations
−$0.9M - After three projects
$11.1M
Reduce · Problem-solving Use-Case
Decide which OT fix comes next.
Know the one fix that removes the most loss, and the order for the fixes after it. Each fix is valued in dollars of loss removed.
Your first free result is a DeRISK™ CRQ estimate of expected annual loss, built from public data. It sets the loss your fixes will work against. Level 3 Board-Grade with the DeRISK Consultant adds the ranked list.
What you face
We have more findings than we can fix, and no way to pick.
Security teams hold long lists. Operations can absorb only a few changes at a time.
Half
Half of incidents began outside.Half of OT incidents began with unauthorized external access, in a survey of 330 security professionals. The first fixes should go where attackers get in.1SANS, State of ICS/OT Security 2025
3%
Few flaws need action now.One OT security firm sorts OT vulnerabilities into Now, Next and Never. Only 3% land in Now, meaning exploited and reachable.2Dragos, 9th Annual OT/ICS Year in Review
25%
One advisory in four gives no fix.A quarter of ICS advisories came with no patch or mitigation advice. Teams need another way to decide what cuts the loss.2Dragos, 9th Annual OT/ICS Year in Review
Hundreds of gaps, most marked high.An assessment lists every gap and rates most of them high. Nothing says which one removes the most loss.
Teams fix what is easy or new.Without a loss figure, teams fix the easiest finding, the newest one, or the next checkbox. The fix that matters most can wait.
Expert ranking is slow.Senior OT consultants can rank fixes by impact. It takes weeks per site and happens every one to three years.
How DeRISK solves it
From a long gap list to a ranked plan.
DeRISK names each project and its scope, values the loss each one removes, and puts the projects in an order your plants can absorb.
Score your controls
Answer one assessment in the framework you report to: the DeRISK Control Model, NIST SP 800-82r3 or IEC 62443. DeRISK scores your control areas and shows the gap to your target. The finding is the gap to your target.
Target mode
Target mode
Risk-basedCompliance-basedInsurance-based
CurrentTarget to bind
Basic HygieneIntermediateSophisticated
Set to the posture an underwriter needs to bind. The finding is the gap to target, not the raw score.
Example company. The gap from the current score to the target, set by risk, compliance or insurability.
Rank every gap by loss removed
Each gap becomes a project with a scope. DeRISK values the loss each project removes, in dollars, and ranks them from the biggest cut to the smallest. The top of the list is your next fix.
Options, ranked by loss removed
Options, ranked
Ranked by loss avoidedRisk trajectoryPast assessmentsForecast, projects P1–P4 below
1
Segment the OT/IT boundaryNext best
−$1.9M2
MFA on remote OT access
−$1.2M3
Offline, tested backups
−$0.8M4
Asset inventory refresh
−$0.3MChosen from the full option space by encoded practitioner judgment
Example company. Four options ranked by the loss each removes, with the next best fix on top.
Fix in an order you can run
Some fixes must come first. In the example, segmentation comes before monitoring. DeRISK orders the projects across people, process and technology, prerequisites first, so operations can absorb each change.
A roadmap in an order that can be done
Step 1Step 2Step 3Step 4People
2Incident drills
Process2Change control4Maturity review
Technology1Segmentationprerequisite3OT monitoring
Example company. Four steps across people, process and technology.
What you get
Each finding in the framework you report to, the control scores behind the ranking, and the maturity by plant that sets the order.
One finding, every framework
One finding
Remote OT access without MFAPR.AA
NIST CSF 2.0Identity and access control
SR 1.1
IEC 62443-3-3User authentication
Remote
NIST SP 800-82R3Remote access
Model
DeRISK Control ModelAccess control
Every mapping recordsSourceDirectionRigor
Controls by NIST SP 800-82r3 security layer
Security management3.0
Network security2.5
Physical security2.0
Hardware security1.5
Software security1.0
01234
Overall 2.0 of 4.0, Developing. Also available in the DeRISK Control Model or IEC 62443.
Control maturity by plant
| Plant | Firewalls | Malware prevention | Vulnerabilities | Access controls | Detection | Incident response | Backups | Average |
|---|---|---|---|---|---|---|---|---|
| Houston | 1.0 | 2.0 | 1.5 | 1.5 | 2.0 | 2.0 | 1.5 | 1.6 |
| Baton Rouge | 2.0 | 2.5 | 1.5 | 2.0 | 1.5 | 2.0 | 1.5 | 1.9 |
| Chicago | 2.5 | 2.5 | 2.0 | 2.5 | 2.0 | 2.0 | 2.5 | 2.3 |
| Pittsburgh | 2.5 | 2.0 | 2.0 | 2.0 | 2.0 | 1.5 | 2.5 | 2.1 |
| Tulsa | 1.5 | 1.5 | 1.0 | 1.5 | 1.0 | 1.0 | 1.5 | 1.3 |
Scale 0 to 4; lighter is weaker. Tulsa scores weakest, but Houston carries more loss: rank by loss, not by score. Also available in IEC 62443, NIST SP 800-82r3 or the DeRISK Control Model.
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Where to start
Start free. Add the ranking when you are ready to act.
Level 1 and Level 2 are free and need no OT data. Level 3 Board-Grade with the DeRISK Consultant names your next fix and ranks the rest by the loss each removes.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Keep going
In your industry
Related problems
Sources
- 1.SANS Institute. State of ICS/OT Security 2025. SANS, Nov. 2025.
- 2.Dragos. 9th Annual OT/ICS Year in Review. Dragos, Feb. 2026.
Find the fix that comes next before the next budget round.
Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss and a company report, with no OT network data needed. Level 3 Board-Grade adds the five executive reports and opens the add-on that ranks your fixes by the loss each removes.
No credit card. No OT network data needed to start.