Risk position
$18.4MExpected annual loss
$64M1-in-20 year (VaR 95th)
$112M1-in-100 year (VaR 99th)
Quantify · Problem-solving Use-Case
Put a dollar figure on your OT cyber risk.
Know your expected annual loss and what a bad year could cost, with a range that narrows as you add data. No OT network data needed to start.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data. A public company answers nothing; a private one gives annual revenue. Nothing connects to your OT network.
Your first resultLevel 1 Estimate · company scope
DeRISK CRQCompanyBy facilityBoard-Grade · Level 3Add-ons · 0 of 1
- 1Organizationanswered once6
- ✓Fleetthe facility list
- ✓Archetypesfacility groups
- 4Company controlsfleet · archetype · facility24
- 5Company factsper facility12
Board-Grade · Level 3 · enterprise-wide
Organization
These 18 questions describe the company, not a site, so they are asked once. 12 answered.
AAsset management2 questions✓ Complete
BAccess & accounts6 questions2 to answer
03Are logs for all remote access sessions preserved and stored?SEC
YesAnswered · R. Okafor · Jun 10, 2026
04How frequently are ICS/OT user accounts and privileges audited, verified, and unnecessary access revoked?IAM
Annual — Annually.Answered · S. Patel · Jun 25, 2026
07Is privileged access in OT granted on request, subject to approval, and automatically revoked when the task or time window ends (Just in Time)?IAM
Select an answerAwaiting answer
CLogging & endpoints3 questions✓ Complete
DResponse & recovery4 questions2 to answer
Cyber Risk BriefReady at 18 of 18 · 12 answered
Expected Annual Loss
$4.8M↓ 23%
$3.1MRange today$7.4M
Down from What you face
Most operators can’t say what an OT cyber incident would cost.
The security team has heat maps and maturity scores. The board and the CFO run on dollars. Nothing bridges the two.
$31.1B
OT cyber is a large, modeled loss.Dragos and Marsh McLennan put OT cyber at roughly $31.1B in annual financial risk, and up to $329.5B in a severe (1-in-250-year) event.1Dragos and Marsh McLennan, 2025 OT Security Financial Risk Report
15%
Few companies measure it in money.Only 15% of organizations measure the financial impact of cyber risk to a significant extent.2PwC, 2025 Global Digital Trust Insights
$354M
One attack, one lost quarter.A cyberattack forced Clorox into manual ordering for weeks. Quarterly net sales fell $354 million, a drop Clorox said was driven largely by the attack. That alone is about 5% of the year’s net sales.3,4,5The Clorox Company, Form 10-Q, first-quarter results and Form 10-K
Colors are not a budget.A heat map or a maturity score never says what is at stake in dollars. It can’t tell a board how much to spend, or where.
There is no benchmark to borrow.Public evidence of OT losses is thin and actuarial data is limited. Simulation is the practical way to understand rare, severe losses.
No OT data, so no number?Most operators have no OT network data to share and assume they can’t quantify without it. Public data and a questionnaire are enough to start.
How DeRISK solves it
From public data to a number the board can act on.
The same model runs at every level. Each level replaces assumptions with your own evidence, so the range around the result narrows.
Start with public data
Get a company-level expected annual loss in minutes, with a bad-year (1-in-20) and a severe-year (1-in-100) figure. The range is widest here, and it is already a number you can discuss.
Example company. The first result at company scope, with the loss exceedance curve behind it.
Add your answers
A short questionnaire first, then a fuller one of about 50 questions in the framework you pick. Each answer replaces an assumption, so the range narrows and the number holds up in front of the board.
Your posture, in the framework you choose
Control posture
DeRISK Control ModelNIST SP 800-82r3IEC 62443
Access control88
Segmentation52
Monitoring34
Asset inventory76
One 50-question instrument, answered once in the framework you pick.
One instrument, answered once, in the DeRISK Control Model, NIST SP 800-82r3 or IEC 62443.
Add facility OT network data
When your sites can share OT network data, each facility gets its own number and the range is narrowest. The company figure is then built bottom-up from the plants that carry the loss.
Loss in dollars, facility by facility
ACombined cycleBSubstationCAssembly lineDStorage
Expected annual loss by facility
A$4.2M
B$2.6M
C$1.1M
D$0.4M
Selected facilityCombined cycle · $4.2M
Example portfolio. Each facility is quantified on its own, then added up.
What you get
Exhibits from the sample reports, each with its own example data: the board’s solvency check, the CISO’s attack surface priorities and the CFO’s exposure statement.
Cyber Risk Brief: solvency check
3 · Solvency check — stress test
Revenue Stress Test — Modeled Loss Against Materiality Thresholds
10% of revenue — $143M25% of revenue — $357M50% of revenue — $715M
Annual Expected Loss
$62.4M 4.4% of revenue
1-in-20 year (VaR 95th)
$172M 12.0% of revenue
1-in-100 year (VaR 99th)
$246M 17.2% of revenue
$10.0M$100.0M$1.0B
Annual loss (log scale) vs. revenue materiality thresholds
Security Posture & Remediation: attack surface priorities
2 · Attack surface priorities
Annual Expected Loss by FAIR Scenario Method
Ransomware with Data Exfiltration$44,500,000 · 71.37%
Remote Service Exploitation$6,100,000 · 9.78%
Supply Chain$4,200,000 · 6.74%
System Outage$3,900,000 · 6.26%
Data Exfiltration$3,650,000 · 5.85%
$0$10.0M$20.0M$30.0M$40.0M$50.0M
The largest FAIR scenario Method exposure is Ransomware with Data Exfiltration at $44,500,000 — 71.37% of company Annual Expected Loss.
Financial Exposure: exposure statement
1 · Exposure statement
Anchored to facility revenue of $15.42M:
| Metric | Loss | Days of revenue |
|---|---|---|
| Annual Expected Loss | $487,000 | 11.53 |
| Rare scenario — 1 in 20 years (VaR 95th) | $1,280,000 | 30.29 |
| Extreme scenario — 1 in 100 years (VaR 99th) | $1,900,000 | 44.97 |
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Where to start
Start free. Go deeper when the board asks.
Level 1 and Level 2 are free and need no OT data. Level 3 Board-Grade is where most companies land: the number holds up for the board, the CFO and your insurer.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Keep going
For your role
In your industry
Related problems
Sources
- 1.Dragos and Marsh McLennan. 2025 OT Security Financial Risk Report. Dragos, 2025.
- 2.PwC. 2025 Global Digital Trust Insights. PwC, 2024.
- 3.The Clorox Company. Form 10-Q for the Quarterly Period Ended September 30, 2023. U.S. Securities and Exchange Commission, www.sec.gov/Archives/edgar/data/21076/000002107623000048/clx-20230930.htm.
- 4.The Clorox Company. “Clorox Reports Q1 Fiscal Year 2024 Results, Updates Outlook.” Press release, 1 Nov. 2023.
- 5.The Clorox Company. Form 10-K for the Fiscal Year Ended June 30, 2024. U.S. Securities and Exchange Commission, www.sec.gov/Archives/edgar/data/21076/000002107624000030/clx-20240630.htm.
Get your first number before the next board meeting.
Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss and a company report, with no OT network data needed. Level 3 Board-Grade adds the five executive reports and opens the add-ons.
No credit card. No OT network data needed to start.