Reduce · Problem-solving Use-Case

Build an OT cyber roadmap and get it approved.

Get a plan toward a target you set, with the loss reduction leadership is asked to fund. Each step shows the loss it removes.

Start freeTalk to sales

Your first free result is a DeRISK™ CRQ estimate of expected annual loss, built from public data. It is the starting point of the forecast. Level 3 Board-Grade with the DeRISK Consultant adds the roadmap.

What you face

We need a plan leadership will fund, and we can’t show what it removes.

A roadmap is a request for money. It gets approved when it shows the loss it removes.

16%
Few OT programs report in money.Only 16% of respondents provide financial metrics to show OT security success. Most use risk or compliance measures instead.1SANS, State of ICS/OT Security 2025
40%
Finance wants risk reduction in numbers.40% of finance leaders say a bigger security budget is easier to justify when the risk reduction is quantified.2Expel, The CISO-CFO Disconnect
34%
A third can’t name their budget.Over half of OT security programs saw their budget rise over two years, but 34% could not say what their security budget is.3SANS, OT security budget report, 2025
The roadmap lives in a spreadsheet.Plans get defended with colors. Red, amber and green do not say what a project is worth.
Finance asks, and gets no number.Finance asks how much risk a project removes. The security team has no dollar answer to give.
One framework, many reports.The plan is written for one framework, while the business reports to several. Each audience needs a rewrite.
How DeRISK solves it

From a target to a plan leadership can approve.

DeRISK names the projects, puts them in order, and values the loss each one removes. The case then speaks in the funders’ units.

Set the target

Pick what the plan aims for: lower risk, compliance, or insurability. DeRISK measures the gap between where you are and that target. The finding is the gap to your target.

Target mode

Example company. Three ways to set the target, with the gap to it.

Get the sequence

DeRISK lays out the steps across people, process and technology. Prerequisites come first, so each step is ready to run when its turn comes.

A roadmap in an order that can be done

Example company. Four steps across people, process and technology.

Make the case

Show the forecast: the loss now, and the loss after each project. Here, $18.4M of expected annual loss falls to $11.1M as three projects remove $4.1M, $2.3M and $0.9M.

What the next projects remove

Example company. The board’s view: expected annual loss now, and after each project.

Answer the follow-up

Then the CFO and the board ask three questions.

  1. Ask in plain language.
  2. Get the answer from your own results.
  3. See the chart or table behind it.

Ask DeRISK the follow-up. The answer comes from your own analysis.

DeRISK Davy add-on

Davy is the voice; the score, the decision and the report come from DeRISK. Davy runs on frontier AI models, privately inside DeNexus’ own cloud environment. Guardrails at the model boundary. No training on your data. Your conversation history stays in your account, and you can delete it at any time.

DavyAnswers from your Level 3 Board-Grade results
CFO

How much loss does the plan remove?

The three projects together remove $7.3M a year of expected loss. That takes $18.4M down to $11.1M.

Ask DeRISK…

A number you can defend

How certain is a CRQ result?(opens in a new tab)

FAIR-based simulation

The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.

Ranges, not one guess

A typical year, a bad year and a severe year, each with its own figure.

Assumptions in plain words

The report lists its assumptions and limitations.

Inputs you can check

See the inputs behind the number, and overrule the ones you know better.

Where to start

Start free. Add the roadmap when leadership asks for a plan.

Level 1 and Level 2 are free and need no OT data. Level 3 Board-Grade with the DeRISK Consultant builds the roadmap. The DeRISK Scenario Simulator tests alternatives.

Free
Level 1 Estimate
where you start

You add

  • Nothing for a public company
  • Annual revenue for a private one

You get

  • Expected annual loss
  • A 1-in-20 and 1-in-100 year
  • A revenue stress test
  • The attack methods and loss types behind them
Level 2 Baseline

You add

  • Fewer than 10 questions

You get

  • The Level 1 Estimate
  • Value at risk for each scenario
  • The scenario register
Premium
Level 3 Board-Grade

You add

  • About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443

You get

  • Reports for the board, CFO, CISO, COO and Chief Risk Officer
  • For the company or one facility

Add-ons start here

DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade

You add

  • OT network data for each facility
  • Network diagrams or static files qualify
  • Monitoring sensors are optional

You get

  • The same reports, grounded in what your OT networks show

Keep going

For your role

In your industry

Related problems

Read more

Sources

  1. 1.SANS Institute. State of ICS/OT Security 2025. SANS, Nov. 2025.
  2. 2.Expel. The CISO-CFO Disconnect. Expel, Jan. 2026.
  3. 3.Parsons, Dean. ICS/OT Cybersecurity Budget Report. SANS Institute, Mar. 2025.

Build the plan leadership can approve.

Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss and a company report, with no OT network data needed. Level 3 Board-Grade adds the five executive reports and opens the add-ons, including the one that builds the roadmap.

Start freeTalk to sales

No credit card. No OT network data needed to start.