Risk trajectory
Past assessmentsForecast as the planned projects are done
Expected annual loss. The forecast follows the order of the planned projects.
Reduce · Problem-solving Use-Case
Show whether OT cyber risk is going up or down.
Track expected loss from one review to the next, and show what the security program has removed. Then forecast how much loss future projects, or any scenario you test, would remove.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data. Level 3 Board-Grade tracks it over time. The DeRISK Consultant adds the forward line, and the DeRISK Scenario Simulator tests a scenario before you commit.
What you face
The board asks if we are better than last year. We can’t say in dollars.
Progress gets reported as activity: projects closed, scores nudged. The board is asking about risk.
43%
Directors want better reporting.In one survey, 43% of public-company directors said better cyber-risk reporting was very or extremely important. Many boards still get updates that are “overly technical.”1NACD and Internet Security Alliance, Director’s Handbook on Cyber-Risk Oversight, 5th ed.
21%
Many programs measure nothing.In one survey of OT security staff, 21% said their programs have no measures of success.2SANS, State of ICS/OT Security 2025
84% to 64%
Board alignment is slipping.In one vendor survey, the share of CISOs who report alignment with their board fell from 84% to 64% in a year.3Proofpoint, 2025 Voice of the CISO
A score that moved a decimal point.Maturity scores move slowly and say nothing about money. A move from 2.1 to 2.3 doesn’t tell the board what changed in its exposure.
Projects done, risk unknown.Progress gets reported as projects finished. Nobody links each project to the loss it removed.
Every quarter starts from scratch.Each report is built by hand from new sources. Quarters can’t be compared, so there is no trend to show.
How DeRISK solves it
From a baseline to a trend the board can follow.
The same model runs at every review, in the framework you report to. Each run adds a point to the line. Planned projects and tested scenarios show where it could go next.
Take a baseline
Run the first assessment: an expected annual loss with bad-year (1-in-20) and severe-year (1-in-100) figures. It is the point every later review compares against.
Risk position
$18.4MExpected annual loss
$64M1-in-20 year (VaR 95th)
$112M1-in-100 year (VaR 99th)
Example company. The baseline: $18.4M expected annual loss, with the curve behind it.
Re-run at every review
Re-run it at each monthly or quarterly review, the same cadence as executive reporting. Answer in the framework you already report to. Each run adds a point to the line and shows which control areas moved.
Control scores, in the framework you choose
By control area
Access control3.0
Segmentation2.0
Monitoring1.0
Asset inventory2.0
01234
Overall 2.0 of 4.0, Developing.
By security layer
Security management3.0
Network security2.5
Physical security2.0
Hardware security1.5
Software security1.0
01234
Overall 2.0 of 4.0, Developing.
By foundational requirement
Identification and authentication2.5
Use control2.5
System integrity2.0
Data confidentiality2.0
Restricted data flow1.5
Timely response to events1.5
Resource availability2.0
01234
Overall 2.0 of 4.0, Developing.
Example company. Control scores in the framework you pick: the DeRISK Control Model, NIST SP 800-82r3 or IEC 62443.
Project the line forward
Add the next projects, each ranked by the loss it removes. The forecast shows where the line could go as each one is done. In the example, three projects would take $18.4M to $11.1M.
Execution sequence
- Segment the remote access pathAll plants, Houston first−$4.1M
- Back up and test controller configurationsHouston and Baton Rouge−$2.3M
- Restrict removable media on operator stationsAll plants−$0.9M
Continuity payoff
$18.4MExpected annual loss now
$11.1MAfter all three
Example company. The next projects in order, with the loss each one removes.
Test a scenario before you commit
Compose a what-if: the threat, the site, the entry point and the controls in place. See what it would cost as is and with a planned change, before you fund it. In the example, MFA on remote access takes one plant’s expected loss from $2.4M to $1.5M a year.
Compose a scenario, compare the options
DeRISK Intelligence PlatformDeRISK CRQDeRISK UWAScenario Simulator
Compose an OT cyber scenario
ThreatRansomwareSiteGas plant · Train 2Entry pointRemote accessControls
Network segmentationMFA on remote access Option B
Comparing
A · as isCurrent controls
B · with MFA+ MFA on remote access
Runs on your scored risk profileSimulate
Financial impact
A · as isB · with MFA
Expected loss / yr
A$2.4M
B$1.5M
Tail loss
A$9.6M
B$6.1M
Saved scenarios
Ransomware · gas plant2 options
Insider · substation1 option
Third-party access · OEM3 options
Example scenario. Ransomware through remote access at one plant, as is and with MFA.
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Where to start
Start free. Track the trend from Level 3.
Level 1 and Level 2 are free and need no OT data. Level 3 Board-Grade is where the trend starts, with the same model at every review. The DeRISK Consultant adds the forward line, and the DeRISK Scenario Simulator tests scenarios.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Keep going
For your role
In your industry
Related problems
Sources
- 1.National Association of Corporate Directors and Internet Security Alliance. Director’s Handbook on Cyber-Risk Oversight. 5th ed., NACD and ISA, 2026, p. 23.
- 2.SANS Institute. State of ICS/OT Security 2025. SANS, Nov. 2025.
- 3.Proofpoint. “Proofpoint’s 2025 Voice of the CISO Report.” Proofpoint, 26 Aug. 2025, proofpoint.com.
Show the board the trend and what the program removed.
Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss and a company report, with no OT network data needed. Level 3 Board-Grade adds the five executive reports and the trend over time, and opens the add-ons that project the line forward and test scenarios.
No credit card. No OT network data needed to start.