Which plants carry the risk
Share of company expected annual loss. Seven more plants: $5.7M (31%).
Quantify · Problem-solving Use-Case
Find the facilities that carry the most risk.
Rank every facility by its own expected annual loss and see where the loss sits, so staff and budget go to the plants that matter most.
Start with a DeRISK™ CRQ estimate for your company, built from public data. Facility-by-facility results begin at Level 3 Board-Grade, which takes about 50 questions and no OT network data.
What you face
We can’t tell which of our sites carries the most risk.
Every plant has findings. Few teams can say which plant’s loss matters most.
25%
One incident can stop a whole site.In ransomware response cases handled by one OT security firm, 25% caused a complete OT site shutdown. 75% caused at least some disruption to operations.1Dragos, OT Cybersecurity Year in Review 2024
NT$2.6 billion
One unchecked tool, one costly quarter.A single new tool, connected without a virus check, let malware into TSMC's fabs. The loss was about NT$2.6 billion, about 2% of that quarter's revenue.2Taiwan Semiconductor Manufacturing Company, Form 6-K filings, 2018
$2.3 million an hour
An idle plant is costly.A vendor survey of plant staff puts an idle line in a large automotive plant at about $2.3 million an hour. It covers downtime from all causes, not only cyber.3Siemens, The True Cost of Downtime 2024
Long lists, no ranking.Each site sends its own list of findings. Nothing says which site’s loss matters most in dollars.
Averages hide the hotspot.A portfolio average blends strong plants with weak ones. The one plant that carries most of the loss disappears inside it.
Money follows the loudest site.Without a ranking, budget and staff get spread evenly or go to whoever asks hardest. The plant that carries the risk waits.
How DeRISK solves it
From a long list of findings to a ranked list of plants.
DeRISK quantifies each facility on its own, then puts the facilities side by side. The same example company runs through the last two steps.
Quantify each facility
Each facility gets its own expected annual loss, with a bad-year (1-in-20) and a severe-year (1-in-100) figure. The facility expected annual losses add up to the company figure. The range around each result narrows as better inputs replace assumptions.
Where the loss sits, plant by plant
1
Houston, TX
$4.4M a year2
Baton Rouge, LA
$3.2M3
Chicago, IL
$2.0MOver $3M$1.2M to $3MUnder $1.2MCircle size = expected annual loss
Expected annual loss by plant. Plant-by-plant results start at Level 3 Board-Grade.
Example company. Each plant has its own expected annual loss, and together they make up the company figure.
Rank and compare plants
Put every plant side by side, ranked by expected annual loss. In the example company, Houston carries $4.4M (24%) of the $18.4M total, and five plants carry about 70% of it. Each plant’s control strengths and gaps sit in the same view.
Control maturity by plant
| Plant | Firewalls | Malware prevention | Vulnerabilities | Access controls | Detection | Incident response | Backups | Average |
|---|---|---|---|---|---|---|---|---|
| Houston | 1.0 | 2.0 | 1.5 | 1.5 | 2.0 | 2.0 | 1.5 | 1.6 |
| Baton Rouge | 2.0 | 2.5 | 1.5 | 2.0 | 1.5 | 2.0 | 1.5 | 1.9 |
| Chicago | 2.5 | 2.5 | 2.0 | 2.5 | 2.0 | 2.0 | 2.5 | 2.3 |
| Pittsburgh | 2.5 | 2.0 | 2.0 | 2.0 | 2.0 | 1.5 | 2.5 | 2.1 |
| Tulsa | 1.5 | 1.5 | 1.0 | 1.5 | 1.0 | 1.0 | 1.5 | 1.3 |
Scale 0 to 4; lighter is weaker. Tulsa scores weakest, but Houston carries more loss: rank by loss, not by score. Also available in IEC 62443, NIST SP 800-82r3 or the DeRISK Control Model.
Example company. Control scores by plant, so you can see where the gaps sit.
Look inside the hotspot
Open the top plant to see why it ranks first. In the example, Houston’s weakest control is firewalls, its top attack method is ransomware with data exfiltration, and its top loss type is business interruption. On its own, a 1-in-100 year there could cost up to $46M.
Hotspot: Houston, TX
$4.4MShare of company loss (24%)
$7.9MHouston on its own
$46MOn its own, 1-in-100 year
Weakest controlFirewalls · 1.0 of 4
Top attack methodRansomware with data exfiltration
Top loss typeBusiness interruption
Two figures, both labeled: Houston’s share of company loss, and its loss on its own.
Example company. Houston’s share of company loss and its loss on its own, both labeled.
What you get
The risk trajectory, with the forecast as planned fixes land, plus exhibits from the COO and Chief Risk Officer sample reports, built facility by facility.
Risk trajectory
$18.4MExpected annual loss now
$11.1MForecast after three planned projects
Past assessmentsForecast as the planned projects are done
Expected annual loss. The forecast follows the order of the planned projects.
Operational Resilience & Facility Risk: downtime exposure
1 · Downtime exposure headline
Worst facility, 1-in-100
8.18Days of facility revenue · Example Facility 1, VaR 99thExample Facility 1 has the highest standalone facility Annual Expected Loss. Its 1-in-100-year modeled loss equals 8.18 days of facility revenue.
Risk Transfer Evidence Bundle: layer-sizing anchors
Exhibit 1 · Modeled loss picture — layer-sizing anchors
| Metric | Loss | Days of rev. | % of revenue |
|---|---|---|---|
| Annual Expected Loss | $1,630,000 | 0.5 | 0.14% |
| VaR 95th (1-in-20) — attachment anchor | $6,120,000 | 1.86 | 0.51% |
| VaR 99th (1-in-100) — limit-sizing anchor | $10,650,000 | 3.24 | 0.89% |
Facility Annual Loss Exceedance Curve
Exceedance Probability
Annual Expected Loss $1,630,000VaR 95th: $6,120,000VaR 99th: $10,650,000
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Where to start
Start free. Go plant by plant when you are ready.
Level 1 and Level 2 are free and need no OT data. Level 3 Board-Grade gives each facility its own result from about 50 questions. Level 4 Evidence-Grade adds OT network data for each facility.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Keep going
For your role
In your industry
Sources
- 1.Dragos. OT Cybersecurity Year in Review 2024. Dragos, 2025.
- 2.Taiwan Semiconductor Manufacturing Company. Form 6-K, 6 Aug. 2018, and Form 6-K for the third quarter, 18 Oct. 2018, sec.gov.
- 3.Siemens. The True Cost of Downtime 2024. Siemens, 2024.
See which plant carries the most risk.
Create a free account. The Level 1 Estimate and Level 2 Baseline are free. They give a company-level expected annual loss and a company report, with no OT network data needed. Level 3 Board-Grade adds facility-by-facility results and the five executive reports.
No credit card. No OT network data needed to start.