Headline risk position
$18.4MA typical year (expected annual loss)
$64MA bad year (1 in 20)
$112MA severe year (1 in 100)
For CEOs and boards
Know how big your OT cyber risk is, in dollars.
One expected annual loss for the whole business, and what a bad year could cost.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data. No questions for a public company; just annual revenue for a private one. Nothing connects to your OT network.
Your first resultLevel 1 Estimate · company scope
$18.4MExpected annual loss
$64M1-in-20 year
$112M1-in-100 year
Loss exceedance curve
Top attack methodRansomware with data exfiltration · 48%
Top loss typeBusiness interruption · 46%
Revenue stress test1-in-100 year = 6.1% of revenue
From public data · thousands of simulated years · assumptions and limitations listed
Most boards hear about OT cyber risk in colors, not dollars.
- Cyber incidents rank as the top global business risk for the fifth year running.Allianz Risk Barometer 2026
- Colors can’t be ranked.Risk matrices can give very different risks the same rating, and they can’t guide where to spend.Cox, Risk Analysis, 2008
- OT is the part boards see least.Few boards (16%) ever see an OT security report.World Economic Forum, Global Cybersecurity Outlook 2026
- Directors’ own guidance asks for dollars.NACD’s handbook says boards may request “quantified exposure in financial terms” for their top risk scenarios.NACD and ISA, Director’s Handbook on Cyber-Risk Oversight, 2026
Frequency
Magnitude
The biggest scenarios
- Ransomware with data exfiltration$41M
- Remote service exploitation$24M
- Privileged abuse$15M
Each scenario’s own 1-in-100 year loss.
One number, from the plant floor to the boardroom.
The same risk, as the plant sees it, as management tracks it, and as the board hears it.
1On the plant floor
A vendor’s remote access account can reach Houston’s line controls.
2In management’s report
Houston carries 24% of the company’s OT cyber risk, more than any other site.
3In the boardroom
$18.4M a year expected. A severe year could cost $112M, 6.1% of revenue.
What the board sees each quarter
Generic views of the Cyber Risk Brief at DeRISK CRQ Level 3 Board-Grade.
Risk trajectory
Past assessmentsForecast with the DeRISK Consultant’s projects
Expected annual loss. The forecast follows the Consultant’s project order, not dates: DeNexus doesn’t schedule the work.
Solvency check
0%25%
1-in-20 year 3.5%1-in-100 year 6.1%10% threshold
Loss as a share of annual revenue, against thresholds Finance sets.
The biggest scenarios
Ransomware with data exfiltration$41M
Remote service exploitation$24M
Privileged abuse$15M
Each scenario’s own 1-in-100 year loss.
Where the risk sits, site by site
1
Houston, TX
$4.4M a year2
Baton Rouge, LA
$3.2M3
Chicago, IL
$2.0MOver $3M$1.2M to $3MUnder $1.2MCircle size = expected annual loss
Expected annual loss by site. Site-by-site results start at Level 3 Board-Grade.
Between meetings
A director’s question shouldn’t wait a quarter.
- Ask DeRISK in plain words, and Davy answers from your company’s own results, with the chart or table behind it.
Your DeRISK results already hold the answer. Finding it shouldn’t take a meeting.
DeRISK Davy add-on
Davy is the voice; the score, the decision and the report come from DeRISK. Davy runs on frontier AI models, privately inside DeNexus’ own cloud environment. Guardrails at the model boundary. No training on your data. Your conversation history stays in your account, and you can delete it at any time.
DavyAnswers from your Level 3 Board-Grade results
Audit committee chair
Is OT cyber risk going up or down?
Down. Expected annual loss fell from $21.3M to $18.4M over the last two quarterly assessments.
Ask DeRISK…
What management does next
See what the next projects would remove.
The board decides how much is enough. Add the DeRISK Consultant, and management brings the next-best projects, their scope and order, in less than one hour, ranked by the loss each one removes.
It doesn’t price the work, so the return needs your own costs.
DeRISK Consultant add-on
- Expected annual loss now
$18.4M - Segment the remote access path
−$4.1M - Back up and test controller configurations
−$2.3M - Restrict removable media on operator stations
−$0.9M - After all three
$11.1M
Loss removed per year, per project. Return needs your own costs.
When you set the target
Set the goal. Get the projects that reach it.
Tell DeRISK where you need to be. The DeRISK Consultant lists the remediation projects that get you there, their scope and order, ranked by the risk each one removes.
It doesn’t price the work, so the return needs your own costs.
DeRISK Consultant add-on
Three ways to set the target
Today · SL 1Target · SL 2
SL 1SL 2SL 3SL 4
Set by threat capability, with IEC 62443-3-3.The DeRISK Consultant lists the projects that close the gap, ranked by the risk each one removes.
When a peer makes the news
Coming next: model your own scenarios.
The DeRISK Scenario Simulator is a future add-on that will let you model different OT cyber scenarios against the risk you have already quantified. It is still being defined, and we will share more as it takes shape.
DeRISK Scenario Simulator add-on · in development
A number the board can trust
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges, not one guess
A typical year, a bad year and a severe year, each with its own figure.
Assumptions in plain words
The assumptions and limits behind the number are listed.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Ask your CIO, CSO or CISO
Ask your CIO, CSO or CISO for the number, not the colors.
Your CIO, CSO or CISO already holds the security data. With DeRISK CRQ, they can bring the board one dollar figure, its direction and what a bad year could cost, every quarter.
- Expected annual loss and a 1-in-100 year loss
- The trend since the last assessment
- Where the risk sits, site by site
The Cyber Risk Brief comes with DeRISK CRQ Level 3 Board-Grade. Anyone can start with the free estimate.
ToYour CISO
SubjectOT cyber risk for the next board meeting
For the next board meeting, could you bring our OT cyber risk in dollars, using DeRISK CRQ? The board wants to see how big it is, whether it’s going up or down, and what a bad year could cost.
Start free. Brief the board at Level 3 Board-Grade.
Each level replaces public-data assumptions with your own evidence, which reduces the uncertainty around your number.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer, for the company or each site
- Add-ons start here: DeRISK Consultant, DeRISK Davy and DeRISK Scenario Simulator (coming)
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Featured resources
All learning resources
Whitepaper · 10 min readOT Cyber Risk in the Boardroom
Oversee OT cyber risk in the same units as every other risk you oversee: dollars, with a trend.
Read the paperSample report (PDF).webp?width=1600&height=900&name=methodology-cover%20(1).webp)
Methodology paper · 20 min readQuantifying OT Cyber Risk: Where FAIR Stops Short
Read the paper →Learn articleHow certain is a cyber risk quantification result?
Read the article →Give your board a number, not a score.
Create a free account. Your first result is a company-level estimate from public data, so nothing touches your OT network.
Not the one who runs security? Send this page to your CISO.