Exposure statement
$18.4MExpected annual loss
$64M1-in-20 year (VaR 95%)
$112M1-in-100 year (VaR 99%)
For CFOs
Every budget request says it reduces risk. By how much?
See the expected loss each project would remove, then weigh it against your own costs and hurdle rate.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data. No questions for a public company; just annual revenue for a private one. Nothing connects to your OT network.
Your first resultLevel 1 Estimate · company scope
$18.4MExpected annual loss
$64M1-in-20 year
$112M1-in-100 year
Loss exceedance curve
Top attack methodRansomware with data exfiltration · 48%
Top loss typeBusiness interruption · 46%
Revenue stress test1-in-100 year = 6.1% of revenue
From public data · thousands of simulated years · assumptions and limitations listed
Most CFOs are asked to fund OT security without a number.
- Requests arrive in the wrong currency.CVEs, frameworks, maturity levels and risk ratings. Finance can’t price any of them.
- Materiality comes with a deadline.A US public company files an 8-K within four business days of deciding a cyber incident is material. The SEC sets no numeric threshold.US SEC, cybersecurity disclosure rules, 2023
- Finance wants the reduction in numbers.In one survey, 40% of finance leaders said quantified risk reduction would make a bigger security budget easier to justify.Expel, The CISO-CFO Disconnect, 2026
15%
Only 15% of organizations measured the financial impact of cyber risks to a significant extent.PwC, 2025 Global Digital Trust Insights
Frequency
Magnitude
Cost of loss structure
- Business interruption$8.4M
- Cyber extortion$6.1M
- Information privacy loss$2.2M
- Proprietary data loss$1.7M
What the expected annual loss is made of.
From a plant risk to a line in the plan.
One fix, as the plant sees it, as security requests it, and as Finance weighs it.
1On the plant floor
A vendor’s remote access account can reach the line controls.
2In the security request
Segment the remote access path.
3In the financial plan
$4.1M a year of expected loss removed (DeRISK Consultant). Your cost and hurdle rate complete the case.
What Finance gets each quarter
Generic views of the Financial Exposure report at DeRISK CRQ Level 3 Board-Grade, company-wide with facility detail.
Revenue stress test
0%25%
1-in-20 year 3.5%1-in-100 year 6.1%10% threshold
Thresholds are set by Finance, to match your materiality levels.
Cost of loss structure
Business interruption$8.4M
Cyber extortion$6.1M
Information privacy loss$2.2M
Proprietary data loss$1.7M
What the expected annual loss is made of.
Risk trajectory
Past assessmentsForecast with the DeRISK Consultant’s projects
Expected annual loss. The forecast follows the Consultant’s project order, not dates: DeNexus doesn’t schedule the work.
Where losses concentrate, by facility
1
Houston, TX
$4.4M a year2
Baton Rouge, LA
$3.2M3
Chicago, IL
$2.0MOver $3M$1.2M to $3MUnder $1.2MCircle size = expected annual loss
Expected annual loss by facility. Facility results start at Level 3 Board-Grade.
In the budget review
Answer the follow-up before the meeting ends.
- The CEO asks what a bad year would cost.
- Ask DeRISK in plain words, and Davy answers from your own results, with the chart or table behind it.
Your DeRISK results already hold the answer. Finding it shouldn’t take a meeting.
DeRISK Davy add-on
Davy is the voice; the score, the decision and the report come from DeRISK. Davy runs on frontier AI models, privately inside DeNexus’ own cloud environment. Guardrails at the model boundary. No training on your data. Your conversation history stays in your account, and you can delete it at any time.
DavyAnswers from your Level 3 Board-Grade results
CEO
What’s our worst plausible year?
A 1-in-100 year could cost $112M, 6.1% of annual revenue. A 1-in-20 year could cost $64M.
Ask DeRISK…
In the capital plan
Compare projects on the loss they remove.
Add the DeRISK Consultant to get the next-best remediation projects, their scope and order, in less than one hour, ranked by the loss each one removes.
DeNexus doesn’t estimate cost or schedule. You enter your costs and hurdle rate, and the comparison is yours to make.
DeRISK Consultant add-on
Investment decision table
| Project | Loss removed a year | Your cost | Payback on your cost |
|---|---|---|---|
| Segment the remote access path | $4.1M | $5.0M | 1.2 years |
| Back up and test controller configurations | $2.3M | $1.2M | 0.5 years |
| Restrict removable media on operator stations | $0.9M | $0.4M | 0.4 years |
Loss removed comes from DeRISK. Costs, payback and the hurdle are yours; DeNexus doesn’t estimate them.
Before the insurance renewal
Line up the renewal with the capital plan.
The policy renews on one date a year. The capital plan funds projects all year. Show the market what last year’s projects changed and what this year’s plan will do, on the policy year. Costs stay in the plan; the market sees the risk delta.
Improvement and commitments, on the policy year
DeRISK Consultant add-onAssessed each quarterForecast on your planned datesRenewal date
Done since the last renewal
- Q1Removed direct internet access to HMIs
- Q2Patched the plant historian servers
- Q3Replaced shared operator accounts
Assessed: $23.0M at the last renewal, $18.4M now, down $4.6M.
Planned over the next year · your dates
- 1Segment the remote access pathbefore the next renewal−$4.1M
- 2Back up and test controller configurationsnext policy year, Q2−$2.3M
- 3Restrict removable media on operator stationsnext policy year, Q3−$0.9M
Forecast: $14.3M if project 1 lands before the renewal; $11.1M once all three are done.
Renewal is one date a year; risk moves all year. The dates are yours: DeNexus doesn’t schedule the work, and costs stay internal.
Before you approve the spend
Coming next: model your own scenarios.
The DeRISK Scenario Simulator is a future add-on that will let you model different OT cyber scenarios against the risk you have already quantified. It is still being defined, and we will share more as it takes shape.
DeRISK Scenario Simulator add-on · in development
A method an auditor can follow
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Ranges with stated assumptions
Expected and tail losses, each with the assumptions behind it.
Inputs and loss parameters shown
The financial inputs and the primary and secondary loss parameters are in the report.
Inputs you can overrule
Replace public-data estimates with your own figures where you know better.
Ask your CISO
Ask your CISO for numbers you can put in the plan.
Your CISO already holds the security data. With DeRISK CRQ, they can bring Finance expected and tail loss, a stress test against your thresholds, and the loss each project removes.
- Expected annual loss and the 1-in-20 and 1-in-100 year losses
- A revenue stress test against our materiality thresholds
- The loss each proposed project removes, to set against our costs
The Financial Exposure report comes with DeRISK CRQ Level 3 Board-Grade. Anyone can start with the free estimate.
ToYour CISO
SubjectOT security budget, in numbers
Before the next budget cycle, could you run our OT cyber risk through DeRISK CRQ? I’d like expected and tail loss, a stress test against our thresholds, and the loss each proposed project would remove. I’ll add our costs and hurdle rate.
Start free. Take it into the budget cycle.
Each level replaces public-data assumptions with your own evidence, which reduces the uncertainty around your number.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer, for the company or each facility
- Add-ons start here: DeRISK Consultant, DeRISK Davy and DeRISK Scenario Simulator (coming)
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Featured resources
All learning resources
Whitepaper · 9 min readOT Cyber Risk on the Balance Sheet
An unquantified OT cyber risk is still on your balance sheet. It is just in someone else's units.
Read the paperSample report (PDF).webp?width=1600&height=900&name=methodology-cover%20(1).webp)
Methodology paper · 20 min readQuantifying OT Cyber Risk: Where FAIR Stops Short
Read the paper →Learn articleHow certain is a cyber risk quantification result?
Read the article →Put OT cyber risk in your financial plan.
Create a free account. Your first result is a company-level estimate from public data, with a revenue stress test. Nothing touches your OT network.
Not the one who runs security? Send this page to your CISO.