For Chief Risk Officers

Walk into renewal with evidence, not a questionnaire.

Modeled loss, scenarios and proof of risk quality, packaged the way underwriters already work.

Your first result is a DeRISK™ CRQ estimate for your company, built from public data. No questions for a public company; just annual revenue for a private one. Nothing connects to your OT network.

Your first resultLevel 1 Estimate · company scope

$18.4MExpected annual loss

$64M1-in-20 year

$112M1-in-100 year

Loss exceedance curve

Top attack methodRansomware with data exfiltration · 48%

Top loss typeBusiness interruption · 46%

Revenue stress test1-in-100 year = 6.1% of revenue

From public data · thousands of simulated years · assumptions and limitations listed

Most renewals are negotiated on questionnaires, not evidence.

Cyber incidents rank as the top global business risk, and business interruption ranks third.Allianz Risk Barometer 2026
The market prices the doubt.In academic studies, actuaries, underwriters and reinsurers all set higher premiums when a risk was ambiguous.Kunreuther, Hogarth and Meszaros, Journal of Risk and Uncertainty, 1993
Your plant can fall between two policies.Many property policies exclude cyber attacks. Cyber policies typically exclude physical damage. When an attack damages equipment and stops a line, neither may pay, and the loss stays with you.Gallagher Specialty, 2025; Lloyd’s Market Association model clauses

85%

Silent cyber has a price.About 85% of NotPetya’s insured loss, put above $3 billion, came through property policies that didn’t affirmatively cover cyber.PCS Global Cyber, Verisk, 2019

What you hand the market

Generic views of the Risk Transfer Evidence Bundle at DeRISK CRQ Level 3 Board-Grade.

Modeled loss picture

$18.4MExpected annual loss

$64MAttachment anchor (1 in 20)

$112MLimit-sizing anchor (1 in 100)

Severity realism

0%25%

1-in-20 year 3.5%1-in-100 year 6.1%10% threshold

Loss as a share of annual revenue, against thresholds you set.

Scenario decomposition

Business interruption$8.4M

Cyber extortion$6.1M

Information privacy loss$2.2M

Proprietary data loss$1.7M

What the expected annual loss is made of.

Risk quality evidence

Security management3.0

Network security2.5

Physical security2.0

Hardware security1.5

Software security1.0

01234

Control maturity by NIST SP 800-82r3 layer, 2.0 of 4.0 overall, with confidence stated.

Risk trajectory since the last renewal

−$4.6MExpected annual loss removed since the last renewal

$11.1MForecast once the committed projects are done

Assessments since the last renewalForecast with the committed projects

Evidence of effort since the last renewal, and the plan for the next year. The forecast follows the DeRISK Consultant’s project order; your company sets the dates.

Before the renewal meeting

Answer the market’s question on the call, not next week.

The broker asks what drives your tail.
Ask DeRISK in plain words, and Davy answers from your own results, with the chart or table behind it.

Your DeRISK results already hold the answer. Finding it shouldn’t take a meeting.

DeRISK Davy add-on

Davy is the voice; the score, the decision and the report come from DeRISK. Davy runs on frontier AI models, privately inside DeNexus’ own cloud environment. Guardrails at the model boundary. No training on your data. Your conversation history stays in your account, and you can delete it at any time.

DavyAnswers from your Level 3 Board-Grade results

Broker

What drives the 1-in-100 number?

Ransomware with data exfiltration. Its own 1-in-100 year loss is $41M, the largest of any scenario.

Ask DeRISK…

Before the next renewal

Get credit for getting better.

Your policy renews on one date each year, but your risk changes all year. Some projects finished after the last renewal; more are planned for the year ahead. Line them up on the policy year, so the market sees what changed and what’s coming.

Improvement and commitments, on the policy year

DeRISK Consultant add-on

Assessed each quarterForecast on your planned datesRenewal date

Done since the last renewal

Q1Removed direct internet access to HMIs
Q2Patched the plant historian servers
Q3Replaced shared operator accounts

Assessed: $23.0M at the last renewal, $18.4M now, down $4.6M.

Planned over the next year · your dates

1
Segment the remote access pathbefore the next renewal
−$4.1M
2
Back up and test controller configurationsnext policy year, Q2
−$2.3M
3
Restrict removable media on operator stationsnext policy year, Q3
−$0.9M

Forecast: $14.3M if project 1 lands before the renewal; $11.1M once all three are done.

Renewal is one date a year; risk moves all year. The dates are yours: DeNexus doesn’t schedule the work, and costs stay internal.

When a wording changes

Coming next: model your own scenarios.

The DeRISK Scenario Simulator is a future add-on that will let you model different OT cyber scenarios against the risk you have already quantified. It is still being defined, and we will share more as it takes shape.

DeRISK Scenario Simulator add-on · in development

Ask your CISO

Ask your CISO for evidence the market can price.

You own the premium; your CISO holds the evidence. With DeRISK CRQ, they can turn the security program into the bundle you take to renewal.

A modeled loss picture with attachment and limit anchors
Risk quality evidence the market can read
The improvement since the last assessment

The Risk Transfer Evidence Bundle comes with DeRISK CRQ Level 3 Board-Grade. Anyone can start with the free estimate.

ToYour CISO

SubjectEvidence for the next renewal

Ahead of renewal, could you run our OT security program through DeRISK CRQ and build the Risk Transfer Evidence Bundle? I need a modeled loss picture and evidence of risk quality to take to the market.

Send to your CISO Copy the note

Start free. Build the bundle at Level 3 Board-Grade.

Each level replaces public-data assumptions with your own evidence, which reduces the uncertainty around your number.

How certain is a CRQ result?(opens in a new tab)

Free

Level 1 Estimate

where you start

You add

Nothing for a public company
Annual revenue for a private one

You get

Expected annual loss
A 1-in-20 and 1-in-100 year
A revenue stress test
The attack methods and loss types behind them

Level 2 Baseline

You add

Fewer than 10 questions

You get

The Level 1 Estimate
Value at risk for each scenario
The scenario register

Premium

Level 3 Board-Grade

You add

About 50 questions

DeRISK Control ModelNIST SP 800-82r3IEC 62443

You get

The Risk Transfer Evidence Bundle and the other role reports, for the company or each site
Add-ons start here: DeRISK Consultant, DeRISK Davy and DeRISK Scenario Simulator (coming)

Level 4 Evidence-Grade

You add

OT network data for each facility
Network diagrams or static files qualify
Monitoring sensors are optional

You get

The same reports, grounded in what your OT networks show

Walk into renewal with evidence, not a questionnaire.

Most renewals are negotiated on questionnaires, not evidence.

From the plant floor to the renewal meeting.

1On the plant floor

2In the security report

3At renewal

What you hand the market

Modeled loss picture

Severity realism

Scenario decomposition

Risk quality evidence

Risk trajectory since the last renewal

Answer the market’s question on the call, not next week.

Get credit for getting better.

Improvement and commitments, on the policy year

Done since the last renewal

Planned over the next year · your dates

Coming next: model your own scenarios.

Evidence the market can check

Ask your CISO for evidence the market can price.

Start free. Build the bundle at Level 3 Board-Grade.

You add

You get

You add

You get

You add

You get

You add

You get

Featured resources

Bringing OT Evidence to Your Cyber Renewal

Quantifying OT Cyber Risk: Where FAIR Stops Short

How certain is a cyber risk quantification result?

Walk into your next renewal with evidence.