Risk position
$18.4MExpected annual loss
$64M1-in-20 year (VaR 95th)
$112M1-in-100 year (VaR 99th)
For CISOs
Stop taking vulnerability counts to the board. Take one number.
Turn OT cyber risk into expected annual loss, a bad-year loss and the attack scenarios behind them, in the dollars your board and CFO already use.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data. No questions for a public company; just annual revenue for a private one. Nothing connects to your OT network.
Your first resultLevel 1 Estimate · company scope
$18.4MExpected annual loss
$64M1-in-20 year
$112M1-in-100 year
Loss exceedance curve
Top attack methodRansomware with data exfiltration · 48%
Top loss typeBusiness interruption · 46%
Revenue stress test1-in-100 year = 6.1% of revenue
From public data · thousands of simulated years · assumptions and limitations listed
Red, amber and green never said what you stood to lose.
- Heat maps don’t survive the trip upstairs.A risk matrix can give very different risks the same color. It can’t tell a board how much to spend, or where.
- You answer for OT. You don’t run it.The plants own the assets, the budget and the outage windows. Every security request crosses that line.
84% to 64%
Board trust is slipping.CISOs reporting alignment with their board fell from 84% to 64% in a year.Proofpoint, 2025 Voice of the CISO
Frequency
Ransomware with data exfiltrationPhishing
Remote service exploitation
Privileged abuse
System outage
Magnitude
Where the risk comes in
- Ransomware with data exfiltration
$8.8M - Remote service exploitation
$3.9M - Privileged abuse
$2.4M - System outage
$2.0M - Phishing
$1.3M
Expected annual loss by attack method.
Speak both languages with one number.
The same gap, as the plant sees it, as you track it, and as the board needs to hear it.
1On the plant floor
The control network and the business network share one flat segment.
2In your risk register
Ransomware can move from an email inbox to the SCADA servers.
3In the boardroom
$8.8M a year expected from ransomware. $41M in a 1-in-100 year.
What you take to the board
Generic views of the CISO report at DeRISK CRQ Level 3 Board-Grade, for the company and site by site.
Where the risk comes in
Ransomware with data exfiltration$8.8M
Remote service exploitation$3.9M
Privileged abuse$2.4M
System outage$2.0M
Phishing$1.3M
Expected annual loss by attack method.
Where the loss lands
Business interruption$8.4M
Cyber extortion$6.1M
Information privacy loss$2.2M
Proprietary data loss$1.7M
Expected annual loss by loss type.
Controls by NIST SP 800-82r3 security layer
Security management3.0
Network security2.5
Physical security2.0
Hardware security1.5
Software security1.0
01234
Overall 2.0 of 4.0, Developing. Also available in the DeRISK Control Model or IEC 62443.
Risk trajectory
$18.4MExpected annual loss now
$11.1MForecast after the Consultant’s three projects
Past assessmentsForecast with the DeRISK Consultant’s projects
Expected annual loss. The forecast follows the Consultant’s project order, not dates: DeNexus doesn’t schedule the work.
Where the loss sits, site by site
1
Houston, TX
$4.4M a year2
Baton Rouge, LA
$3.2M3
Chicago, IL
$2.0MOver $3M$1.2M to $3MUnder $1.2MCircle size = expected annual loss
Expected annual loss by facility. Facility-scope results start at Level 3 Board-Grade.
In the meeting
Answer the follow-up in the room, not next quarter.
- A director asks something you didn’t prepare for.
- Instead of “I’ll look into that” and a wait until the next meeting, ask DeRISK in plain words.
- Davy answers from your own results, with the chart or table behind it.
Your DeRISK results already hold the answer. Finding it shouldn’t take a meeting.
DeRISK Davy add-on
Davy is the voice; the score, the decision and the report come from DeRISK. Davy runs on frontier AI models, privately inside DeNexus’ own cloud environment. Guardrails at the model boundary. No training on your data. Your conversation history stays in your account, and you can delete it at any time.
DavyAnswers from your Level 3 Board-Grade results
Audit committee chair
How much of the $18.4M comes from ransomware?
$8.8M a year, or 48% of expected annual loss. In a 1-in-100 year, ransomware alone could cost $41M.
Ask DeRISK…
After the meeting
Give the plant manager a reason to say yes.
An outage request that comes with the loss it removes is easier to weigh against the production it costs. Rank the work by loss, and the few maintenance windows you get go to what matters most.
Add the DeRISK Consultant to get the next-best remediation projects, their scope and sequence, in less than one hour, ranked by the loss each one removes. It doesn’t price the work, so bring your own project costs to compare the return.
DeRISK Consultant add-on
- Expected annual loss now
$18.4M - Segment the remote access path
−$4.1M - Back up and test controller configurations
−$2.3M - Restrict removable media on operator stations
−$0.9M - After three projects
$11.1M
Loss removed per year, per project. Return needs your own costs.
Before the insurance renewal
Turn the security program into renewal evidence.
The renewal questionnaire asks what changed. Show it: the projects finished since the last renewal, with the assessed drop in expected loss, and the projects planned for the year ahead, on the policy year your risk manager works to.
Improvement and commitments, on the policy year
DeRISK Consultant add-onAssessed each quarterForecast on your planned datesRenewal date
Done since the last renewal
- Q1Removed direct internet access to HMIs
- Q2Patched the plant historian servers
- Q3Replaced shared operator accounts
Assessed: $23.0M at the last renewal, $18.4M now, down $4.6M.
Planned over the next year · your dates
- 1Segment the remote access pathbefore the next renewal−$4.1M
- 2Back up and test controller configurationsnext policy year, Q2−$2.3M
- 3Restrict removable media on operator stationsnext policy year, Q3−$0.9M
Forecast: $14.3M if project 1 lands before the renewal; $11.1M once all three are done.
Renewal is one date a year; risk moves all year. The dates are yours: DeNexus doesn’t schedule the work, and costs stay internal.
When the news breaks
Coming next: model your own scenarios.
The DeRISK Scenario Simulator is a future add-on that will let you model different OT cyber scenarios against the risk you have already quantified. It is still being defined, and we will share more as it takes shape.
DeRISK Scenario Simulator add-on · in development
A number you can defend
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Confidence on show
Data sufficiency and confidence are stated with the results.
Assumptions in plain words
The report lists its assumptions and limitations.
Inputs you can check
See the inputs behind the number, and overrule the ones you know better.
Start free. Go deeper when the board asks.
Each level replaces public-data assumptions with your own evidence, which reduces the uncertainty around your number.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions
DeRISK Control ModelNIST SP 800-82r3IEC 62443
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer
- For the company or one facility
Add-ons start here
DeRISK ConsultantDeRISK DavyDeRISK Scenario Simulator (coming)
Level 4 Evidence-Grade
You add
- OT network data for each facility
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Featured resources
All learning resources
Whitepaper · 15 min readPrioritizing OT Security by Expected Loss
Rank the work by the loss it removes, and the ranking becomes the referee between IT, the plants and finance.
Read the paperSample report (PDF).webp?width=1600&height=900&name=methodology-cover%20(1).webp)
Methodology paper · 20 min readQuantifying OT Cyber Risk: Where FAIR Stops Short
Read the paper →Learn articleHow certain is a cyber risk quantification result?
Read the article →Get your first number before the next board meeting.
Create a free account. Your company-level estimate is built from public data, so nothing touches your OT network.