Which plants carry the risk
Share of company expected annual loss. Seven more plants: $5.7M (31%).
For COOs
Run the plants. Know what cyber could cost each one.
Expected annual loss and a 1-in-100 year loss for each plant, ranked, with the attack scenarios behind them.
Your first result is a DeRISK™ CRQ estimate for your company, built from public data. Plant-by-plant results start at Level 3 Board-Grade. Nothing connects to your OT network.
Your first resultLevel 1 Estimate · company scope
$18.4MExpected annual loss
$64M1-in-20 year
$112M1-in-100 year
Top loss typeBusiness interruption · 46%
Top attack methodRansomware with data exfiltration · 48%
Revenue stress test1-in-100 year = 6.1% of revenue
From public data · thousands of simulated years · assumptions and limitations listed
Security findings don’t say which plant to protect first.
- The shutdown call is yours.When an attack hits, operations decides whether to stop a plant, often before anyone knows what the attacker reached.
- Ransomware stops operations.Dragos saw significant operational disruption in every OT ransomware case it worked.Dragos, OT/ICS Cybersecurity Year in Review, 2026
- Recovery outlasts the attack.Nearly one in five incidents took more than a month to remediate.SANS, State of ICS/OT Security, 2025
11%
Unplanned downtime, from all causes, already costs the world’s 500 largest companies 11% of revenue.Siemens, The True Cost of Downtime 2024
Frequency
Magnitude
Which plants carry the risk
- Houston, TX$4.4M · 24%
- Baton Rouge, LA$3.2M · 17%
- Chicago, IL$2.0M · 11%
- Pittsburgh, PA$1.7M · 9%
- Tulsa, OK$1.4M · 8%
Share of company expected annual loss. Seven more plants: $5.7M (31%).
Speak the plant’s language and the board’s.
One plant, as the floor sees it, as operations tracks it, and as the board hears it.
1On the plant floor
A vendor’s remote access account can reach Houston’s line controls.
2In the operations review
Houston carries more OT cyber risk than any other plant: 24% of the company’s expected loss.
3In the boardroom
$4.4M a year of the company’s $18.4M expected loss sits at Houston.
What you take to the operations review
Generic views of the COO report at DeRISK CRQ Level 3 Board-Grade, plant by plant.
Hotspot: Houston, TX
$4.4MShare of company loss (24%)
$7.9MHouston on its own
$46MOn its own, 1-in-100 year
Weakest controlFirewalls · 1.0 of 4
Top attack methodRansomware with data exfiltration
Top loss typeBusiness interruption
Two figures, both labeled: Houston’s share of company loss, and its loss on its own.
Control maturity by plant
| Plant | Firewalls | Malware prevention | Vulnerabilities | Access controls | Detection | Incident response | Backups | Average |
|---|---|---|---|---|---|---|---|---|
| Houston | 1.0 | 2.0 | 1.5 | 1.5 | 2.0 | 2.0 | 1.5 | 1.6 |
| Baton Rouge | 2.0 | 2.5 | 1.5 | 2.0 | 1.5 | 2.0 | 1.5 | 1.9 |
| Chicago | 2.5 | 2.5 | 2.0 | 2.5 | 2.0 | 2.0 | 2.5 | 2.3 |
| Pittsburgh | 2.5 | 2.0 | 2.0 | 2.0 | 2.0 | 1.5 | 2.5 | 2.1 |
| Tulsa | 1.5 | 1.5 | 1.0 | 1.5 | 1.0 | 1.0 | 1.5 | 1.3 |
Scale 0 to 4; lighter is weaker. Tulsa scores weakest, but Houston carries more loss: rank by loss, not by score. Also available in IEC 62443, NIST SP 800-82r3 or the DeRISK Control Model.
Risk trajectory
$18.4MExpected annual loss now
$11.1MForecast after the Consultant’s three projects
Past assessmentsForecast with the DeRISK Consultant’s projects
Expected annual loss. The forecast follows the Consultant’s project order, not dates: DeNexus doesn’t schedule the work.
Where the loss sits, plant by plant
1
Houston, TX
$4.4M a year2
Baton Rouge, LA
$3.2M3
Chicago, IL
$2.0MOver $3M$1.2M to $3MUnder $1.2MCircle size = expected annual loss
Expected annual loss by plant. Plant-by-plant results start at Level 3 Board-Grade.
In the operations review
Answer the plant question in the review, not next month.
- A plant manager asks why their site ranks first.
- Instead of “I’ll find out,” ask DeRISK in plain words.
- Davy answers from your own results, with the chart or table behind it.
Your DeRISK results already hold the answer. Finding it shouldn’t take a meeting.
DeRISK Davy add-on
Davy is the voice; the score, the decision and the report come from DeRISK. Davy runs on frontier AI models, privately inside DeNexus’ own cloud environment. Guardrails at the model boundary. No training on your data. Your conversation history stays in your account, and you can delete it at any time.
DavyAnswers from your Level 3 Board-Grade results
VP of manufacturing
Which plant carries the most?
Houston: $4.4M a year, 24% of company expected annual loss. Baton Rouge is next at $3.2M.
Ask DeRISK…
Before the next outage window
Fix in an order operations can absorb.
Every outage window has more projects than slots. Rank the work by the loss it removes, and security earns its slot on the merits.
Add the DeRISK Consultant to get the next-best remediation projects, their scope and their order, in less than one hour. Your planners fit them into the outage windows you already have. It doesn’t price or schedule the work, so bring your own costs and dates.
DeRISK Consultant add-on
Execution sequence
- Segment the remote access pathAll plants, Houston first−$4.1M
- Back up and test controller configurationsHouston and Baton Rouge−$2.3M
- Restrict removable media on operator stationsAll plants−$0.9M
Continuity payoff
$18.4MExpected annual loss now
$11.1MAfter all three
Loss removed per year, per project. Return needs your own costs.
When a peer’s plant stops
Coming next: model your own scenarios.
The DeRISK Scenario Simulator is a future add-on that will let you model different OT cyber scenarios against the risk you have already quantified. It is still being defined, and we will share more as it takes shape.
DeRISK Scenario Simulator add-on · in development
Numbers your plants can check
FAIR-based simulation
The probability of a loss (frequency) and its severity (magnitude), over thousands of simulated years.
Plant by plant
Each plant gets its own results from Level 3 Board-Grade up, so you can compare sites.
Inputs you can check
See the inputs behind each plant’s number, and overrule the ones you know better.
Start without new monitoring
Level 3 Board-Grade works from public data and about 50 questions. OT network data comes in at Level 4 Evidence-Grade.
Ask your CISO
Ask your CISO to bring it in plant terms.
Your CISO already holds the security findings. With DeRISK CRQ, they can bring them to the operations review as dollars by plant, ranked, instead of vulnerability lists.
- Which plants carry the most OT cyber risk, in dollars
- What a bad year could cost each plant
- The order of the next fixes, and the loss each one removes
The Operational Resilience & Facility Risk report comes with DeRISK CRQ Level 3 Board-Grade. Anyone can start with the free estimate.
ToYour CISO
SubjectOT cyber risk, plant by plant
Could you run our OT cyber risk through DeRISK CRQ and bring the plant ranking to the next operations review? I’d like to see which plants carry the most risk in dollars, and what a bad year could cost each one.
Start free. Go plant by plant when you’re ready.
Each level replaces public-data assumptions with your own evidence, which reduces the uncertainty around your number.
Free
Level 1 Estimate
where you startYou add
- Nothing for a public company
- Annual revenue for a private one
You get
- Expected annual loss
- A 1-in-20 and 1-in-100 year
- A revenue stress test
- The attack methods and loss types behind them
Level 2 Baseline
You add
- Fewer than 10 questions
You get
- The Level 1 Estimate
- Value at risk for each scenario
- The scenario register
Premium
Level 3 Board-Grade
You add
- About 50 questions in IEC 62443, NIST SP 800-82r3 or the DeRISK Control Model
You get
- Reports for the board, CFO, CISO, COO and Chief Risk Officer, for the company or each plant
- Add-ons start here: DeRISK Consultant, DeRISK Davy and DeRISK Scenario Simulator (coming)
Level 4 Evidence-Grade
You add
- OT network data for each plant
- Network diagrams or static files qualify
- Monitoring sensors are optional
You get
- The same reports, grounded in what your OT networks show
Featured resources
All learning resources
Whitepaper · 10 min readOT Cyber Risk in Production Days
Operations measures disruption in days, not vulnerabilities. Cyber risk has to be told in days, per plant.
Read the paperSample report (PDF).webp?width=1600&height=900&name=methodology-cover%20(1).webp)
Methodology paper · 20 min readQuantifying OT Cyber Risk: Where FAIR Stops Short
Read the paper →Learn articleHow certain is a cyber risk quantification result?
Read the article →Get your first number before the next operations review.
Create a free account. Your first result is a company-level estimate from public data, so nothing touches your plants’ networks. Plant-by-plant results start at Level 3 Board-Grade.
Not the one who runs security? Send this page to your CISO.