Trusted by industrial operators and insurers
Quantify. Reduce. Transfer.
01 Quantify · DeRISK CRQ
Know what an event would actually cost
Expected annual loss in dollars, built from your OT topology and your control posture — not from a maturity score somebody assigned you.
How DeRISK does it
DeRISK quantifies each site on its own, from its network topology and asset criticality. You see which plant carries the exposure and how much, so the budget conversation starts with a location instead of an average.
The quantification runs on FAIR and FAIR-MAM, the standards insurers and risk teams already recognise. Beneath that sits the DeRISK Consequence Model: 50 loss types, 22 of them specific to industrial operations, because a stopped production line is not a data breach.
The same number arrives as five views — CEO and board, CISO, CFO, COO and CRO. Each gets the framing their decision needs, so nobody is left translating an engineering report into a budget case.
02 Reduce · DeRISK Consultant
Spend where it buys the most risk back
Severity scores rank flaws in theory. They say nothing about which one stops your line. DeRISK ranks every mitigation by the loss it avoids, in dollars.
How DeRISK does it
Every gap is priced by the loss it carries, so the queue reorders itself around money. A CVSS 9.8 on an isolated asset can sit below a moderate flaw on the workstation that reaches your process network.
The DeRISK Consultant prescribes the next-best action and the multi-year sequence behind it, with targets set by risk, by compliance or by insurability — whichever pressure you are answering to.
Because the model recalculates as your plant changes, the reduction is measurable rather than asserted. You can show what last year's spending actually bought, quarter over quarter.
03 Transfer · DeRISK UWA
Walk into the renewal with evidence
What you cannot prove, the market prices as uncertainty. DeRISK turns your OT posture into a submission an underwriter can actually work with.
How DeRISK does it
Controls you can demonstrate carry more weight than controls you simply claim. A submission that cannot evidence its OT posture is not a neutral data gap — it is read as a risk signal, and priced accordingly.
The renewal conversation starts from a number rather than a questionnaire: expected annual loss, loss-exceedance curves, and what remains after the mitigation plan has been executed.
DeRISK UWA assesses OT submissions for insurers and reinsurers. Both sides of the table end up working from the same evidence base instead of negotiating on assumption.
Find the solution tailored to your role or industry
Not seeing your role? We translate the risk for any seat.
See all roles
See how operators and insurers put a number on OT risk
A full OT cyber submission went from intake to assessment in 11 minutes 47 seconds, with an underwriter reviewing the verdict before anything was bound. The same review typically takes 10 to 30 hours by hand.
Specialty insurance and reinsuranceDeRISK UWA · June 2026
Submission to assessment
By hand10 to 30 hours
DeRISK™ UWA11 min 47 s
< 12 minsubmission to assessment
8coverage lines assessed
Resources to put a number on OT cyber risk
Browse all resourcesGuides, standards explainers, webinars and reports — everything we publish on quantifying, reducing and transferring OT cyber risk, in one place.
Blog
Only 1% of Cyber Losses are Covered by Cyber Insurance
Read article
Blog
FAIR was built for IT. In OT, there are gaps to fill.
Read article
Blog
Building a Multi-Year OT Cyber Risk Management Program with Clearway
Read article
Blog
Industrial Cyber Insurance: Why Visibility Is the Market's Biggest Challenge
Read article
Blog
DeNexus Joins the ISA Global Cybersecurity Alliance (ISAGCA)
Read article