A source-backed monthly briefing covering OT/ICS cybersecurity developments, cyber insurance market signals, and industrial risk intelligence — built for practitioners, risk owners, and insurers who need signal, not noise.
July's issue delivers what June promised: the operating model. The feature essay lays out a practical OT risk playbook built on three moves — Quantify, Reduce, Transfer — and makes the case that they run in parallel, not as phases. The thesis underneath it: OT cyber-physical risk is its own class, tail risk dominates the consequence picture, and the insurance gap between cyber and property coverage is structural — not incidental, not temporary, and not something better policy language will fix.
Download the July Newsletter →
What you'll get:
— What mattered this month: A Practical OT Risk Playbook. The four-page feature essay sets out the operating model for cyber-physical risk management. Quantify translates OT exposure into Expected Annual Loss and Value at Risk. Reduce ranks remediation by loss reduction rather than severity score. Transfer converts quantified, traceable evidence into insurability. The discipline: run all three moves continuously, because sequencing them leaves the tail uncovered while you wait.
— Regulation & industry news: CISA's Binding Operational Directive 26-04 and the shift from patch-everything to risk-based patching; active zero-day exploitation of Check Point VPN appliances; and the six-agency UK NCSC joint advisory that put OT security squarely on the board agenda. Sources this month include CISA, NCSC, CrowdStrike, and Check Point.
— DeNexus news: Both July webinar sessions — "Industrial OT Cyber Underwriting: From Submission to Binding Decision" and "Quantified OT Cyber Risk: From Exposure to Reduction" — are now available on demand. The new DeNexus Learning Hub is live, three white papers are in the pipeline, and you'll find us at ISA/ISASecure events through the summer.
— DeRISK Platform: The operating model behind the issue, end to end — DeRISK CRQ (Quantify) and DeRISK QVM (Reduce) on one simulation core, with DeRISK UWA Agentic (Transfer) completing the loop from OT exposure to a bindable underwriting decision.
— Coming next month: More from the Frontier AI & Industrial Cyber Risk series, and the first of three upcoming white papers.