A number read in isolation gets interpreted against whatever reference the reader happens to carry — and that’s how risk estimates produce reflexive conservatism or false confidence. This month’s DeNexus newsletter makes the case that benchmarks and executive reporting are what turn an OT risk number into a decision.
Benchmarks and executive reporting. Comparability is becoming the standard. The discipline is twofold: cohort discipline — comparing facilities against peers with similar exposure archetypes (architecture, segmentation maturity, restore readiness, vendor dependency), not generic sector averages — and executive-narrative discipline: a one-page view of drivers, options, trend, and residual tail, built on versioned evidence that survives challenge. Numbers without a narrative produce questions, not decisions.
OT attacks, regulation & guidance. The FBI and US Coast Guard boarded two US-bound oil tankers after signs of network compromise — a reminder not to call a network event “control-system manipulation” without evidence. The EU Cyber Resilience Act’s reporting obligations went live on 11 September via ENISA’s Single Reporting Platform. CISA launched a CVE “Quality Era” framework; NIST opened its SP 800-82 Rev. 4 draft; ENISA’s 2026 Threat Landscape analyzed 8,257 incidents; NetDiligence’s study of 10,309 claims shows large firms (3% of claims) drove 56% of $5.65B in costs; and Swiss Re projects ~$91B in AI data-center insurance premiums by 2030.
DeNexus news. September webinar recordings (UWA End-to-End; Multi-Year OT Cyber Risk Program), the Learning Hub, and four research reports available to download.