DeNexus Revolutionizes OT Risk-Based Vulnerability Management with AI-Powered DeRISK Quantified Vulnerability Management

New capability maps individual vulnerabilities in OT networks to dollars at risk, enabling effective risk-based vulnerability prioritization

BOSTON, March 26, 2025 /PRNewswire/ -- DeNexus, a leader in end-to-end cyber risk management for operational technology (OT) in Industrial Enterprises and Critical Infrastructures with cyber-physical assets, today announced an innovative enhancement to its cyber risk management flagship solution DeRISK™. The new DeRISK Quantified Vulnerability Management leverages advanced AI techniques to automatically and continuously mapping common vulnerabilities and exposures, or CVEs, to potential financial impacts, providing unprecedented insights for cybersecurity teams.

This new solution will revolutionize vulnerability management in OT environments by addressing the overwhelming challenge of prioritizing CVEs, reducing the task to only those that drive financial exposure, and transforming how organizations handle cybersecurity risks in industrial settings. Unlike traditional scoring methods, DeRISK Quantified Vulnerability Management translates cybersecurity vulnerabilities and controls into clear financial risk metrics including dollars at risk, enabling executives to make informed business decisions in cybersecurity investments. By integrating with leading ICS/OT security solutions and leveraging advanced technologies like generative AI, it provides a comprehensive, business-oriented view of vulnerability management priorities.

"DeRISK Quantified Vulnerability Management is groundbreaking, bringing significant efficiency to security teams, MSSPs and MSPs" said Jose Seara, CEO and co-founder of DeNexus. "Instead of allocating precious time and resources to vulnerabilities that do not truly drive risk even if highly critical and exploitable, they can now focus only on the ones that might trigger the greatest operational and financial damage to the organization."

"Evaluating cyber exposures and cyber risks using business-level metrics is transformational for cybersecurity teams in their need to justify investments," says Paul Donnelly, OT Systems Engineer at EDF Renewables United Kingdom. "This starts with understanding the financial and operational damages potentially caused by vulnerabilities throughout the supply chain."

Despite various scoring systems like CVSS, EPSS, and KEV, cybersecurity teams remain overwhelmed by the volume of vulnerabilities to address. Recent research shows organizations take about a year (361 days) to address 50% of the CVEs that impact their environment. DeNexus' new offering tackles this challenge head-on by applying advanced cyber risk modeling and quantification techniques to compile Value at Risk and Expected Financial Loss for each identified vulnerability, given security controls in place. 

"Using a true risk-based approach to vulnerability management is no longer a nice-to-have—if we all keep just chasing CVSS metrics, we will all go broke and sleepless" says John Franzino, Founder and CEO of GridSecurity Inc. "In addition to layering in exploit metrics like EPSS and KEV, we must understand the context and exposure of identified vulnerabilities—using DeRISK's wealth of outside-in and inside-out data, we can now prioritize remediation at scale, while also having financial data to support risk-acceptance decisions."

Key highlights of the new offering include:

• AI-Powered Vulnerability Mapping: Utilizing Large Language Models (LLMs), DeRISK™ automatically maps daily newly published Common Vulnerabilities and Exposures (CVEs) to the MITRE ATT&CK frameworks for Enterprise and ICS.
• Financial Risk Quantification: DeNexus' advanced risk modeling powered by inside data from OT systems processes this mapping to calculate the Value at Risk and Expected Financial Loss for each identified vulnerability in a given network, considering the network topology, role of the affected device, and implemented cybersecurity controls.
• DeRISK Quantified Vulnerability Management (DQVM): Combining this new offering with DeNexus´ state-of-the-art Risk Mitigation Simulation feature in DeRISK™, enterprises with industrial networks now take a financial approach to vulnerability management.
• Integrated Vulnerability Data: The solution incorporates inside-out vulnerability data from leading cybersecurity partners including Claroty, Forescout, Nozomi Networks, and Tenable.

For more information about DeNexus' DeRISK Quantified Vulnerability Management or to request a demonstration, please visit: https://www.denexus.io/products/derisk/derisk-quantified-vulnerability-management

About DeNexus™: 
DeNexus is a leading provider of end-to-end cyber risk management for industrial networks. The company aims to establish the global standard in industrial cyber risk management for risk owners, shareholders, investors, boards, and the risk transfer market. Employing advanced simulation, AI, and internal data, DeNexus forecasts incident probabilities, translating them into quantifiable financial risks. Trusted by Global 1000 companies in sectors like energy, manufacturing, transportation, and data center operations, DeNexus provides an evidence-based approach to tailor cybersecurity economics and enhance risk reduction investments. https://www.denexus.io 

Media Contacts
Abigail Dellapina
[email protected]

SOURCE DeNexus