Code Red and the Economics of Cyber-Physical Risk

Code Red and the Economics of Cyber-Physical Risk; with insights from DeNexus, based on research by the McCrary Institute for Cyber and Critical Infrastructure Security 

A Wake-Up Call for Industrial Cyber Risk Quantification 

The McCrary Institute’s Code Red: A Guide to Understanding China’s Sophisticated Typhoon Cyber Campaigns issues a stark warning to asset owners across energy, manufacturing, water, and telecom. The report, authored by leading cybersecurity and intelligence experts Frank Cilluffo, William Evanina, and Mark Montgomery, details how China’s state-backed “Typhoon” campaigns are no longer focused on data theft — they now target disruption. 

These campaigns embed themselves into the operational technology (OT) systems that sustain modern life: energy grids, water utilities, pipelines, and communication networks. For OT leaders and policymakers, the implications are clear — cybersecurity risk is now a board-level financial risk. 

From Espionage to Operational Disruption 

What makes Code Red distinctive is its focus on cyber-physical consequences. The report outlines how multiple PRC-backed Typhoon operations — Volt, Flax, Salt, Linen, Violet, Silk, and Nylon Typhoon — collectively enable the potential for widespread physical disruption: 

• Volt Typhoon: Embedded in energy, telecom, and water systems near military and critical infrastructure. 

• Flax Typhoon: Exploited IoT devices across manufacturing and government networks for reconnaissance. 

• Salt Typhoon: Targeted major telecom carriers, breaching data from over a million Americans. 

• Silk & Linen Typhoon: Leveraged zero-day vulnerabilities in Microsoft SharePoint and trusted supply chains. 

Together, these campaigns illustrate a single strategic playbook — one that fuses espionage, disruption, and influence into a unified doctrine of cyber-enabled statecraft. 

The Financial Dimension of OT Cyber Risk 

The McCrary Institute emphasizes a crucial shift: cyber threats must be measured as financial exposures, not just technical incidents. 

A successful cyber-physical attack on a grid or water utility could cascade into production losses, supply-chain breakdowns, and capital-market shocks. 

For CISOs, CFOs, and OT executives, this requires adopting industrial cyber risk quantification — the ability to model and price risk based on expected loss and Value-at-Risk (VaR). Key imperatives include: 

• Modeling cross-sector loss scenarios to understand system interdependencies. 

• Translating vulnerabilities into quantified financial impact for board-level reporting. 

• Integrating cyber risk analytics into enterprise risk management and insurance portfolios. 

Only by doing so can asset owners achieve true risk-based cybersecurity investment and align defense budgets with measurable outcomes. 

From Awareness to Action: DeNexus’ Quantified Approach 

DeNexus expands on the McCrary Institute’s findings through its DeRISK platform — a full-stack solution to industrial cyber risk quantification and management. By combining threat intelligence with financial modeling, DeRISK transforms technical vulnerabilities into evidence-based cybersecurity metrics executives can act upon. 

With DeRISK QVM and CRQ, organizations can: 

• Map exposure across manufacturing and energy sectors — the same targets highlighted in Code Red. 

• Quantify potential financial loss (Expected Loss and VaR) from cyber-induced disruptions. 

• Prioritize investments using quantified vulnerability management (QVM) instead of subjective scoring. 

• Optimize cyber insurance coverage based on empirical risk data, not estimations. 

• Simulate cascading impacts — such as how a power outage may ripple into other sectors. 

This quantified approach bridges the gap between OT cyber risk management and enterprise financial resilience, enabling leadership teams to make informed, defensible decisions. 

“With DeRISK, asset owners no longer discuss cyber risk in technical terms — they discuss it in dollars, probabilities, and expected outcomes.” 

Conclusion: Measuring What Matters 

Code Red underscores a fundamental truth — the future of cybersecurity is quantitative. 

As state-backed operations evolve, industrial and critical infrastructure operators must evolve too — from reactive protection to predictive resilience. 

Platforms like DeNexus DeRISK empower organizations to turn intelligence into insight and risk into measurable action. The ability to quantify cyber-physical exposure is now the difference between awareness and preparedness. 

Request a demo of DeRISK QVM today to start translating OT exposures into board-level metrics. 

Or learn more about Cyber Risk Quantification (CRQ) for industrial resilience.