This post is part two of a 4-part series for infrastructure fund professionals (GPs, portfolio operations, and risk leaders) focused on Operational Technology (OT) cyber risk and cyber-physical loss. Missed part one? Read it here
A common objection in investment discussions is, "We've never had an OT cyber event." That observation is not evidence of low exposure; it is a feature of the risk profile.
OT cyber-physical risk is typically low frequency and high severity. In other words, the expected loss can be modest while the tail risk can be large enough to dominate a year of cash flow or permanently alter an asset's risk premium.
For infrastructure investors, the problem is not whether an incident is likely this quarter. The problem is whether the portfolio is priced, governed, and insured for scenarios that could materially impair value.
Why OT tail risk behaves differently than IT risk
IT cyber events are often modeled around data loss, fraud, and short-duration business interruption. OT events can produce longer and more complex recovery profiles because physical processes must be stabilized safely, control systems must be carefully restored, and policies & regulations may require integrity validation before restart.
In OT, small technical compromises can cascade into large operational outcomes depending on the process, safety interlocks, and operational contingency planning.
- Severity is driven by outage duration, not just intrusion presence.
- Recovery is constrained by safety and integrity validation requirements.
- Operational and supply chain interdependencies can create correlated losses across sites or services.
- The same event can trigger contractual penalties, regulatory actions, and reputational costs.
- Certain industries are national critical infrastructure, with greater dependence for the greater good as well as regulatory scrutiny (e.g., water, power, cloud datacenters).
- Heat maps do not separate frequency from severity.
- They do not provide loss estimates that can be reconciled to cash flow models.
- They do not clearly show how specific mitigations reduce tail exposure.
- Estimate operational consequences (downtime, lost capacity, waste materials, contractual penalties).
- Translate consequences into financial loss drivers (revenue loss, extra OPEX, penalties, capex repair, delayed projects).
- Aggregate to a portfolio view to identify concentration and systemic exposure.
Why qualitative heat maps do not survive investment committee (IC) and lender scrutiny
Red-amber-green scoring can be useful for program management, but it rarely answers the investor questions that matter: How big can the loss be? Which scenarios drive the tail? What is the value-at-risk concentration by asset, sector, or vendor?
Without financial quantification of risk, teams often default to generic control lists and uneven prioritization. That increases the chance that capital is spent on controls that are visible rather than controls that move the risk curve.
Ready to quantify your OT cyber exposure and get investor-ready outputs?
Click Here to Get Started →
A practical investor-grade approach to OT risk quantification
Scenario-based quantification is the most defensible method for OT tail risk. It starts with realistic operational scenarios that connect attack pathways to physical outcomes, and then translates those outcomes into loss drivers.
For funds, the goal is not academic precision. The goal is a consistent, auditable basis for decisioning across assets: where to intervene first, what to require from management teams, and how to communicate residual risk to stakeholders.
How this improves portfolio outcomes
Once tail scenarios are quantified, mitigation planning becomes a capital allocation exercise: controls and operational changes are prioritized by expected risk reduction and feasibility within uptime constraints.
Quantification also strengthens narratives in IC memos, refinancing materials, and insurance discussions because assumptions and residual risk are explicit.
Next step
Complete the form to book a demo and receive a concise overview of the workflow and outputs (including investor-ready reporting and insurance-ready documentation) so we can discuss your portfolio context and show the platform in action.