This post is part two of a 4-part series for infrastructure fund professionals (GPs, portfolio operations, and risk leaders) focused on Operational Technology (OT) cyber risk and cyber-physical loss. Missed part one? Read it here
A common objection in investment discussions is, "We've never had an OT cyber event." That observation is not evidence of low exposure; it is a feature of the risk profile.
OT cyber-physical risk is typically low frequency and high severity. In other words, the expected loss can be modest while the tail risk can be large enough to dominate a year of cash flow or permanently alter an asset's risk premium.
For infrastructure investors, the problem is not whether an incident is likely this quarter. The problem is whether the portfolio is priced, governed, and insured for scenarios that could materially impair value.
IT cyber events are often modeled around data loss, fraud, and short-duration business interruption. OT events can produce longer and more complex recovery profiles because physical processes must be stabilized safely, control systems must be carefully restored, and policies & regulations may require integrity validation before restart.
In OT, small technical compromises can cascade into large operational outcomes depending on the process, safety interlocks, and operational contingency planning.
Red-amber-green scoring can be useful for program management, but it rarely answers the investor questions that matter: How big can the loss be? Which scenarios drive the tail? What is the value-at-risk concentration by asset, sector, or vendor?
Without financial quantification of risk, teams often default to generic control lists and uneven prioritization. That increases the chance that capital is spent on controls that are visible rather than controls that move the risk curve.
Scenario-based quantification is the most defensible method for OT tail risk. It starts with realistic operational scenarios that connect attack pathways to physical outcomes, and then translates those outcomes into loss drivers.
For funds, the goal is not academic precision. The goal is a consistent, auditable basis for decisioning across assets: where to intervene first, what to require from management teams, and how to communicate residual risk to stakeholders.
Once tail scenarios are quantified, mitigation planning becomes a capital allocation exercise: controls and operational changes are prioritized by expected risk reduction and feasibility within uptime constraints.
Quantification also strengthens narratives in IC memos, refinancing materials, and insurance discussions because assumptions and residual risk are explicit.
Complete the form to book a demo and receive a concise overview of the workflow and outputs (including investor-ready reporting and insurance-ready documentation) so we can discuss your portfolio context and show the platform in action.