A modernization plan isn't defended in projects. It's defended in dollars.

Each initiative carries a loss range (minimum and maximum) and an annual event frequency, following the FAIR approach. Two engines run on that: a deterministic annualized loss expectancy (ALE) you can defend line by line, and a Monte Carlo simulation for the distribution behind it. The simulation is seeded: the same data gives the same result, so two versions of the plan can be compared without random noise.

Gross exposure is the annualized expected loss across the whole register before any mitigation credit — what you carry today. Residual exposure is the same calculation after each initiative in the plan applies its mitigation. The difference, avoided exposure, is what the roadmap takes off the table: its value is stated in dollars per year rather than claimed.

It is the 90th percentile of simulated annual losses. Lanterna Tech states it in plain words: “there is a 10% chance that annual losses exceed X.” The median (P50) describes an ordinary year, the P90 a plausible bad one; the loss exceedance curve sets both against your risk appetite threshold.

Yes. The Enterprise OT tier adds the Purdue model, from the physical process (level 0) up to the enterprise (level 4) with the industrial DMZ at 3.5, plus IEC 62443 zones and conduits with their target security levels. You can import findings from Claroty or Nozomi Networks and track what changed week to week, and run IEC 62443 assessment campaigns with your suppliers.

No. The IEC 62443 and NIST CSF 2.0 assessments are self-assessment and prioritization tools: they show where you stand and where to start, then turn the gaps into costed initiatives. They certify nothing and do not replace an auditor.

Partly, and we say so plainly. All of your organization's data is encrypted at rest with a key unique to your organization, wrapped by a KMS vault kept apart from the database: a stolen database or backup yields nothing readable, but our server can decrypt the data to run the application. Once your administrator turns on the vault, the most sensitive fields (asset names and descriptions, the OT register, supplier contact details, assessment notes) are encrypted in your browser with a key derived from your passphrase, which we never hold: those we cannot open. The limit of any in-browser encryption applies: it does not protect against a compromised server delivering modified code.

Starter $100, Professional $350 and Enterprise $650 per month, in US dollars; Enterprise OT is quoted. Annual billing takes −25% off. Each tier lists its user, initiative and asset limits in the Pricing section.

Creating an initiative takes about thirty seconds, and both initiatives and assets can be imported from CSV. You are not on your own either: we set up your first assets with you, and the Enterprise OT tier includes dedicated OT onboarding.