Security tools grade posture ("how mature are your controls?"). Engineers ask a different question: if this fails, what breaks, who's hurt, and does it fail safe? This maps fragility on the two axes that actually drive engineering work — consequence severity × resilience-engineering maturity. The red corner is where engineering goes first.
Stands on INL's Cyber-Informed Engineering (CIE) — baking cyber into the engineering lifecycle — and its consequence-first method, Consequence-driven Cyber-informed Engineering (CCE): start from the worst outcomes, engineer the digital pathways out. Organized by the six IEEE TIPPSS dimensions. Example below: a small water utility.
Click any function chip on the map to see its consequence-first questions and where it lands — and why.
Why this is a demo, not a product: the hard part isn't the map — it's calibrating "how bad" against the real world. That's exactly what we'd build with partners: UnDisruptable27's resilience engineering (which failures actually matter, and how to make them survivable) and IEEE TIPPSS's reach and data. VCRI brings the neutral instrument; the consequence-severity taxonomy borrows from FMEA / process-safety / CCE; base rates can seed from public incident data (DOE outage reports, CSB/PHMSA/NTSB).
© 2026 Value Chain Risk Institute · concept demo · illustrative data only.