# OT/ICS Portfolio Risk Exposure Aggregator

> OT/ICS Portfolio Risk Exposure Aggregator is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.4/call, status unknown (last checked 2026-09-14).

Aggregates capability-opportunity-intent threat scores across all relevant threat actors for a given sector and region, returning a ranked actor list and AI-written executive summary (BLUF/ICD-203) for board and GRC reporting.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/risk-exposure
- Price: $0.4/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-ics-portfolio-risk-exposure-aggregator-3af3d186
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_XQw-USSTY9wKafdsZUoRW

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-ics-portfolio-risk-exposure-aggregator-3af3d186
```

Example prompt: Give me a board-level OT risk exposure summary for the energy sector in the GCC region — include Schneider Modicon and Siemens SIMATIC in the vendor stack and frame it against IEC 62443-3-2 compliance.

## When to prefer this

Use this endpoint when you need a portfolio-wide, board- or GRC-ready aggregation of OT threat actor risk across a full sector and region — rather than a single actor-target pairing (use /ot/threat-score for that). Best for vCISO automation, quarterly board reporting, or compliance narrative generation where you need ranked actor intelligence and an AI-written executive summary rather than raw scores alone.

## Known failure modes

- Missing required 'sector' or 'region' query parameter returns a 400 error
- Unknown or unsupported sector/region combination may return empty actor list or low-confidence summary
- DeepSeek LLM narrative generation timeout or failure may delay or omit the executive summary
- Invalid compliance_framework value may be silently ignored or cause a malformed narrative
- Render.com cold-start latency may cause initial request timeout on idle instances

## How this service works

Board/GRC-level portfolio risk aggregator. Pass sector and region. Aggregates the same deterministic capability x opportunity x intent scoring used by /ot/threat-score across the actors relevant to that sector, ranks them, and returns a DeepSeek-written executive summary (BLUF structure, ICD-203 language). Optional compliance_framework noted qualitatively in the narrative. Portfolio-level companion to /ot/threat-score — for vCISO agents and GRC/board-reporting automation.

## Output

Returns a ranked list of threat actors relevant to the specified sector and region, each scored on capability, opportunity, and intent dimensions, along with a DeepSeek-generated executive summary in BLUF structure using ICD-203 language. If a compliance framework is specified, it is noted qualitatively within the narrative.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "sector",
      "region"
     ],
     "properties": {
      "region": {
       "type": "string",
       "description": "Target region e.g. GCC, KSA, UAE, Qatar, Europe"
      },
      "sector": {
       "type": "string",
       "description": "Target sector e.g. energy, water, manufacturing"
      },
      "timeframe": {
       "type": "string",
       "description": "Optional lookback window, default 90d"
      },
      "vendor_stack": {
       "type": "string",
       "description": "Optional comma-separated vendor list e.g. 'Schneider Modicon,Siemens SIMATIC' — feeds each actor's capability score, same as /ot/threat-score"
      },
      "compliance_framework": {
       "type": "string",
       "description": "Optional — framework to note qualitatively in the narrative e.g. NIST_CSF_2_0, IEC_62443_3_2"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "region": "GCC",
  "sector": "energy",
  "timeframe": "90d",
  "confidence": "moderate",
  "top_threats": [
   {
    "actor": "ELECTRUM",
    "confidence": "moderate",
    "threat_score": 26
   }
  ],
  "data_sources": [
   "OT-Intel-DB",
   "GDELT Project (gdeltproject.org)",
   "OFAC Sanctions List (US Treasury)",
   "DeepSeek-CTI-Synthesis"
  ],
  "executive_summary": {
   "bluf": "GCC energy sector faces elevated risk from state-linked ICS-targeting actors.",
   "narrative": "Threat activity against regional energy infrastructure has likely increased..."
  },
  "compliance_framework": null,
  "portfolio_risk_level": "ELEVATED"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-ics-portfolio-risk-exposure-aggregator-3af3d186/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)