Account for what runs and who can reach it, then close the gaps

For CISOs, IT directors and technical leads facing NIS2 or Cyber Resilience Act requirements, visibility precedes control. Without an account of host software and authorised access to critical assets, you cannot demonstrate that risk-management measures work. This page explains how we establish that visibility and close the gaps it reveals, and ends with a technical security gap analysis.

Start from evidence: what runs and who can reach it

Directive (EU) 2022/2555 (NIS2), Article 21(2), requires risk-management measures including supply-chain security, vulnerability handling, access control, and asset management. Management is accountable under Article 20.

We establish the baseline through two read-only assessments:

Software provenance: every file on a Linux host receives a verdict on where it came from and whether it should stay; files nobody can vouch for become a prioritised keep, remove, or review list.
Cloud access paths: we compute which people, pipelines, and workloads are authorised to reach sensitive Azure, Entra ID, and AKS assets, and the smallest set of changes that closes those routes.

Both are analysed on our self-hosted EU infrastructure; no third-party cloud AI service sees your data. Host reliability and basic cyber hygiene—firewall rules, SSH hardening, patch status—are covered by the SRE audit under Continuity.

Close the gaps through defined projects

We deliver follow-up actions as defined projects with fixed scope and end dates: hardening reviews, secure software architecture, and certificate, remote-access, and mail infrastructure your auditors can inspect.

Prepare for the Cyber Resilience Act

Manufacturers of products with digital elements must comply with Regulation (EU) 2024/2847. Reporting obligations apply from 11 September 2026, and main obligations from 11 December 2027. We support vulnerability handling, Software Bill of Materials (SBOM), coordinated disclosure, and the technical documentation required for conformity assessment.

Schedule a technical security gap analysis

Services

Services in this umbrella

Software provenance

A read-only software provenance assessment of your Linux hosts: a verdict for every file and a prioritised keep, remove or review list.

Read the full page

Cloud access paths

A read-only review of Azure, Entra ID and AKS access paths: who can reach your secrets, data and admin roles, and the fewest changes that close it.

Read the full page

Certificate lifecycle

Design and operate a PKI that distinguishes between valid historical signatures and post-compromise suspect data using CRL and OCSP with effective-time semantics.

Read the full page

Managed VPN

Hardened IKEv2 IPsec VPN gateway for IT leads. Secure site-to-site and road-warrior access using automated, certificate-based authentication.

Read the full page

Secure email

Replace US-based hyperscalers with a self-hosted, GDPR-compliant mail stack featuring mutual TLS, ClamAV, and rspamd filtering.

Read the full page

.fi domains

We provide accredited .fi domain registration and management, ensuring full compliance with Traficom regulations and RFC 5730–5733 standards.

Read the full page

Security training

Structured, exam-backed online courses on EU and Finnish security regulations including NIS2, CRA, AI Act, and Katakri TL IV for professional teams.

Read the full page