A company with no security team gathers assets, vulnerabilities and policies by hand, then tries to map them to the requirements in separate spreadsheets. For an audit, the evidence stays fragmented and always has to be rebuilt.
CyberAgent
NIS2 readiness, attack surface under the agent's continuous watch and validated exploitability: qualified risks and ready evidence, not lists of CVEs.
Use case · Platform availableToday With CyberAgent
NIS2 readiness
From the NIS2 directive to evidence, even without an in-house SOC.
Up to €10M or 2% of turnoverthe penalty NIS2 puts on the table
The agent maps vulnerabilities and measures to NIS2 requirements, keeps the surface under continuous watch and prepares reports and checklists ready for the board and auditors.
What it is
NIS2 extends cybersecurity obligations to thousands of SMEs in essential and important sectors. It requires adequate technical and organizational measures, vulnerability management and accountability at management-body level.
References
Directive (EU) 2022/2555 (NIS2); Legislative Decree 138/2024 (Italian transposition). Framework: ISO/IEC 27001. Financial sector: Regulation (EU) 2022/2554 (DORA).
What CyberAgent surfaces
missing measuresvulnerabilities against requirementscompliance checklistevidence for the auditorpriorities and deadlines
Use case · Platform availableToday With CyberAgent
Attack surface under control
From a quarterly scan to continuous watch across network, web apps and APIs.
Continuous coveragenot a snapshot every three months
Periodic assessments or costly red teams, with a long window in which new vulnerabilities go unseen. The CVE list grows without a priority that reflects real risk.
Continuous asset discovery and vulnerability assessment, a real-time CVE database, correlation with EPSS and CISA KEV. New exposures surface as they appear, already qualified by risk.
What it is
The attack surface changes every week: new services, subdomains, APIs, dependencies. A periodic scan captures a single moment; between one scan and the next, new exposures stay invisible.
References
Risk sources: CVE (MITRE/NVD), EPSS (FIRST), CISA KEV catalog. Aligned to ISO/IEC 27001 controls and to NIS2 vulnerability-management requirements.
What CyberAgent surfaces
newly exposed assetsCVEs with high EPSSpresence in CISA KEVopen services and portsvulnerable dependencies
Use case · Platform availableToday With CyberAgent
Exploitability validated
Automated pentesting confirms which vulnerabilities are actually exploitable in your environment.
Without an external red teamexploitability confirmed automatically, continuously
External red teams engaged once or twice a year, costly and point-in-time. In between, teams work on a CVE list without knowing which ones actually matter.
Automated pentest simulates real attacks on network, web apps and APIs and confirms what is exploitable, continuously. The team receives validated risks, not just alerts.
What it is
A pentest checks whether a vulnerability is concretely exploitable in the real context: attack chains, configurations, reachability. A CVE list ranked by CVSS does not tell you: many “criticals” are not reachable, and some “mediums” are.
References
Reference methodologies: OWASP Testing Guide, PTES. Legitimate use: activities run only on assets whose control has been verified (domain validation).
What CyberAgent surfaces
exploitable vulnerabilitiesattack chainsfalse positives ruled outreachable assetsexploits proven safely
Use case · Platform availableToday With CyberAgent
Phishing and awareness
NIS2 requires training and basic cyber hygiene: the human factor is something you measure, not assume.
Art. 21 NIS2requires basic cyber hygiene and cybersecurity training
One-off training or generic online courses, with no measure of effectiveness: no one knows who falls for phishing or whether things improve over time. For the audit, all that remains is the attendance certificate.
Simulated phishing campaigns and training paths, with per-employee scoring: the human factor becomes an observable metric that improves over time, with evidence ready for the audit.
What it is
The minimum measures in art. 21 of NIS2 include basic cyber hygiene practices and cybersecurity training. Phishing remains one of the most common initial access vectors: technical defences alone are not enough if one click opens the door.
References
Directive (EU) 2022/2555 (NIS2), art. 21: basic cyber hygiene and training. Legislative Decree 138/2024 (Italian transposition). Related controls: ISO/IEC 27001 (awareness and training).
What CyberAgent surfaces
click rate per campaignper-employee scoringtrend over timeuser reportstraining evidence
CyberAgent watches the surface and validates exploitability continuously: the agent does the groundwork, the decision on what to fix stays with your team. Scan scope and intensity are agreed on your case, and every activity runs only on assets whose control has been verified.