EU Network and Information Security Directive 2

Continuous scanning checks each engine and version against known CVEs, missing patches, end-of-life versions, and hardening benchmarks, and extends to the network: exposed listeners, unexpected reachability, weak TLS, and drift from the documented baseline. Findings rank by exploitability and by the classification of the data at risk, so the same CVE sits differently in the queue on classified data than on a development copy — and the scan history is the evidence that the control operated continuously rather than quarterly.

This mandate asks for documented policy and procedure rather than telemetry, so the platform is the evidence layer beneath it rather than the control itself. Our advisory engagements organise that documentation — a gap register mapping each requirement to its current state and a named owner, a sequenced remediation roadmap, and quarterly auditor-ready packs — and we answer the database-controls questions during the audit window. Drafting and owning the policy stays with you; assembling the evidence that it operates does not have to.

Notification clocks start when you become aware, so detection latency is the whole exposure. Behavioural baselines score each deviation as it happens and flag it in under a second, rather than surfacing it in a weekly review. Severity is decided at the collector and routed immediately, so the window between the access and someone knowing about it is measured in seconds — and the audit trail behind it already holds what was reached, by whom, and when.

A supplier-risk requirement has two halves and they are not equally hard. The register of providers, the contractual clauses, and the assessment of each supplier as an organisation are yours to maintain — nothing in the platform produces them. The half that is usually undocumented is what those suppliers, their tooling, and their service accounts are actually reaching inside your estate. Scanning surfaces the shared and vendor-default accounts, the credentials with no owner, and the standing privileges nobody has exercised; the query trail then shows which of those grants were used, against which classified tables, from which client host. So the review reflects observed third-party access rather than an attestation, and an integrator session that steps outside its usual pattern is scored as it happens rather than found at the next annual review.