Your first regulator-ready NIS2 report within 24 hours.
cysec.watch is an AI-driven NIS2 compliance service for DACH companies with 50–500 employees and no in-house security team. Install a read-only collector, and five specialist agents do the work. A rules engine decides. Claude explains.
cysec.watch dashboard screenshot — product's own UI, not restyled
NIS2 and NISG
The obligation is here. The security team is not.
NIS2 widens the circle of companies with legally binding cyber-security duties to much of the mid-market. In Austria, the NISG 2026 transposes it, with registration deadlines and management liability. Most affected companies have an IT manager, not a security department. cysec.watch is built for exactly that gap.
- Scope
- Essential and important entities, generally from 50 employees or €10M turnover in listed sectors.
- Austria
- NISG 2026, in force since 1 October 2026. Registration with the competent authority required.
- Art. 21
- Ten minimum risk-management measures, from incident handling to supply-chain security.
- Liability
- Management bodies must approve and oversee measures and can be held personally accountable.
Onboarding
From install to report in one day.
- 0 hInstall the CollectorA read-only agent on one host. No firewall changes, no credentials with write rights.
- 1 hFirst evidence arrivesEncrypted and sent to your isolated tenant in Germany.
- 4 hAgents completeDiscovery, Identity, Vulnerability, Configuration and Logging finish their passes.
- 12 hVerdicts mappedThe rules engine maps every finding to NIS2 Article 21.
- 24 hReport deliveredRegulator-ready PDF with plain-language explanations and the audit log.
The report
Written for a regulator. Readable by a managing director.
Each measure gets a status, the evidence behind it and a short explanation of what it means and what to do next. No scores invented by a model — a status is either backed by evidence or it is not.
NIS2 compliance report — preview
21(2)(a)COMPLIANTRisk-analysis policy documented and reviewed in the last 12 months.
21(2)(b)GAPNo incident-handling runbook found. Template and owner proposed.
21(2)(d)PARTIALSupplier list exists; 4 of 11 critical suppliers lack security clauses.
21(2)(e)COMPLIANTVulnerability handling: 0 critical CVEs older than 30 days.
21(2)(j)GAPMFA not enforced for 3 administrative accounts.
STATUS BY RULES ENGINE · EXPLANATION BY CLAUDE · EVIDENCE IDS IN APPENDIX B
Why the AI does not decide
A model explains. A rule decides. A person signs.
Agents
Collect and analyse
Five specialist agents turn raw evidence into structured findings. They are good at coverage and tireless at detail.
Rules engine
Decides compliance
The mapping of findings to NIS2 Article 21 is deterministic code. Same evidence, same verdict, every time — and auditable.
Claude
Explains, never judges
Claude writes the plain-language explanation of each finding and what to do about it. It has no vote on the verdict.
Data residency and security
Your evidence stays in the EU, and stays read-only.
- Hosted exclusively in Germany, in an isolated tenant per customer.
- The Collector has read-only access and no capability to change or execute anything.
- Secrets, credentials and personal data are scrubbed before any content reaches a language model.
- Every verdict carries the evidence IDs that produced it. The audit log is yours to export.
- Deletion on request; no evidence is retained after offboarding.
FAQ
Do we need a security team to use cysec.watch?
No. It is built for companies with an IT manager and no dedicated security staff. The report tells you what to fix and in which order; we can connect you with partners for the hands-on work if you want.
What does the Collector actually access?
Configuration, identity and logging data in read-only mode. It cannot change settings, run commands or move laterally. The full access list is published and part of the contract.
Does our data get used to train models?
No. Nothing you send is used for training, and content is scrubbed of secrets and personal data before any model sees it.
Is the compliance verdict legally binding?
No software can give a legally binding verdict. cysec.watch gives you a transparent, evidence-backed mapping to Article 21 that you and your auditor can rely on and verify.
How is it priced?
A monthly subscription by company size, with no setup fee. [Pricing placeholder — to be confirmed.]
See it on your own network.
Install the Collector today; read your first report tomorrow.