Attack surface visibility for NIS2 and DORA

Attack-surface oversight is required, tooling is priced for F500

The endpoints that solve it

A quarter-ending compliance scan in three calls

# 1. Enumerate the external attack surface (10 credits)
curl https://api.dfir-lab.ch/v1/exposure/scan \
  -H "Authorization: Bearer $DFIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target": "example-bank.eu"}' \
  -o scan-2026Q2.json

# 2. Enrich the discovered assets (3 credits per IOC)
jq '[.assets[] | {type, value}]' scan-2026Q2.json > indicators.json
curl https://api.dfir-lab.ch/v1/enrichment/lookup \
  -H "Authorization: Bearer $DFIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @indicators.json \
  -o enrichment-2026Q2.json

# 3. Ask the AI for a board-ready narrative (20 credits)
curl https://api.dfir-lab.ch/v1/ai/threat-profile \
  -H "Authorization: Bearer $DFIR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "indicators": '"$(cat enrichment-2026Q2.json)"',
    "context": "Quarterly NIS2 / DORA review — summarize exposure posture and change vs. previous quarter."
  }' \
  -o narrative-2026Q2.md

# Commit all three files to your ISMS evidence repo.

1. 01
   Step 01

   Scope

   Agree the in-scope domain list with the CISO and ISMS owner. For DORA, include every customer-facing and ICT-third-party endpoint; for NIS2, the full corporate perimeter and essential-service assets.

2. 02
   Step 02

   Scan

   Call /v1/exposure/scan for each in-scope domain. Capture the raw JSON response verbatim — timestamps included.

3. 03
   Step 03

   Enrich

   Feed the discovered assets into /v1/enrichment/lookup. Anything with a negative verdict from two or more sources becomes a remediation ticket.

4. 04
   Step 04

   Narrate

   Pipe the merged JSON into /v1/ai/threat-profile. The output is a short paragraph the CISO can paste into the quarterly risk report.

5. 05
   Step 05

   Archive

   Commit scan, enrichment, and narrative to a private, access-controlled repository. This is the audit evidence — the diff between quarters is the story.

Pricing that tracks your workload

1. 01

   Small in-scope entity — 3 domains, quarterly scan, ~20 assets each

   (3 × 10) + (3 × 20 × 3) + (3 × 20) = 30 + 180 + 60 = 270 credits per quarter ≈ 90 credits/month

   Fits Starter ($29/mo, 500 credits) with significant headroom for ad-hoc third-party due-diligence.
2. 02

   Mid-market regulated org — 10 domains, monthly scan, ~40 assets each

   (10 × 10) + (10 × 40 × 3) + (10 × 20) = 100 + 1,200 + 200 = 1,500 credits/month

   Fits Professional ($99/mo, 2,500 credits) comfortably, with room for incident-driven ad-hoc scans.
3. 03

   Bank or critical-infra operator — 40 domains, monthly scan, ~60 assets each

   (40 × 10) + (40 × 60 × 3) + (40 × 20) = 400 + 7,200 + 800 = 8,400 credits/month

   Exceeds Professional — move to Enterprise (unlimited credits, on-premise option, custom SLA).

Three ways to evaluate

Frequently asked

Q / 01

Is this a certified NIS2 / DORA compliance product?

No — neither directive certifies individual tools. NIS2 and DORA place obligations on regulated entities; this platform is one piece of evidence an entity can use to demonstrate attack-surface oversight. Your auditor looks at your process and artifacts, not a vendor logo.

Q / 02

What data does /v1/exposure/scan actually return?

Domains and subdomains resolved for the target, TLS certificates and their SANs, exposed services observed via passive sources, and the source each finding came from. Structured JSON — you parse it, you own it, you archive it.

Q / 03

Do you store our scan results?

Scan history is persisted under your organization so you can diff quarter-over-quarter and regenerate reports. On Enterprise, an on-premise deployment is available if data residency rules out the SaaS.

Q / 04

How is this different from a CVE scanner?

Exposure scanning maps what is externally visible — the asset inventory side. CVE / vulnerability scanning decides whether what is visible is patched. The two are complementary; this platform focuses on the former and leaves authenticated patch scanning to tools that do it well.

Q / 05

Can I automate this against 50 third-party suppliers?

Yes — the endpoint is stateless and rate-limited only by your credit balance. Third-party risk teams typically wire it into a GRC platform or a simple cron job that posts a weekly digest into a Slack channel.

Q / 06

Does the AI narrative make factual claims?

The narrative summarizes the scan and enrichment JSON you feed it. Treat it as a first draft — a human analyst signs off before anything reaches a risk committee. That is also what the regulators expect.