NIS2 · Directive (EU) 2022/2555
See which NIS2 requirements OwlyScan covers — with proof you can show.
EU hosted · Audit-ready reports · Free company check
OwlyScan
OwlyScan is a deep and dark web monitoring platform. It indexes documents in every format and language, watches your company and your suppliers, and turns hits into alerts and audit-ready reports.
Your organisation, direct suppliers, and critical subcontractors enter the watch list.
Leaks, dumps, forums, and marketplaces are indexed; AI filters what concerns your perimeter.
Alerts and audit-ready reports document that supply-chain exposure watch is running.
OwlyScan supports selected measures with external monitoring and evidence. It is not a certification, and it does not replace your full compliance programme.
| Ref | Domain | What the framework asks | Coverage | How OwlyScan helps |
|---|---|---|---|---|
| Art. 21(2)(d) | Supply chain security | Manage cybersecurity risk in relationships with direct suppliers and service providers, including their vulnerabilities and practices. | Covered | Continuous deep and dark web monitoring of named suppliers and subcontractors, with alerts and reports for the supplier risk file. |
Manage cybersecurity risk in relationships with direct suppliers and service providers, including their vulnerabilities and practices.
Continuous deep and dark web monitoring of named suppliers and subcontractors, with alerts and reports for the supplier risk file.
| Ref | Domain | What the framework asks | Coverage | How OwlyScan helps |
|---|---|---|---|---|
| Art. 21(2)(b) | Incident handling | Detect, analyse, contain, and respond to cybersecurity incidents. | Partial | Early external signal when credentials or documents appear on the dark web; sourced findings for analysis. Not containment or SOC tooling. |
| Art. 21(2)(a) | Risk analysis | Policies on risk analysis and information system security. | Partial | Objective exposure evidence of what actually circulates about you and your chain — input to risk analysis beyond self-attestation. |
| Art. 21(2)(f) | Effectiveness of measures | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures. | Partial | Audit-ready monitoring reports document that supply-chain and self exposure watch is operational over time. |
| Art. 23 | Incident reporting | Report significant incidents to competent authorities within mandated timelines. | Partial | Timestamped artefacts for the narrative and timeline. Does not file notifications. |
| Art. 21(2)(c) | Business continuity / crisis | Business continuity, backup, disaster recovery, and crisis management. | Partial | Faster awareness of exfiltration can reduce time-to-decision. Not a BCP or backup product. |
Detect, analyse, contain, and respond to cybersecurity incidents.
Early external signal when credentials or documents appear on the dark web; sourced findings for analysis. Not containment or SOC tooling.
Policies on risk analysis and information system security.
Objective exposure evidence of what actually circulates about you and your chain — input to risk analysis beyond self-attestation.
Policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
Audit-ready monitoring reports document that supply-chain and self exposure watch is operational over time.
Report significant incidents to competent authorities within mandated timelines.
Timestamped artefacts for the narrative and timeline. Does not file notifications.
Business continuity, backup, disaster recovery, and crisis management.
Faster awareness of exfiltration can reduce time-to-decision. Not a BCP or backup product.
NIS2 incident handling is more than a procedure. External leak signals often arrive first on the dark web.
Continuous monitoring of you and suppliers reduces blind spots before a significant incident is declared.
Alerts when credentials or documents appear underground feed detection and analysis under Art. 21(2)(b).
Investigation mode scopes what was published, about whom, and since when — with sources for the file and for Art. 23 narrative support.
OwlyScan does not isolate hosts, run your SOC, or file notifications with authorities.
Outputs designed for CISOs, compliance, procurement, and incident responders.
EU hosted · Audit-ready reports · Free company check
