Free check Check exposure →
Platform/nis2
EU DIRECTIVE NIS2

NIS2 starts at your attack surface.

NIS2 obliges thousands of organisations across the EU to run technical risk management - including the systems that are reachable from the internet. See in two minutes what an attacker sees of your organisation.

Free attack-surface analysis → What NIS2 requires Passive, non-intrusive, no login.
01

Are you in scope?

The NIS2 directive (EU) 2022/2555 sharply widens the circle of regulated organisations and is being transposed into national law (in Germany via the NIS2 implementation act). It distinguishes two categories.

ANNEX I
Essential entities
High-criticality sectors such as energy, transport, banking, health, water, digital infrastructure and public administration.
ANNEX II
Important entities
Other critical sectors such as postal services, waste, chemicals, food, manufacturing, digital providers and research.
Rule of thumb: medium and large entities - from around 50 employees or 10 million euro turnover - in one of the covered sectors. Some entities are in scope regardless of size.
COVERED SECTORS (NOT EXHAUSTIVE)
Energy
Transport
Banking
Financial market infrastructure
Health
Drinking water
Waste water
Digital infrastructure
ICT service management (B2B)
Public administration
Space
Postal & courier
Waste management
Chemicals
Food
Manufacturing
Digital providers
Research

This is an orientation. Whether and how NIS2 applies to you depends on your specific case.

Check your scope in two questions →
02

What NIS2 requires - technically

Article 21 requires appropriate technical and organisational measures "state of the art". Several of them can be measured from the outside - that is where Athorion fits in (marked green).

21.2 a Risk analysis & information security policies Organisational
21.2 b Incident handling & detection Athorion
21.2 c Business continuity, backup & crisis management Organisational
21.2 d Supply-chain security Athorion
21.2 e Security in acquisition, development & maintenance, incl. vulnerability handling Athorion
21.2 f Policies to assess the effectiveness of the measures Athorion
21.2 g Basic cyber hygiene & security training Organisational
21.2 h Cryptography & encryption Athorion
21.2 i Access control, asset management & HR security Organisational
21.2 j Multi-factor authentication & secured communications Organisational
Incident reporting
Early warning within 24 h, notification within 72 h, final report within one month (Art. 23).
Management accountability
Management bodies must approve and oversee the measures and can be held liable (Art. 20).

■ Externally measurable - Athorion supports this directly.

03

How Athorion supports you

Athorion is one building block: the continuous, external view of your attack surface. It does not replace legal advice or a full information-security management system - it covers the technical, outside-in part of your NIS2 risk-management measures.

Vulnerability handling
Continuous detection of externally reachable services, outdated versions and known CVEs, including the CISA KEV catalogue of actively exploited flaws.
MAPS TO ART. 21.2 e
Supply-chain exposure
Monitor the external attack surface of your suppliers and partners, not just your own infrastructure.
MAPS TO ART. 21.2 d
Effectiveness & evidence
A traceable 0-100 risk rating plus reports and evidence - something to show management and auditors that measures work.
MAPS TO ART. 21.2 f
Early detection & alerts
Alerts when something changes on your perimeter: a new open port, a new subdomain, an expiring certificate, a new CVE on a detected version.
MAPS TO ART. 21.2 b
Reports for management
PDF reports that help management meet its oversight duty and document the state of the external attack surface over time.
SUPPORTS ART. 20
04

Frequently asked

Is my company in scope of NIS2?
As a rule of thumb: medium and large entities (from around 50 employees or 10 million euro turnover) in one of the covered sectors. Some entities are in scope regardless of size. The exact answer depends on your specific case.
Does Athorion make me NIS2 compliant?
No. Athorion covers the external, technical side - continuous vulnerability handling and monitoring of your internet-facing systems. NIS2 compliance covers more, such as organisation, processes and reporting paths.
What does the attack-surface analysis cost?
The first external analysis is free, non-intrusive and needs no login. You only enter your domain.
Where do the scans run from?
From the EU (Germany), non-intrusive - comparable to internet-wide measurement services.

See your exposure first.

Enter your domain and get a free, non-intrusive external analysis - open ports, exposed services, TLS and mail posture, known CVEs. No login.

This content is a general orientation and not legal advice. Whether and how NIS2 applies to your organisation should be clarified in your specific case. Athorion covers the external, technical side of risk management and does not by itself establish NIS2 compliance.