Practical guides on vulnerability management, compliance, and cybersecurity for European organizations.
Vulnerability management
★ Latest
I aimed our scanner at something almost nobody checks: the container images AI coding agents run inside. The current latest images ship a git flaw CISA lists as actively exploited, patched for months, and most scanners won't tell you. Here's why, and what to do about it.
On a real production inventory, of the fixable OS-package CVEs that Grype and Trivy both agree on, SentriKat detects 97.3% (818 consensus CVEs), with fewer backport false positives. Here is the method, the numbers, and the parts still in triage.
SentriKat now offers an optional AI-DLP endpoint layer, powered by our open-source Contextia engine. Here's what it is, why it matters, and how to turn it on.
DORA's fifth pillar (Article 45) encourages financial entities to share cyber threat information and intelligence among trusted communities. It's voluntary, but participating is a clear sign of a mature resilience programme.
DORA's second pillar (Articles 17–23) requires financial entities to detect, classify and report major ICT-related incidents to their competent authority on a defined timeline. Here's the practical shape of it.
DORA's first pillar (Articles 5–16) requires a board-owned ICT risk-management framework. Here's what that means in practice for banks, insurers, investment firms and their critical functions.
The Digital Operational Resilience Act requires ICT vulnerability management for financial entities. Learn DORA requirements, deadlines, and how to implement compliant vulnerability tracking.
NIS2 Article 21(2)(f) requires policies to assess whether your risk-management measures are actually effective. Present, on paper, isn't the same as working, here's how to show the difference.
A free, non-intrusive security posture scan for any public domain. Five categories, a 0–100 score, a PDF report, and zero data retention. Here's what's under the hood.
NIS2 Article 21(2)(j) calls for multi-factor authentication and secured communications. MFA is the single most effective control against the account compromise behind most breaches, here's how to get it right.
NIS2 Article 21(2)(h) requires policies on cryptography and, where appropriate, encryption. The measure isn't 'turn on HTTPS', it's having a deliberate, documented approach to protecting data.
NIS2 Article 21(2)(g) requires basic cyber hygiene practices and security-awareness training. It's the cheapest, highest-leverage measure on the list, here's a practical baseline.
A transparent write-up of the April 2026 security hardening on sentrikat.com and portal.sentrikat.com: what we changed, why it matters, and what's next.
Sprint 4 and Sprint 5 add CRA-ready SBOM export (CycloneDX, SPDX, STIX), signed gap-analysis reports for PCI-DSS, ISO 27001 and SOC 2, full remediation assignments with SLA tracking, and multi-tracker integration with Jira, GitHub, GitLab and YouTrack.
NIS2 Article 21(2)(c) requires backup management, disaster recovery and crisis management. The word that matters is 'tested', a backup you've never restored is a hope, not a control.
We're opening SentriKat to 30 SaaS and 15 on-premises organizations for free. Full Pro features, no credit card, no time limit. Here's what you get and how to join.
NIS2 requires essential and important entities to handle and report incidents on a strict timeline, 24-hour early warning, 72-hour notification, one-month final report. Here's what an incident-handling capability looks like in practice.
NIS2 Article 21(2)(a) requires a management-approved security policy and a maintained risk assessment. Here's what 'good enough' looks like for an essential or important entity, without the enterprise bureaucracy.
A detailed comparison of SentriKat with Tenable Nessus, Qualys VMDR, and Rapid7 InsightVM. Learn how a CISA KEV-focused approach differs from traditional full-spectrum vulnerability scanning.
La direttiva NIS2 richiede la gestione delle vulnerabilità per le PMI europee. Scopri cosa serve, come implementarla senza budget enterprise, e come SentriKat automatizza la conformità.
How managed service providers can deliver vulnerability management at scale using multi-tenant architecture, white-label branding, and CISA KEV-focused prioritization. A practical guide for MSPs.
How to manage vulnerabilities in air-gapped and isolated networks. Learn about offline KEV tracking, manual knowledge base sync, and SentriKat's approach to vulnerability management without internet access.
Should your vulnerability management tool be self-hosted or cloud-based? We compare on-premises and SaaS approaches for organizations that care about data sovereignty and GDPR compliance.
SentriKat now fetches CVSS scores from 3 independent sources with automatic fallback. Here's why we built multi-source vulnerability intelligence and what the NVD backlog crisis means for your security posture.
ENISA EUVD is the European Union's vulnerability database mandated by NIS2 Article 12. Learn what it contains, how it compares to NVD and CISA KEV, and how SentriKat integrates it for EU vulnerability management.
CVSS scores alone don't tell you what to fix first. Learn how EPSS (Exploit Prediction Scoring System) and the CISA KEV catalog provide real-world exploit context for better vulnerability prioritization.
The CISA Known Exploited Vulnerabilities catalog lists CVEs actively used in cyberattacks. Learn what KEV is, how it differs from the NVD, and why tracking it is essential for NIS2 and DORA compliance.
NIS2 requires vulnerability handling for essential and important entities across the EU. Learn what Article 21 demands, how to demonstrate compliance, and practical tools for SMBs.
No articles in this category yet.
Cloud or on-premises vulnerability management focused on what's actively exploited.