NIS2 vulnerability management
built for European organizations
Support your Article 21 vulnerability handling with on-premises deployment, the European vulnerability database read natively, and cross-checked intelligence from 6+ authoritative databases, backed by cryptographically signed, auditor-ready evidence. Made in Europe. EU data sovereign. €4,999/year.
To be clear: SentriKat produces the vulnerability-management and supply-chain evidence Article 21 asks for. That's one part of NIS2, not the whole directive, and no single tool can be.
What NIS2 Article 21 requires, and how SentriKat delivers
NIS2 Requirement
Article 21(2)(e) mandates "vulnerability handling and disclosure", a structured, repeatable process for identifying, assessing, and remediating vulnerabilities across your IT environment.
SentriKat Delivers
Automated inventory discovery, multi-source vulnerability matching (two feeds, one of them European), CVSS enrichment from 3 databases, remediation deadline tracking, and NIS2-specific compliance reports for auditors.
Why EU organizations choose SentriKat
EU Data Sovereignty
Run it on your own EU-based servers and your vulnerability data never leaves your infrastructure, or use our cloud, hosted in the EU.
European Vulnerability Database
Native integration with the European Vulnerability Database run by the EU cybersecurity agency under NIS2 Article 12(2). Track EU-flagged exploited vulnerabilities alongside the other catalogues we track, so no single source decides what you get to see.
NIS2 Compliance Reports
Generate audit-ready NIS2 Article 21 compliance reports with executive summaries, risk scores, remediation timelines, and KPIs. PDF exports ready for board presentations and regulatory audits.
Cryptographically signed, tamper-evident evidence
Every compliance report SentriKat generates is hashed with SHA-256 and signed with HMAC. An auditor can verify, independently, offline , that the evidence in front of them hasn't been altered since SentriKat produced it. Most scanners export unsigned PDFs that anyone can edit without a trace.
SHA-256 content hash
Each report carries a fingerprint of its exact contents. Change a single character and the hash no longer matches, instant, mathematical tamper-evidence.
HMAC signature
The hash is signed with a keyed HMAC, tying each report to your SentriKat instance. Verifiable offline, no SaaS call-home, no third party in the loop.
Independently verifiable
Hand the PDF or JSON to your auditor with the verification steps. They confirm the integrity themselves, evidence that stands on its own, no trust in us required.
Signed reports, mapped to the controls your auditor checks
Multi-source vulnerability intelligence
No single point of failure. SentriKat enriches every CVE from 6+ authoritative databases with automatic fallback.
| Source | Purpose | EU Relevance |
|---|---|---|
| Exploited-vulnerability catalogue | Vulnerabilities confirmed as used in attacks | US-maintained, globally adopted |
| European vulnerability database | EU exploited vulnerabilities + CVSS | Run by the EU cybersecurity agency under NIS2 Article 12(2) |
| Primary severity database | Primary CVSS scoring | Industry standard baseline |
| Enriched CVE records | Secondary CVSS, publisher-provided scores | Independent fallback |
| Exploit probability | How likely a vulnerability is to be used | Prioritization model |
| Package advisories | Open-source package vulnerability data | Vendor advisory aggregation |
What SentriKat gives you for NIS2
How it compares with other tools, with sources and dates, is on the comparison pages.
| Capability | SentriKat |
|---|---|
| Where it runs | On your own servers, or in our cloud hosted in the EU |
| European vulnerability database | Read alongside the other sources |
| Severity scores | Three sources, with automatic fallback when one is down |
| NIS2 compliance reports | Included, mapped to Article 21 |
| Your data | On your servers it never leaves your network; in the cloud it stays in the EU |
EU and international compliance frameworks
Industrial equipment is in scope, and we check it for you
NIS2 covers energy, water, transport, manufacturing and health. In those sectors the asset that matters is often a controller on a production line that has run untouched for nine years, and no software can be installed on it. So we do that part by hand.
Makes, models and firmware versions. A spreadsheet is fine.
Against the same database the product runs on, including the exploited-in-the-wild list and exploitation probability.
What is exploitable today, what can wait, and what has no fix. Written for whoever has to schedule the downtime.
What this is not
We do not put software on your industrial equipment and we do not connect anything to your control network. This is a person reading your equipment list against a database that is already current, and telling you what to do about it.
Tell us the sector and roughly how many devices. We will say what we can answer before you send anything.
Honest about what this is
SentriKat produces auditor-ready gap analysis and evidence for the vulnerability-management parts of NIS2, DORA, PCI-DSS, ISO 27001 and SOC 2, finding, prioritising and tracking the fix of vulnerabilities, then documenting it in signed reports. It hands your auditor clean, verifiable proof and makes their job faster. It is not a certification, and no tool can make you "compliant" on its own. We'd rather tell you that up front than oversell it, that's the kind of vendor we want to be.
Ready for NIS2 compliance?
Deploy SentriKat on-premises, import your inventory, and generate your first NIS2 compliance report, all in under an hour.
Frequently asked questions
Does SentriKat help with NIS2 Article 21 vulnerability handling?
Yes. The obligation is the organization's; SentriKat provides structured, auditable vulnerability handling: automated discovery via agents, severity scoring cross-checked across three independent public databases, remediation tracking with deadlines, and NIS2-specific compliance reports with executive summaries for auditors and board presentations.
Can SentriKat run on my own servers in the EU?
Yes. SentriKat is fully self-hosted via Docker Compose. Your vulnerability data, scan results, and full software inventory never leave your infrastructure. Air-gapped deployments are supported with offline license activation. The external calls are the license check-in (every 12 hours, counters only, never sent by the Community Edition) and, if left enabled, anonymized signals about software our engine could not identify (no version, hostname, or customer data). Both are documented at sentrikat.com/telemetry and sentrikat.com/privacy.
Does SentriKat use the European vulnerability database?
Yes. SentriKat reads the European vulnerability database that the EU cybersecurity agency runs under NIS2 Article 12(2), both for exploited-vulnerability tracking and for severity enrichment. It is cross-checked against three other public databases, so no single one, European or American, decides what you are told.
Where can I see how SentriKat compares with other tools?
On our comparison page, which lists with sources and dates where each of them is ahead of us. SentriKat starts from the software installed on your machines, can run entirely on your own servers, reads the European vulnerability database, and includes NIS2 reports.
How does SentriKat make its compliance reports tamper-evident?
Every compliance report is hashed with SHA-256 and signed with HMAC. The hash is a fingerprint of the report's exact contents, and the HMAC signature ties it to your SentriKat instance. An auditor can verify offline that the evidence hasn't been altered since it was generated, no third-party service required. Most vulnerability scanners export unsigned PDFs that can be edited without trace.
Does SentriKat make my organization NIS2 or ISO 27001 certified?
No, and no tool can. SentriKat produces auditor-ready gap-analysis and evidence for the vulnerability-management parts of NIS2, DORA, PCI-DSS, ISO 27001 and SOC 2. It documents your posture and gives your auditor verifiable evidence, which accelerates an assessment or certification carried out by an accredited body. SentriKat itself does not issue certifications.