Defensse brings risk, incidents, assets, audits and business continuity into a single platform — every compliance requirement measured, documented and ready for inspection.
On your own server or in the cloud. Four containers, one open port, about five minutes.
Risks, assets, policies, vendors, BCP/DRP plans — every entry is linked automatically to the compliance control it satisfies.
The scoreboard shows exactly where you stand, control by control. The incident report for your regulator is generated with one click — inside the reporting deadline.
Everything a regulated institution needs, built as one system — not twelve disconnected tools.
Risk register with a likelihood × impact matrix, annual assessments and treatment plans.
The reporting clock starts at detection; the official report for your regulator is generated with one click.
Physical and logical assets with criticality, owners and location.
Versions, approval cycles and review deadlines for every policy.
Vendor register with risk assessments and contract deadlines.
Audit plans, severity-rated findings, and follow-up through to closure.
Continuity and recovery plans with RTO/RPO targets and periodic testing.
Training tracking, certifications, deadlines and status for every employee.
A scoreboard against any regulatory framework, with evidence and status per control.
Event monitoring and threat intelligence: alerts become incidents automatically.
Wazuh + OpenCTIMFA, least privilege, a complete audit log, SSO and Active Directory.
KeycloakTransparency, auditability and controls for every decision your AI models make.
NeMo GuardrailsPick the ones you actually answer to. Defensse ships each framework’s full control catalogue and its reporting clock — so an incident inherits the deadline of the strictest rule that applies to you, not a generic 72 hours.
The universal baseline for an information security management system — any organisation, any sector, any country.
Anyone processing the personal data of people in the EU.
Essential and important entities — energy, transport, health, water, digital infrastructure, manufacturing.
EU financial entities. Sits on top of national banking rules rather than replacing them.
SaaS and service providers, when enterprise customers want proof before they sign.
US public and private sector organisations, and the supply chains that serve them.
Held to more than one? Most institutions are. Switch on every framework that applies and one piece of evidence counts against all of them — logged once, not maintained in three spreadsheets. When an incident opens, Defensse applies the tightest deadline in force and records which framework set it, so the audit trail still reads correctly a year later. A SaaS provider selling into Europe, for instance, answers to GDPR and NIS2 while its enterprise buyers insist on SOC 2.
Framework and standard names are the trademarks of their respective owners. Defensse maps its controls to these standards and is not certified by, endorsed by, or affiliated with ISO, the AICPA, NIST, or any EU institution.
Defensse installs in full on your own infrastructure — no cloud dependency, no data sent offsite. The same platform is also available hosted by us as a service.
Monthly subscription, no install cost. Buying online activates your license immediately — install takes five minutes.
Write to us and we'll be in touch within one business day — a 30-minute demo, no commitment.