Prioritises by actual exposure rather than protection requirement and delivers the top risks for management.
Developed in Germany · Hosted in the EU or on-premises
Delivered together with
Sovereign hosting in Germany, single-tenant from the first user.
Legal, tax and compliance expertise for legally sound deployment.
Advisory and implementation for the public sector, starting with the AI readiness assessment.
The scanner reports a vulnerability on a specialist application server and rates it high. Then someone asks about reachability, about protection requirement, about ownership, and the answers come from three different directions.
A single finding takes two assessments, three queries and four working days before the order is settled, and because the agent brings protection requirement and reachability together in one pass, that is 50% less time to prioritisation.
The 50% comes from the agent's data record and refers to the time from the list of findings to an agreed order. It is a figure from practical experience, not a series of measurements.
The agent pulls the findings from the vulnerability scanner and matches them against the asset register. For every finding it notes whether the system is reachable from the internet, who operates it and which specialist application depends on it.
Findings export from the scan run, 3 systems without network assignmentThe agent sorts the findings by exposure and protection requirement and explains for the top ten why they rank where they do. Findings of equal rank are merged into one item.
Top 10 table under file reference ISB-RIS/2026/084The agent writes a summary for the head of department: three risks, one sentence each on impact, one sentence each on the next step. The full list is attached as an annex.
Leitungsvorlage_Risikolage_KW34.docx, 2 pages, list of findings as an annexThat rests with the head of department and the information security officer. The agent delivers the order and the reasoning behind it.
Operations clarifies that with the service provider on the specific system. The agent works with the scanner's rating and the protection requirement from the register.
The agent reads exposure from the network plan. For the three systems listed there without an assignment, it gives only the protection requirement from the asset register and records reachability as open.
Connected systems
Operations
A pilot typically runs on your own data within 4 to 6 weeks. The agent connects to your existing systems rather than running as a separate, parallel environment.
EU cloud, private cloud or on-premises. Processing is GDPR-compliant and models are never trained on your data. Details in the Trust Center.
It is based on experience from comparable projects and process benchmarks, not a commitment. We work out the realistic effect for your organisation during the assessment before the pilot.