160,000+ organizations in the EU are now in scope for NIS2, and the clock is ticking.
NIS2 is 10 controls,a 72-hour clock,and your signature.
Miss any of it, and it's up to €10M, or personal liability.
Alexus AI makes every part provable, from the operations you already run.
Two ways to prove NIS2.
- Screenshots and spreadsheets, re-gathered every audit
- Evidence that’s stale the day after you collect it
- A blank page at 2am when an incident hits
- Weeks of consultant time to prove one control
- One live graph of every asset, change and control
- Evidence that stays current as you operate
- 24h / 72h reports pre-assembled and waiting
- A live answer for every control the data can prove
The operations you already run, turned into NIS2 evidence — live.
Under the hood it is one continuously-updated graph: every change, incident, access grant and asset your tools already record, linked together and scored against each NIS2 measure.
The evidence was always there. Now it's continuous.
Compliance you can prove.
The evidence NIS2 asks for (Articles 21, 23 and 20) as a by-product of the operations you already run.
Continuous readiness scoring
A live score against all 10 NIS2 measures, each with a per-control evidence trail.
- All 10 measures, continuously scored
- Gaps surfaced before the auditor
CSIRT incident reporting
24-hour and 72-hour reports, pre-formatted for each national CSIRT, not a spreadsheet.
- 24h early-warning + 72h full report
- Early warning, notification and final report
Verifiable audit trail
Every change logged (actor, source, timestamp) and hash-chained, so tampering is detectable in a single verify call.
- Actor · source · timestamp
- Tamper-evident — verify the whole chain
- Reports become a query
Executive Accountability Pack
A quarterly pack for boards and D&O insurers, built from the evidence trail.
- Board-level evidence summary
- Supports Article 20 due diligence
Operations in. Evidence out.
Operate
Run IT ops exactly as you already do
Capture
Every change logged: actor · source · time
Score
Live readiness across Article 21's 10 measures
Report
24h / 72h reports, drafted from the incident
Prove
Board & auditor-ready evidence pack
Where Alexus fits.
That model on the left depicts how Alexus fits in your IT estate, i.e. your service desk, cloud or identity tools (without replacing them), connecting to every tool and producing NIS2 evidence from the operations you already run.
This connection is what allows us to "query" the estate and produce a live, continuously-updated lineage of your assets, changes, access grants and owners.
Ticketing · CMDB · AI Service Desk
Runs alongside your service desk.
Observability · Alerting · Codebase
Signal from monitoring, paging and code.
GRC / Compliance Evidence
The operational-evidence layer over your GRC stack.
Reads from the tools you already run.
No rip-and-replace. Connect a source and Alexus auto-fills the Article 21 measures it can evidence. Identity providers (Entra ID, Okta), SIEM and endpoint tools are on the roadmap.
Each item carries a live-verified badge — the source and time it was last confirmed.
The auditors won't wait. Neither should you.
NIS2 is being transposed into national law across the EU, with some countries late. Where it applies, essential and important entities can be assessed at any time, with evidence expected on demand, not at quarter-end.
Questions, answered.
Is Alexus a replacement for our ITSM or SIEM?
No. Alexus reads from the tools you already run and turns their data into evidence. There’s nothing to migrate.
What do we have to do after setup?
Almost nothing. You connect your tools once, read-only, and Alexus keeps your inventory, changes and compliance evidence up to date by itself. It only asks you a question when two of your tools disagree and it isn’t sure.
Can we ask it questions?
Yes, in plain English, in the app, Slack or Teams. Ask about a system by name and it answers from its live state and what it depends on, for example “is the payments database healthy?”
How fast can we see a readiness score?
Connect a first source and Alexus starts building your Article 21 picture straight away, with no manual data entry. It sharpens as you link more of your tools.
Does this cover more than NIS2?
NIS2 is what Alexus does today. The same evidence is designed to be reused: ISO 27001, DORA and SOC 2 mappings are on our roadmap.
Who is Alexus built for?
CISOs, IT and security leaders at essential and important entities in NIS2 scope across the EU.
Where is our data hosted?
In the EU, with an EU-only data path. External AI is off by default, so your data isn’t sent to a public AI service unless you choose it. We name the exact region in your data processing agreement.
Do you replace our GRC tool?
No. We add the operational-evidence layer underneath Vanta or Drata: what your systems actually did.
NIS2 as a query, not a quarter.
Turn the operations you already run into audit-ready evidence, and see it on your own estate.
nis2.readiness(article: 21)liveA paid assessment, 80% off for now: connect your tools read-only and get a report on your gaps. No commitment beyond it.
Keep exploring
See how Alexus shows up in real teams, then explore the Phase 2 agent.