How Alexus compares, and when to pick something else.
What each kind of tool does well, where it stops for NIS2 evidence, and who should choose what. Based on the public documentation we reviewed in October 2026.
Three ways teams try to get NIS2 evidence today.
Each is good at something real. In the documentation we reviewed, none of them ships a live, reconciled picture of what your systems did, turned into per-measure proof on a record an auditor can verify, pre-built, at mid-market prices.
GRC and compliance automation
Policy templates, questionnaires and control tests across dozens of frameworks, with a fast path to a first audit. The evidence is a sample of control states over a flat asset list pulled from integrations, not a record of what your systems actually did.
Enterprise ITSM and risk suites
A genuinely mature CMDB, incident operations, estate health and a risk module with a NIS2 content pack. Linking that operational data to each NIS2 measure is typically configured through the risk module and a systems integrator, at enterprise cost and timelines.
Inventory and observability
Excellent at seeing assets or telemetry. They stop short of per-measure NIS2 evidence and the Article 23 reporting clock. The closest in spirit, Dynatrace, supports DORA only today, not NIS2.
The operational-evidence layer, underneath whatever you already use.
Alexus connects the tools you already run, reconciles them into one live picture, and derives the operational half of NIS2 evidence from it: a score for each of the ten Article 21 measures, the Article 23 deadlines and reports, and a tamper-evident record. It sits beneath your GRC tool; it does not replace it.
Read-only access to the tools you already run. After onboarding there is nothing to feed or maintain.
Component health every 2 minutes, cloud and monitoring scans hourly, changes every 30 minutes, a compliance snapshot daily.
Name a system and get its live state and what it depends on, in the app, Slack or Teams.
Every change lands in a hash-chained record an auditor can verify, so the history exists when a regulator asks.
What each approach covers for NIS2 evidence.
A tick is a capability that exists today. We mark ourselves as honestly as we mark others, including the rows where we are weaker. Read the first two rows first: if that is your gap, a GRC tool is what you need.
| Capability | GRC tools | ServiceNow | Lansweeper | Dynatrace | Alexus |
|---|---|---|---|---|---|
Policies, risk register, training and audit workflow The paperwork half of NIS2, across several frameworks. Alexus does not do this by design and sits alongside a tool that does. | |||||
Breadth of asset discovery Finding what you run across a large or mixed estate, including on-prem, OT and IoT. | |||||
Reconciles conflicting tools into one record When two tools disagree about the same system, a stated rule decides which to trust, field by field, and shows its reasoning. | |||||
Incident operations Detect, triage and track incidents through to closure. | |||||
Live health of what you run Current state of each component, not a periodic snapshot. | |||||
Evidence per NIS2 Article 21 measure, from operational data A live score for each of the ten measures built from what your systems did, with the gaps listed. Alexus covers the operational half of each. | |||||
Article 23 incident clocks and report drafts The 24 hour early warning, 72 hour notification and one month final report, with deadline status per incident. | |||||
Tamper-evident evidence trail Every record is hash-chained and append-only, so any alteration is detectable and verifiable on demand. | |||||
Set up by your own team, no integrator Read-only connectors and no enterprise programme to stand up first. | |||||
Track record: customers, references, certifications Years in market, auditor relationships and ISO 27001 or SOC 2 certificates. We are early and say so. |
GRC tools means Vanta, Drata, Secureframe and similar. Marks reflect public documentation we reviewed in October 2026 and will date as vendors ship. If we have got a vendor wrong, tell us and we will correct it.
What each does well, where it stops, and when to pick it.
A straight answer, including when it is not us.
Alexus is likely right if
- You are in NIS2 scope and run a real tool estate: cloud, ITSM, monitoring.
- You must prove what your systems did, not only that policies exist.
- You do not have an enterprise ServiceNow programme and an integrator.
- You want read-only access, EU hosting, and a picture that keeps itself current.
Use a GRC tool, with or without us
- Your gap is policies, a risk register, training and audit workflow.
- You need several frameworks at once.
- Add Alexus underneath when an auditor wants proof of operation, not attestation.
Choose something else if
- You already run a mature ServiceNow CMDB with a partner: extend it. We can read it as a source.
- Your hardest problem is discovering a large on-prem, OT or IoT estate: look at Lansweeper.
- You want autonomous incident remediation today: look at agentic SRE tools. Alexus advises in this version.
- You need a vendor with certifications and customer references today.
Three things we would tell you first.
In a compliance purchase a vendor who overstates their coverage is disqualifying, so we say these before you ask.
No customer results yet
Alexus is built and tested on realistic test estates. The next milestone is running it on a customer’s live systems. We will not quote customer numbers until we have them.
We cover the operational half
Coverage is partial on all ten Article 21 measures, by design. You still need policies, a risk register and training records, from a GRC tool or your own ISMS.
We are small and early
No ISO 27001 or SOC 2 certificate yet (we are working towards ISO 27001), far fewer connectors than the large GRC tools, and a young brand. Design partners get hands-on help and a say in what we build first.
Still have questions?
Read the FAQ bank or see how Alexus fits into a real NIS2 programme.
FAQs
The questions CTOs, CISOs, IT directors and SREs actually ask in evaluations, answered straight, with the numbers behind each claim.
Read the FAQsUse Cases
Five high-impact ways teams put Alexus to work: conversational service desk, auto-resolution, knowledge graph, root-cause AI, and a live CMDB.
Explore use cases