Your people are the attack surface. Now the law agrees.
NIS2 turned staff training into a legal duty across the EU, and by 2026 most member states have their national law in force, Sweden's since 15 January. Four things close the gap it leaves: watch what an attacker can see, train the people they target, investigate what you already leak, and test the doors email never reaches.
New to the law? NIS2 in plain English, ten minutes, no consultancy fog. Your auditor or IT lead wants the evidence page.
- MONITOR
- TRAIN
- INVESTIGATE
- TEST
The team platform is being built and is not open for self-service yet. The exposure check is real and delivered by hand today, and early clients are being taken on one at a time. Prices below are indicative while the programme is finished.
One attacker, every door. We cover them.
Monitor keeps a permanent eye on your exposure. Train builds the reflex in your people. Investigate digs, by hand, into everything an attacker could find. Test & probe attacks you - with permission - to prove it works. Tap any card to see how it runs.
Three ways in. The first one is small on purpose.
These are starting points, not an offer. The final figure depends on how many domains, people and languages are in scope, and you always get it in writing before any work begins. Continuous monitoring and the per-seat training platform are still being built and are not priced yet.
Exposure check
The way in. One page, no call, no dashboard.
Delivered within 2 working days · public sources only
- ✓Whether anyone can send mail as your company (SPF, DKIM, DMARC)
- ✓Look-alike domains already registered against you
- ✓Corporate addresses found in public breach data
- ✓What to ask your IT partner to fix, in plain words
Executive exposure
PopularFor the people attackers pretend to be
3 to 5 key people from €1,300 · 5 to 8 working days
- ✓Leaked credentials tied to that person
- ✓The public footprint an impersonator reuses
- ✓Metadata left behind in documents they published
- ✓What a convincing fake from them would look like
Full company exposure
Everything the check only samples
10 to 14 working days
- ✓Forgotten subdomains and exposed services
- ✓Look-alike domains with live mail exchangers
- ✓Every corporate mailbox found in breach corpora
- ✓One written report you can hand to your IT partner
Draft pricing, subject to change, excluding VAT, and not a binding offer. Everything above comes from public and breach-corpus sources: your domain, your corporate mailboxes and what your company has published, never an employee's private accounts. Training, simulated campaigns and continuous monitoring are quoted per engagement.
Every path begins with one small check.
See what an attacker sees before they use it.
Tell us the domain. You get one page on what is publicly exposed around your company, at a fixed price, within two working days. No call, no demo, no subscription.
Awareness training stopped being a nice-to-have.
NIS2 is one directive transposed into 27 national laws. The core is the same everywhere: ten security measures, personal accountability for management, and a reporting clock of 24 hours, 72 hours and one month. Our home market, Sweden, implemented it as Cybersäkerhetslagen on 15 January 2026, with registration to MSB by 2 February; other countries differ only in the authority and the name of the law.
Scope generally starts at 50 employees, or €10M turnover, for organisations in the sectors listed in the directive's annexes - transport, manufacturing, food, water, health, digital providers and others. Among the required measures: cyber hygiene and training, explicitly covering both staff and management.
Sanction fees run up to €10M depending on classification, and management can be barred from holding leadership positions. An annual slideshow does not build the reflex the law is asking for. Repeated, realistic practice does.
This is a summary for orientation, not legal advice. Whether your organisation falls in scope, and what exactly it must do, is a question for your own counsel or the relevant supervisory authority.
- ✓50-250 employees, in a sector covered by NIS2
- ✓No in-house security team, and no appetite to build one
- ✓A compliance obligation with a date attached to it
- ✓People who have never been trained on this, ever
- ✗You already run a mature awareness programme
- ✗You need in-person, on-site delivery
- ✗You want a per-seat platform with SSO and an admin console
- ✗You are looking for penetration testing or incident response
Want to see the training before you talk to anyone? The whole path is free and needs no account.
Open the trainingDo we have to install anything?
No. The training runs in a browser, monitoring reads public records, and the simulation runs from our side. No agent, no plug-in, no integration to approve.
Do you touch our systems?
No. Monitoring and the report are public sources only. A simulated campaign is the one thing that reaches your people, and it happens only after you authorise the scope in writing.
How is this different from the free training on the site?
Same engine, different product. The corporate version is delivered by private link to named staff, refreshed every quarter with current context, tracked, and turned into a compliance record. The public version is none of those.
What language is it in?
English - training, reports and monitoring alerts. Everything runs remotely. Swedish, German and Dutch training versions are on the roadmap.