Risk analysis and control framework
All-hazards risk analysis and a catalogue of measures per the state of the art — justified proportionately and documented.
Typical tasks
What typically lands on your desk
Detecting and reporting incidents
Incident response with severity classification and on-time reports — 24h / 72h / 1 month under NIS2, 4h/24h · 72h · 1 month under DORA.
Proving effectiveness
Run audits, pentests and KPI reviews and document them so that auditors and supervisors can follow the evidence.
Securing AI agents
Agents with tool access need limits a better prompt cannot move — and protection against indirect prompt injection.
How Agentic360 helps
Target process, finding and evidence in one chain
The building blocks security leaders can work with on the platform — each linked to its detail page.
NIS2 and DORA blueprints
Grounded target processes with 22 and 24 controls — risk analysis, incident handling, supply chain, resilience testing and access control, mapped module by module against your current state.
Incidents and the Control Room
The Control Room connects regulation, risk, action and evidence in one auditable chain and switches to live mode during an incident; agents draft the reports, you sign them off.
Scanner and cloud evidence
A built-in security and compliance scanner with deterministic grading. A read-only connected AWS account delivers Security Hub findings, Config status and IAM posture as evidence — mapped to ISO 27001, BSI C5, DORA and NIS2 controls. Every scan state exports as an audit pack with a SHA-256 manifest per file.
Agents with hard limits
Tool allowlist, policy gate, safety class, human approval and rate limit. Zero-trust spotlighting defuses indirect prompt injection, and red-team runs are graded on a deterministic capability ladder.
From a running pilot
softScheck Singapore: pentest findings behind a review gate
At softScheck, external pentest tools deliver their findings straight into the tenant via the MCP gateway; anything at CVSS 9.0 or above waits in a review stage until a tenant admin has signed off. The installation runs as the APAC pilot on its own hardware in Singapore, with local model serving.
Read the client storyRegulations
Regulations that shape your role
BSIG in force since 6 December 2025; reporting 24h / 72h / 1 month.
For the financial sector: reporting 4h/24h · 72h · 1 month, resilience testing including TLPT for designated entities.
- ISO/IEC 27001
Platform controls are ISO 27001-aligned — the platform itself is not certified.
- BSI C5
Mapping target for automatically collected cloud evidence.
For AI systems in your own organisation; duties in stages since 2 February 2025.
- GDPR Articles 33/34
Parallel notification where an incident affects personal data.
Whether and to what extent a regulation applies to your organisation depends on size, sector and business model. This overview is orientation, not legal advice.
Related industries
Show us your next audit.
30 minutes: we walk through the relevant blueprint, run the incident in the Control Room and show how evidence is exported.