For mid-sized companies without a dedicated CISO · NIS2
Your IT mapped, your risk priced in euros, and ready for NIS2.
Ekera reads your documents, your tools and your accounts, interviews your teams, then calculates what an attack or an outage would stop in your business and what it would cost. It proposes the work that cuts risk the most for three budgets, and prepares your NIS2 evidence. In a few days, at a fixed price, with no access to your systems for the assessment.
Hosted in France · Assessment with no access to your systems · AI proposes, you decide
AssessmentAteliers Morvan · fictitious example
81%of the business can be stopped by a single attack today
Indicator
Today
After the work
Maximum outage after an attack
81%
34%
Worst case
€2.4M to €4.9M
€0.9M to €1.8M
Expected annual loss
€150k to €980k
€40k to €260k
Weak entry points
5
1
Backups out of reach
no
yes
NIS2 checkpoints met
9 of 20
16 of 20
Single point of failure: the shipping workstation in Nevers, with no backup. Source: maintenance contract, p. 4.
Euros calculated from the accounts · cost of work to be confirmed by quotes · NIS2 Article 21
1 · Why now
Claims are rising, attacks are speeding up, NIS2 is coming
1,251cyber claims paid to companies in France in 2025, up from 448 in 2024.
248 claimspaid in 2025 for 2,002 insured mid-sized companies, about 12% in a single year.
Over 15,000entities covered by NIS2 in France according to ANSSI, the French national cybersecurity agency, up from about 500 under NIS 1.
Requiredby ANSSI’s Référentiel Cyber France (working draft, March 2026): an IT map kept up to date.
Meanwhile, cyber insurance rates are falling: −5% worldwide in the second quarter of 2026, the twelfth quarter of decline in a row. Insurers will have to tell well-protected companies from the rest.
And attacks are changing scale: in July 2026, Hugging Face confirmed an intrusion carried out by an autonomous AI agent. At that speed there is no time left to react. It is the architecture of the information system that limits the damage.
In France, the law transposing NIS2 has not been passed yet. But your customers, your insurers and your buyers are already asking the same questions.
From IT mapping to decision: the agent does the architect’s work, you stay in control
Figures are calculated by an engine, not made up by the AI: same data, same result. When the agent is unsure, it says so, and an expert checks.
Your sourcesDocuments, exports and read-only connectors: inventory, directory, contracts, network, accounts.no administrator rights
AI-led interviewThe agent interviews the CIO and business teams, and only asks the questions your documents do not settle.online, at your own pace
The mapFrom business process to server, every item linked to its source.sourced and dated
The assessmentWhat an attack or an outage would stop, single points of failure, gaps against the NIS2 measures.deterministic calculation
Risk in eurosWorst case and expected annual loss, calculated from your accounts.read on site
Three variantsThe best combination of work for three budgets, with the loss it avoids.cost to be confirmed by quotes
The decisionCIO, CISO, CFO, purchasing and management each receive the page that concerns them.tracked approval flow
Your tools up to dateApproved changes are written into your tools, one by one, and can be reversed.nothing without your approval
MonitorPublished vulnerabilities, end-of-support dates, NIS2 texts, suppliers, and what changes in your tools.
AlertOnly what affects you: a flaw in your ERP, a server missing from the map, an incident that keeps recurring.
ProposeEvery month, the changes to decide on, with scenarios, costs and sources, ready for your approval flow.
4 · Risk in euros
Figures your CFO can stand behind
Ekera translates outages into euros from your accounts, not from estimates typed in by hand. Then, for three budgets, it searches for the combination of work that cuts risk the most.
Your accounts
Read on site, never sent
The French standard accounting entries file (FEC), which every company in France can produce, gives revenue and variable costs. Margin is split across your revenue streams, so each stream is counted only once. The worst case is broken down line by line and compared with your insurance limit.
Three variants
The best combination for each budget
For each budget, the engine evaluates every combination of work in the catalogue and keeps the best one; no item in it is superfluous. You see the cost, the loss avoided and the NIS2 measures covered.
The cost of the work
Costs that become real
List price multiplied by your quantities (accounts, workstations, servers, sites), plus integration days, over three years calculated
Range from the catalogue, sourced and dated, when the price is only available on quote estimated
Quotes from your suppliers, requested by your purchasing team once the work is decided quote
Actual cost read from the invoice, which refines the catalogue actual
Today, the costs shown are illustrative orders of magnitude, to be confirmed by quotes. Each amount shows its confidence level. If the ranking of variants changes between the low and high ends of the price ranges, Ekera flags it.
5 · Deciding together
Everyone sees what concerns them, nobody needs to log in
A work scenario goes through an approval flow before anything is written into your tools. For each decision-maker, Ekera prepares the page that concerns them, calculated by the engine.
1CIOProposes the scenario and its work items.
2CISOSees the remaining risk and the attack paths still open.
3CFOSees the cost, the loss avoided, the payback period and the insurance coverage.
4PurchasingReceives ready-made quote requests, suppliers to assess and security clauses.
5ManagementReceives a one-page summary and decides.
Each person approves, rejects or asks for a change from their email or Teams. The flow adapts to your organisation: the CFO only above a certain amount, for example. The decision and the opinions are recorded; nothing is written into your tools before that.
6 · The workspace
A conversation on the left, your views on the right
Ask your question in plain language: “if we replace this shipping software, what changes, and how much does it cost?”
The answer appears on the right: the map, the euros, the variants, or the record as it is stored in your tool, with changes highlighted.
Every figure comes from the engine and cites its source. When your answer feeds the calculation, the agent offers you choices.
Those who do not log in receive a weekly summary, with the approvals to give.
Ekera in screens: from your documents to risk in euros and the NIS2 assessment, then continuous monitoring
The screens show a fictitious company, Ateliers Morvan, an industrial mid-sized company with 420 employees. They are mock-ups: the product is being built with its first customers.
You upload what you have. Diagrams, contracts, inventory or directory exports, invoices. Ekera reads the files, with no access to your systems.
The agent only asks useful questions. It flags what the documents do not say and explains why it is asking.
From business process to server. Every item keeps its sources; gaps and single points of failure are flagged.
What to fix, in order. Every finding points to its evidence and its NIS2 measure, with a roadmap.
Query the mapAteliers Morvan · fictitious example
What would a 3-day ERP outage cost?
The ERP supports 6 processes, including invoicing and shipping. A 3-day outage would cost €0.6M to €1.1M.Calculation: Ekera engine, assumptions shown · ERP: GLPI inventory · revenue: 2025 accounting entries file
What is the best firewall for us?
I cannot establish that from the map. Your requirements and quotes are missing; I can prepare a comparison of the catalogue options.
Ask your question in plain language. Every figure comes from the calculation engine, never from the language model, and every fact cites the object and the document it comes from. When the map cannot answer, Ekera says so and shows what is missing.
SourcesAteliers Morvan · fictitious example
Source
Mode
Status
GLPI inventory
API, read-only
up to date
Directory
On-site collector
up to date
Firewall
Configuration export
export older than 10 days
Backups
API, read-only
test failed: expired certificate
Accounting
Uploaded file
FY 2025
GLPI credential: vault reference vault://ekera/glpi-lecture · the value stays in your vault
Every source shows where it comes from and what state it is in. A connection test before the first read; your credentials stay in your vault and Ekera only keeps the reference; the collector installed on your premises opens no inbound port.
Files are enough for an assessment. Connections to your tools are optional, read-only by default, and your credentials stay with you.
Nothing is written without your approval. Ekera fills in Archi, Mercator, CISO Assistant, GLPI or NetBox, change by change, with versioning.
Ekera prepares, your purchasing team decides. One quote request per selected building block, with quantities read from your tools and the security clauses to put in the contract. The quote replaces the order of magnitude; Ekera never places an order.
The ABB describes the need, the SBBs are the solutions that meet it. Monitoring keeps the catalogue up to date; an architect approves every change.
Sourcing · Remote access with two-factor authenticationfictitious example
Where to look
Option
Cost and lead time
1. Already in house
Cloud directory, feature included in your licences, not enabled
€0 in licences · 2 to 3 weeks
2. Approved by your purchasing team
No approved product for this need
—
3. Market
Option A, list price · option B, qualified by ANSSI
A: price recorded and dated · B: on quote
Option 1 proposed. Choosing A or B would bring in a new product: that is your decision, recorded in a decision record with the options set aside and the reasons.
First, what you already have. For each need, Ekera looks at your building blocks in place, then the products approved by your purchasing team, then the market, with prices recorded and dated, or “on quote”. Feedback at 3, 6 and 12 months shows what the building block really cost.
Architect deliverablesAteliers Morvan · fictitious example
Document
Filled from the map
Status
ERP technical architecture document, on your template
78%
to review
Security accreditation file
71%
3 gaps flagged
EBIOS RM risk analysis, workshops 1 to 3
64%
draft
Architecture board file
90%
approved, published
Unused licences: 37 office licences assigned to accounts disabled for more than 90 days. Sources: directory, licence contract
Your templates, filled from the map. Technical architecture document, HLD, security accreditation file, EBIOS RM, architecture board file: Ekera fills in what the map establishes and flags what is missing; the architect reviews, approves and publishes. Approved changes flow back to your repositories.
What your insurer would receive. Verified indicators, never your map or your accounts, and only with your consent.
Then, Ekera keeps watch. Published vulnerabilities, end-of-support dates, gaps between design and operations, then scenarios proposed for decision.
For architecture teams. Select objects in Archi: the agent analyses impacts, compares scenarios and drafts the opinion.
Try the demoClickable seven-step walkthrough, about five minutes, fictitious data.
Next feature
From need to application: your IT keeps pace with the business, in real time
The need
The business wants its applications in days, not quarters, and its needs change from one week to the next
Tools that generate code and infrastructure are fast, but they ignore your real IT: dependencies, sensitive data, company rules, NIS2
The result: applications built in a vacuum, which security either blocks or lets through without seeing them
Ekera’s role
The plan: from the map, the target architecture and the API contracts, reusing what you already have first
The constraints: your sovereignty rules, your prohibitions and NIS2, attached to the package handed to your generation tools or your IT services firm
Risk priced before building: the engine compares the variants in euros
Verification before go-live; the map updates itself, you decide
Complementary to code and infrastructure generators, not a competitor: Ekera designs and verifies, your tools or your partner IT services firm generate. Ekera never pushes code into your systems.
The need, as the business expresses it. Every version is kept with what changed; the agent only asks the questions that change the architecture or the risk.
What already exists comes first. Components reused from the map and the catalogue, new components, flows, sensitive data and company rules, each with its source.
The risk, before writing a single line. For each variant, the engine calculates entry points, maximum outage, expected annual loss and NIS2.
A framework for your generators. API contract, sovereign infrastructure skeleton (OVHcloud, Scaleway or on premises) and rules, handed to your tools or your IT services firm.
Checked before production. Gaps against the target block go-live; a person approves, after re-authenticating, and the map updates itself.
Day to day
Sourcing, monitoring, documents and vault
What the architect and the CISO do every week, kept up to date from the map: choosing a product, following alerts, publishing documents, keeping evidence.
Sourcing building blocks. For each need: what you already have, your approved products, then market options with origin, ANSSI approval and recorded price, scored on weighted criteria. Every new product is a decision, with its record.
Monitoring agent. End-of-support dates, vulnerabilities and CERT-FR advisories, new versions and incoming signals, linked to the affected objects on your map; the engine prices the effect of the proposed work, you decide.
Document chain and portal. Your templates filled from the map, reviewed and approved, then published on an internal portal: architecture file, ANSSI views, application records. Every page is dated, sourced and versioned; role-based access, never public.
Vault for documents and evidence. Contracts, minutes, diagrams and NIS2 evidence encrypted with your key, versioned, with fingerprint and access log; temporary sharing with an auditor; nothing is ever erased.
8 · Your tools, both ways
Ekera fills your tools instead of replacing them
Your tools remain the reference. Ekera reads them continuously and recalculates at every change; it only writes what you have approved, and every write can be reversed. One tool is authoritative for each type of object.
What is stored
Reference tool
What Ekera reads
What Ekera writes, after approval
Architecture views and scenarios
Archi
The model, at every save
Proposed views and relationships
Applications and flows
Mercator
Applications, flows, owners
Statuses, new applications, building blocks
Equipment
GLPI or iTop
Workstations, servers, software and versions
End of life, backups, failover
Network
NetBox
Zones and crossings between zones
Crossings to filter
Compliance
CISO Assistant
Controls and evidence
NIS2 actions, dated evidence
Purchasing and suppliers
Your purchasing software
Quotes, orders, contracts, suppliers, invoices
Quote requests, approved by your purchasing team; never an order
Do you use other open tools, such as MONARC for risk analysis? Ekera can connect to them on request.
All your applications
With AI, connecting to a new application no longer takes months
The connector is written in a few hours from the vendor’s documentation, then tested on your premises before it reads anything.
Your PDF, Word and Excel documents, whatever their origin
Written in days, tested for real
The eleven direct connectors were written in a few days
Then tested on real instances: Samba AD directory, Greenbone, Mercator, GLPI 10, 11 and 12
Your tool is not on the list? All it needs is an API or an export
Connecting a source
Every connector is tested before reading, and your secrets stay with you
Three ways to read
An uploaded file: inventory, directory or firewall export, accounting entries file
A read-only API, with a dedicated account that you create
A collector installed on your premises, which sends its readings without opening an inbound port
What you see for each source
A connection test, and a clear reason when it fails (expired certificate, missing permission)
The date of the last read, and an alert when a source is out of date
A vault reference instead of the password: Ekera never keeps its value
With your purchasing software
Work priced with real prices, and followed through to the invoice
Ekera prepares, your purchasing team approves and sends
Once the decision is made, one quote request per selected building block
Quantities read from your tools: accounts, workstations, servers, sites
The security requirements and NIS2 clauses to put in the contract
Possible suppliers
Ekera never places an order.
Ekera reads back
Quotes, which replace the order of magnitude in the variants
Orders and delivery dates, which track the roadmap
Contracts and suppliers, for the NIS2 supply-chain measure
Invoices, which give the actual cost. Since 1September 2026, every company in France must be able to receive electronic invoices; when your supplier already issues them, the actual cost is read with no re-keying
Your purchasing software is usually the purchasing module of your ERP (Sage X3, Divalto, Cegid, Microsoft Dynamics 365, SAP) or a procurement suite (Ivalua, Coupa, SAP Ariba). Without a purchasing tool: Dolibarr, French open-source software, or the GLPI Management module.
Your toolsArchi, Mercator, GLPI, NetBox, CISO Assistant, purchasing software
→↓ continuous reading: every change triggers a recalculation←↑ approved writes, one by one, reversible
→↓ indicators, with your consent←↑ anonymised claims, to refine the calculation
Your insureror your broker; partnership in preparation
From the conversationThe CIO asks a question; Ekera answers with the map, the euros or the tool record, and prepares the changes.
From your toolThe architect selects objects in Archi; Ekera analyses impacts, proposes scenarios, drafts the opinion or the technical architecture document.
An architecture ontologyThe agent reasons on linked concepts: “Sage X3”, “sales management” and “SRV-ERP-01” are one and the same ERP.
You do not have these tools?We install open-source software on your premises: GLPI, Mercator, NetBox, CISO Assistant, and Dolibarr for purchasing. They remain yours, even if you leave Ekera.
9 · Catalogue and lessons learned
Building blocks kept up to date, costs that sharpen with every customer
A three-level catalogue, sourcing that starts with what you already have, and every new product decided by you, in writing.
Building-block catalogue
What is needed, and with what
ABBs state what is needed (“remote access with two-factor authentication”), SBBs state with which solution and at what cost. Each building block is linked to security measures, NIS2 controls and the calculation: putting it in place changes the euros. A monitoring agent proposes updates (end of support, vulnerability, price); an Ekera architect approves them before publication.
Feedback base
What the work really cost
Each building block put in place produces a feedback record: planned and actual cost and lead time, difficulties met, observed effect. Anonymised and aggregated, with each customer’s written consent, these records will make estimates more accurate for the next customers: everyone benefits from the others’ experience.
Level 1 · generic
The needs
ABBs, common to all customers: “backup out of reach”, “controlled supplier access”. Each is linked to the NIS2 measures and to the calculation.
Level 2 · market
The available solutions
Products, list prices recorded and dated, lead times, ANSSI qualifications. When the price is not public, Ekera writes “on quote” rather than inventing a figure.
Level 3 · yours
Your building blocks and your prices
What is already in place in your company, the products your purchasing team has approved, your negotiated prices and your actual lead times. This catalogue belongs to you alone.
Sourcing, in this order
What you already have. A feature included in your licences, an under-used tool: often the cheapest and fastest.
What your purchasing team has approved. Existing contract, supplier already assessed.
The market. Two or three options compared on the same need, with sourced prices and lead times.
A written decision. Every new product is your choice: the decision record keeps the options set aside and the reasons.
Lessons learned
At 3, 6 and 12 months
Actual cost and lead time, difficulties met, observed effect on the calculation. Your feedback first enriches your own catalogue. It only serves other customers anonymised, aggregated over at least five companies, and with your written consent.
10 · Insurance
Show your insurer what you have done
With your consent, Ekera sends your insurer or broker verified indicators: maximum outage after an attack, backups out of reach, two-factor authentication on remote access, NIS2 compliance, worst case in euros compared with your coverage limit.
Questionnaires from your insurers and from your key customers are pre-filled from the assessment; you review them before anything is sent.
With a partner insurer, the exchange will go both ways: its claims, anonymised, will be translated into Ekera’s ontology using public classifications of incidents and attack techniques (VERIS, MITRE ATT&CK), then validated by an architect and an actuary. We will see which processes, applications and building blocks they affect, and the calculation will become sharper.
This partnership is in preparation. The long-term goal: a premium that reflects your architecture.
What is sent, with your consent
Today’s indicators, and the work decided as a commitment: the new figures count once the work is done and proven
The worst case and the expected annual loss
The date of the assessment, checked by an architect
What is never sent
The company name without your consent
The detailed map of your systems
Your accounts and the names of your servers
For insurers
Ekera for insurers: underwrite and prevent on verified facts
The offer
Underwriting: the insurer’s questionnaire pre-filled, every answer with its evidence
Portfolio: verified indicators tracked over time (maximum outage, backups, two-factor authentication, NIS2 measures, losses in euros calculated by the engine)
Prevention: a costed work plan for the policyholder; once completed and confirmed, the architecture is “verified by Ekera” and the premium or deductible can be reviewed
Claims: your anonymised claims, translated into Ekera’s ontology, to calibrate the model
Confidentiality guarantees
Nothing is sent without the policyholder’s consent, given by a designated person (“sharing” role), and revocable at any time
Indicators, never the detailed map or the raw data
Portfolio averages only above five companies
Data hosted in France, open AI models
Fictitious insurer and portfolio. Policyholder indicators calculated by the Ekera engine.Become a partner insurer
11 · What you receive
Mapping, NIS2 compliance, risk in euros: some thirty deliverables drawn from the same map
NIS2 complianceGaps per measure, audit file, mapping to ISO 27001 and NIST
1 · TemplateYoursYour template for technical architecture documents, HLD or architecture board files, or ANSSI’s for accreditation and EBIOS RM.
2 · DraftingFrom the mapEkera fills in what the map establishes, each fact with its source, and lists what is missing.
3 · ReviewBy the architectThe architect corrects, completes and approves, section by section.
4 · PublicationVersionedIn your document space, with the date and the approver’s name.
5 · FeedbackBack to your repositoriesApproved changes flow back to Archi, Mercator or GLPI, one by one.
The same cross-check of directory, inventory and contracts spots unused licences: disabled accounts that keep a licence, software installed but never opened. Every line cites its source; you decide what is returned.
12 · Sovereignty and trust
Sovereign AI, an architect’s rigour, at a mid-sized company’s price
AI attacks alone. With Ekera, you defend together.
With customers’ consent and in aggregates of at least five companies, every assessment enriches the lessons learned that benefit everyone.
Calculated, not declaredWhat stops is calculated on the map by an engine; the euros come from your accounts. Same data, same result.
Evidence, not statementsEvery finding cites its source; evidence is dated and stored in an exportable vault, ready for an audit.
From finding to decisionThree costed variants, one page per decision-maker, then the changes written into your tools.
SovereignHosting in France, open AI models, no data sent to US services. For sensitive sites, the AI runs on your premises.
No lock-inYour data stays in open tools and formats. If you leave, everything stays with you.
You decideAI proposes, an expert checks (systematically for the first customers, then by sampling and whenever the agent is unsure), you approve. Nothing is written into your tools without your consent.
Product security, reviewed continuously
Ekera applies to itself the requirements it checks for you
At every change
A dedicated security role reviews every sensitive change before it enters the product
Seven automated checks: known vulnerabilities in dependencies, secret scanning across the full history, static code analysis, licences, software bill of materials, components pinned by hash, environment installed from a hash-locked file
Over time
A threat analysis kept up to date
59 security findings raised in code reviews since the start, addressed as they come
An external security audit planned before self-service opens
13 · Who it is for
First, companies without a dedicated CISO
Mid-sized and larger SMEs
No dedicated CISO
Roughly 100 to 500 employees, industry first. The CIO does everything, often alone: Ekera brings the architecture and security team they lack.
CISO
The lone CISO
Roughly 500 to 1,000 employees. The CISO has the responsibility without the team: Ekera does the architecture work and feeds their steering tools, without replacing them.
Large groups and funds
Architects and acquirers
For architecture teams: building-block catalogue, scored scenarios and a panel inside Archi, with an annual licence. Before an acquisition: an IT due diligence in ten days, with no access to the target’s systems.
14 · Partners
IT services firms and managed service providers, accountants, insurers and brokers
IT services firms and managed service providers: deliver assessments to your clients under your brand or ours, for a fee per assessment, and carry out the work they decide on.
Chartered accountants: your clients’ cyber risk, priced from their accounts, to advise them on their investments and their insurance.
Insurers and brokers: verified indicators on your policyholders’ architecture, with their consent.
Engineer in Californian startups, then architect in France
Nearly twenty years of enterprise architecture in regulated environments: nuclear, defence, banking
Cybersecurity solution architecture (NIST, NIS2)
Co-founder of a mobility startup
“Mid-sized companies have the same obligations as large groups, without their architecture teams. Ekera gives them that architect.”
15 · Indicative pricing
A fixed-price assessment, then a subscription
Prices excluding VAT, indicative.
Assessment
€3,500 excl. VAT
IT mapping
Risk in euros and three costed variants
NIS2 gaps and roadmap
Subscription
from €290 excl. VAT / month
Map kept up to date from your tools
Monitoring, alerts and proposals
Evidence vault
2027 launch offer
about €1,500 excl. VAT
First customers, with hands-on support
Full assessment
In exchange for your feedback
IT due diligence
about €12,000 excl. VAT
Quality score of the IT
Red flags, cost of remediation
With no access to the target’s systems
Expertise
€1,000 to €1,200 excl. VAT / day
Complex cases
Large accounts
On-premises installation
Large groups: annual licence, about €40,000 excl. VAT. The cost of the work proposed by the assessment depends on your suppliers: Ekera gives an order of magnitude, then your quotes replace it.
Shared security
Security a mid-sized company could not afford on its own
We set aside at least 30% of every subscription for Ekera’s research, quality and security. This budget is shared by all customers: every flaw fixed, every reading error removed, every new trap tested benefits everyone. The more customers, the better each one is protected, at no extra cost.
Customers
Shared annual budget
What it funds
10
about €17,000
A test bench of hundreds of fictitious companies and trap worlds, one penetration test a year
50
about €85,000
Plus: an annual audit by a PASSI-qualified provider, quarterly penetration tests, human-written test worlds
200
about €340,000
Plus: ISO 27001 certification, a bug bounty programme, full attack exercises, dedicated engineers
1,000
about €1.7M
A security and quality team, SecNumCloud-qualified hosting, a continuous testing lab
Orders of magnitude, based on indicative subscription tiers (from €290 to about €1,200 excl. VAT per month depending on IS size): each customer contributes about €1,700 a year. The audits, certifications and hosting listed are funded as the customer base allows; they are planned, not yet carried out. With each customer’s consent and only in aggregate, from five companies, lessons learned also improve Ekera for everyone. Our R&D.
Shared vigilance
The vigilance of a very large IS, at the price of a mid-sized one
By sharing what they learn, our customers benefit from the vigilance of a large group without its teams. It works like a community navigation app: every driver who reports a traffic jam helps all the others. At Ekera, when a customer spots an attack, an exploited flaw or an incident, the signal benefits everyone, and each receives the alerts and protections drawn from the others’ experience.
The difference that matters to a CISO: our signals cannot be poisoned. Each signal is checked by two people at the customer, then by an Ekera analyst, and signed. It is shared only with the customer’s consent, given by a designated person, and only in aggregate, from five companies. No raw data leaves your premises. Signal analysis is funded by the shared 30% budget.
Ekera and cybersecurity firms
Complementary, not competing
Security plays out on three levels. AI accuracy: Ekera’s strength, tested on a bench of hundreds of fictitious companies, as in an AI lab. Security of the Ekera product: secure development already in place (code review by a dedicated role, automated analysis, secret scanning, verified dependencies, bypass tests, independent review), then an outside view planned and funded by the shared budget: a penetration test by a provider, a PASSI audit, certification. Security of your systems: Ekera does not run penetration tests and never enters your network. It reads, read-only, and computes what an attack would stop without launching it. PASSI-qualified providers remain essential, and become our partners.
Better-targeted penetration tests, and monitoring between campaigns
Ekera does not replace penetration testing: it targets it. It tells you what to test first, the attack paths and single points of failure that matter, and what an outage would cost; you avoid paying to test what has no impact. The provider’s findings flow back into the map and the costing in euros, with the work to be done, and Ekera monitors continuously between two annual campaigns. The result: shorter or more useful penetration tests, and monitoring the rest of the year.
16 · FAQ
What people ask us
Is my company covered by NIS2?
As a rule, yes if you are a medium or large company (at least 50 employees or more than €10M in revenue) in one of the 18 sectors covered: energy, transport, health, water, digital, manufacturing, food, waste, postal services, chemicals, among others. In France, the transposition law has not been passed yet: adopted by the Senate in March 2025, it is still awaiting the National Assembly, and the Court of Justice of the European Union has been seized against France in July 2026 over the delay. The obligations will apply once the law and its decrees are adopted. The directive provides for fines of up to €10M or 2% of worldwide turnover for essential entities, and €7M or 1.4% for important entities. Your customers, insurers and buyers often ask the same questions today, even if you are not directly covered.
Where does my data go?
It is hosted in France and segregated per customer: separate database, encryption keys, indexes and backups. Ekera uses open AI models hosted in France: no data goes to US services. For sensitive sites, the AI can run on your premises.
Does Ekera need access to my systems?
No. You upload documents and exports, or plug in read-only connectors. To write the changes you approve, Ekera uses separate, optional access limited to those changes, with no administrator rights.
Where do the euros come from?
From your accounts. The accounting entries file, which every company in France can produce, gives revenue and variable costs; it is read on your computer. The assumptions (outage duration, share recovered, penalties) are shown and can be discussed with your CFO or your accountant.
And the cost of the proposed work?
At first it is an order of magnitude, flagged as such. It becomes the list price multiplied by your quantities, or a sourced and dated range when the price is only available on quote; then your suppliers’ quote, requested by your purchasing team from your purchasing software once the work is decided; then the actual cost read from the invoice. Ekera never places an order.
How is this different from a security audit?
An audit tests your defences. Ekera maps what you have, calculates what an attack would stop, measures the gaps against requirements and prepares the evidence. The two complement each other: Ekera’s map and evidence make your auditor’s work easier.
How is this different from compliance management tools?
Those tools help a CISO track risks and frameworks, based on what is declared in them. To our knowledge, they do not calculate on the map of your systems what an attack would stop, and they do not propose the target architecture with its cost. Ekera can feed the tool you already have.
Does Ekera replace my CISO or my accountant?
No. Ekera does the architecture work and the calculation; it does not carry responsibility for your security and does not keep your books. It gives your CIO, your CISO if you have one and your accountant costed, sourced material to decide.
What if the AI gets it wrong?
The figures come from a calculation engine, not from the AI. Every finding cites its source, which you can check. When the agent is unsure, it says so and an expert checks. You confirm the facts you know before the map is written into your tools.
What happens after the assessment?
You keep the map and the deliverables. With the subscription, Ekera keeps the map up to date from your tools, monitors the vulnerabilities and end-of-support dates that concern you, and proposes the changes to decide on every month.
17 · Become a customer
Become an Ekera customer
Our first customers get a launch offer for their first assessment, on preferential terms. A 30-minute call is enough to see whether Ekera is right for you.
