ekera Interdependent information systems
An outage or a compromise can affect several applications, infrastructure components and business processes. Understanding these dependencies helps anticipate the consequences of an incident.
The method: from mapping the information system to the decision
Ekera builds a documented map of your information system, finds the critical dependencies, analyses attack and outage scenarios, estimates their consequences in euros and compares the work. AI proposes, your teams decide.
Why now
Cyber risk is becoming an investment question
Companies need to know their IT dependencies better, justify their security investments and document the measures they put in place. Yet decisions remain hard: technical teams describe vulnerabilities, while management arbitrates budgets without always having a shared estimate of the economic consequences.
1,251 cyber claims paid to companies in France in 2025, up from 448 in 2024.
248 claims paid in 2025 for 2,002 insured mid-sized companies, about 12% in a single year.
Over 15,000 entities covered by NIS2 in France according to ANSSI, the French national cybersecurity agency, up from about 500 under NIS 1.
Required by ANSSI’s Référentiel Cyber France (working draft, March 2026): an IT map kept up to date.
Three shifts reinforce this need
Growing security and traceability requirements
Companies must identify their risks, justify their security measures and document their decisions. A structured map makes this easier and lets you track how the system changes.
Budget decisions that are hard to arbitrate
Security measures keep multiplying, but they do not all have the same cost or the same effect on risk. Comparing them helps target investment.
Meanwhile, cyber insurance rates are falling: −4% worldwide in the second quarter of 2026, the twelfth quarter of decline in a row. In a more competitive market, telling risk profiles apart can become an advantage for insurers; verifiable information on architecture can contribute to it.
And attacks are changing scale: in July 2026, Hugging Face confirmed an intrusion carried out by an autonomous AI agent. Faster attacks call for better preparation: knowing the dependencies between applications, infrastructure, identities and processes before the incident, so you know at once what is affected.
In France, the law transposing NIS2 has not been passed yet. But your customers, your insurers and your buyers are already asking the same questions.
Sources: AMRAE, LUCY 2026 study (2025 data); Marsh, Q2 2026 ; Hugging Face, 16 July 2026; Security Magazine and IT-Connect, July 2026; Vincent Strubel, Director General of ANSSI, before the French Senate, December 2024; Référentiel Cyber France (ReCyF) v2.5, objective 5, measure 5.A.1, working draft of 17 March 2026.
Ekera brings these three issues together: understanding the system, estimating the consequences of an incident and choosing which measures to fund.
Three situations
Three common situations
Track your progress on the NIS2 measures
Identify the gaps between your situation and the applicable requirements, map critical dependencies and organise the evidence needed to track them. Ekera helps structure the assessment and prepare your roadmap; it does not, on its own, deliver a compliance certification.
Discover the NIS2 assessmentAssess an information system before an acquisition
In a deal, IT risks weigh on business continuity, future investment and the value of the company. Ekera structures the available information, identifies points of attention and estimates remediation costs, from the accessible documents, with no direct access to the target’s systems.
Discover IT due diligenceEquip your enterprise architecture team
Automate part of the collection, analysis and documentation to spend more time on decisions. Ekera links business needs, applications, infrastructure and technical solutions; it prepares change scenarios and the related documents, which your architects check and approve.
Discover enterprise architecture
The common thread
From mapping the information system to the investment decision
Ekera helps companies understand their information system, estimate the financial consequences of its weaknesses and choose the work that reduces their exposure the most. From your documents, your tools and your teams’ knowledge, it builds a documented map, finds the critical dependencies, analyses attack and outage scenarios, then estimates their consequences from your data and explicit assumptions. Results are sourced, assumptions are visible, and decisions stay in your hands. Every module below follows from this mechanism.
Ekera’s modules
One product, one map: modules are switched on as you need them.
Are you a broker or an insurer? Become an Ekera partner
How Ekera works
AI automates part of the analysis and documentation. You stay in control of the decisions.
Ekera uses your documents, your exports and, when you decide so, data from your tools. It builds a documented map of your information system, analyses its dependencies and prepares change decisions. Results are tied to their sources; missing information, assumptions and the limits of the analysis are flagged. Not every step is automated: the interview with your teams, checking the results and the decisions remain human.
| Step | Your question | What Ekera provides |
|---|---|---|
| Collect | What information do we gather? | Your documents, your exports and, if you decide so, data from your tools; what is missing or contradictory is flagged. |
| Map | What does my system depend on? | A documented map of applications, dependencies and business processes, every item linked to its source. |
| Assess | What would an incident cost? | Attack and outage scenarios, explicit assumptions and financial estimates. |
| Prioritise | Which work should we fund first? | The measures assessed, compared by cost and estimated effect for three budgets, and a roadmap. |
The steps, one by one
- Collect You provide the documents, diagrams, inventories and exports you have. The initial assessment needs no direct access to your systems. (no admin rights)
- Complete The agent asks your teams about what the documents cannot establish, and only about what changes the map, the risk or the decision. (online, at your pace)
- Map Business processes, applications, infrastructure and dependencies, each item linked to its sources, with their date and status when known. (sourced and dated)
- Analyse Critical dependencies, single points of failure (items whose failure alone can interrupt a critical activity) and attack or outage scenarios to examine. (checkable against sources)
- Estimate A calculation engine independent of the language model applies explicit rules to your data and the chosen assumptions. Reproducible; as accurate as the data and assumptions. (assumptions shown)
- Compare Combinations of catalogue measures, by estimated cost and effect on modelled risk. Indicative prices are kept separate from quotes. (costs to confirm by quote)
- Prepare decisions The CIO reviews dependencies, the CISO the risks, the CFO the estimated costs and benefits, purchasing the requests for quotes; management arbitrates. (traced approval flow)
- Follow up When your sources are connected, Ekera updates the map, spots relevant changes and proposes new actions. Any write into your tools follows the agreed permissions. (nothing without your consent)
What Ekera uses
Your documents (contracts, architecture files, security policy, meeting minutes), your exports (inventory, directory, firewall, cloud, tickets, purchasing, accounting entries), read-only connectors to your tools, and an interview with your CIO for what the documents do not say. What is missing or contradictory is flagged.
Financial estimates built on explicit assumptions
A calculation engine, independent of the language model, produces the figures; data, assumptions and sources are shown, and every quotation is checked word for word against its document. Identify the measures, among those assessed, that reduce your exposure the most. It is a reasoned basis for prioritising, not a guarantee of the actual cost of a future incident.
You stay in control of changes
Ekera writes into GLPI, CISO Assistant or Mercator what you have decided, and only after a person’s signed approval, through the process agreed with you. Every write is traced: who approved it, when, what changed. Ekera never deletes anything; a mistake is undone or compensated by a reverse operation when the tool allows it.
Costing in euros
Link technical risks to their financial consequences
A list of vulnerabilities is not enough to decide which measures to fund. Ekera estimates the financial consequences of the scenarios studied from your data, notably accounting and operational data, and explicit assumptions.
Four notions to keep apart
What a given incident would cost
Depending on its duration, its scope and the assumptions made. The worst scenario is broken down line by line and compared with your insurance limit.
A yearly average, under the assumptions
What the scenarios studied would cost on average each year, as a range: estimated potential losses, conditional on the assumptions used (provisional calibration, not validated by an actuary).
How it is calculated
Given the frequencies and consequences used in the model: for each scenario, estimated frequency × loss, added up. They are given as a range because frequencies, downtime and response costs are uncertain.
The modelled risk reduction
The estimated drop in risk in the modelled scenarios, if the measures considered are implemented. It is a change in risk, not an avoided expense.
An expense actually avoided or reduced
A cancelled licence, a purchase that no longer happens: it shows in your accounts, as distinct from a theoretical gain or time freed up. These four figures are not interchangeable; each comes with its definition, assumptions and limits.
Your accounts, read on site
The figures are produced by the calculation engine, independently of the language model: same data, same result.
How it is calculated
Reproducible does not mean exact: the result is only as good as the data and assumptions. The French accounting entries file (FEC), which every company can produce, gives revenue and variable costs; the margin is split across your revenue streams, each counted once. Data, parameters and sources are shown so you can discuss them with your technical and finance teams.
Costs that become more precise
- Order of magnitude from the catalogue (estimated)
- List price times your quantities, or a sourced, dated range when the price is only given on quotation (calculated)
- Quotes from your suppliers, requested by your purchasing team once the work is decided (confirmed)
- Actual cost after completion, read on the invoice when available (invoiced)
Today, the costs shown are illustrative orders of magnitude, to be confirmed by quotes. If the ranking of the variants changes between the low and high ends of the price ranges, Ekera flags it.
The goal: a well-argued basis for comparing investments, without confusing an estimate with a guaranteed result.
Collective decision
A shared basis for your IT and financial decisions
One assessment, several viewpoints: for each function, Ekera prepares the page that concerns it, calculated by the engine. A work scenario goes through your approval flow before anything is written into your tools.
- CIO Sees the dependencies and weak points, and compares change scenarios.
- CISO Links technical findings to business processes, documents risk scenarios and prepares the roadmap.
- CFO Reviews the cost of measures, the estimated financial consequences and the expected risk reductions.
- Purchasing Prepares requests for quotes and compares options based on needs, what exists and documented prices.
- General management Receives a summary of the stakes, scenarios and proposed trade-offs, and decides.
Each person approves, rejects or asks for a change from their email or Teams. The flow adapts to your organisation: the CFO only above a certain amount, for example. Decisions and opinions are traced; nothing is written into your tools before.
Request an assessment
A first 30-minute call: framing your need, the possible scope and the list of information needed for the assessment. The initial assessment starts from your documents and exports, with no direct access to your information system.
Read next
- Costed example (fictitious example)Fictitious example: activity stopped, worst case in euros, work compared.
- The product in screensThe workspace, the screens, the deliverables and continuous monitoring.
- Tools and architectureRead-only connectors, enterprise architecture, catalogue and purchasing.