The traces of the attack are already in your network's logs. Nobody has the time to read them.
In a single day, firewalls, servers and computers produce more alerts than the team can check, and the important ones get lost among the false alarms.
Understand what is happening, right away.
Know in time when you are under attack. Know exactly what to do.
A security operations centre (SOC) with an AI agent, installed in your network, that can watch both your office network and your industrial network. Work with your own team, helped by the agent, or with certSIGN's specialists, 24/7.
- No hard-to-find specialists needed: anyone can understand and respond, with the help of the AI agent.
- With the on-premises installation, your data stays in your network.
- We identify attack campaigns and attack chains, and make investigation simpler.
It shows you what is happening, helps you respond to attacks and keeps the evidence that you acted.
From certSIGN, a Romanian cybersecurity company, active since 2006.
thousands of log lines → one campaign
The situation
Two networks, one team and more and more compliance requirements.
A mid-sized energy producer, a water company or a factory has two networks: the office network (IT) and the industrial network (OT). The same IT team, usually a small one, looks after both. Now NIS2 requires this team to detect and report attacks in both.
IT security tools do not understand industrial protocols, and OT tools do not see the attack that started in the office and reached production.
Twenty-year-old controllers produce no security logs. Two or three suppliers have remote access. And nobody has the complete list of connected equipment.
NIS2 requires you to prove that you detect and report in time. A spreadsheet is not enough.
The early warning (24 hours), the notification (72 hours) and the final report carry the signatures of people who are personally accountable.
How it works
From thousands of log lines to one attack, explained and verifiable.
Every step can run entirely on your servers (no data in the cloud). The AI agent that investigates and writes the explanations never decides whether something is an attack: using the context, it explains the classification made by classic detectors, which can be tested. The decision is yours.
-
01Collect
IT and OT logs are collected locally, without writing parsing rules (parsers) and without exporting anything. For industrial equipment that produces no security logs, the cyberTENANT platform reads a copy of the network traffic from a switch's mirror port, without interfering with the network.
-
02Detect
Several independent detectors analyse every source and must agree before an alert reaches you. They run on ordinary processors, without a graphics card.
-
03Correlate
Every detection is mapped to an attack technique in the MITRE ATT&CK catalogue. Detections are linked in the order they happened and kept together as one attack, from the office network to the industrial network.
-
04Explain
Every sentence of the explanation points to the exact log lines it relies on, and an automatic check rejects any sentence without a source. When the evidence is thin, the system says so openly. The decision is yours.
The local AI agent
The agent asks before it acts.
You ask in plain words and get an answer with the evidence beside it. Anyone can investigate like a specialist, without being one.
What it does
Answers questions about your network and shows the log lines behind every sentence. Investigates only with approved tools, whose use is recorded, describes the incident and generates the drafts of the NIS2 reports, from the same evidence.
What it never does
It does not decide alone and does nothing until a person presses "Confirm". Everything it reads and every step it takes is recorded in the audit log.
Where it runs
Everything can run locally, on your servers. Detection runs on ordinary processors and needs no graphics card (GPU). For the agent to run locally, you need one graphics card with 32–80 GB of memory. If you prefer, the agent can also use an external AI model.
In the on-premises option, logs go to no cloud AI and no third party. In the managed service, certSIGN receives only what you choose to send.
IT managerWhat did the account ana.ionescu do after 22:40?
AI agent
Three steps, each with its evidence. The account connected through the VPN from an address outside the country, never used before[1], asked Active Directory for the list of administrators[2], then opened a remote session (RDP) to the file server FS-02[3]. I see no files copied outside the network. My recommendation: block the account temporarily and check with Ana whether she logged in.
- [1]vpn-01 · 22:41:07 · login ok user=ana.ionescu src=203.0.113.45 geo=NL NEW_ADDRESS
- [2]dc-01 · 22:43:52 · ldap search user=ana.ionescu filter=(memberOf=Domain Admins)
- [3]fs-02 · 22:47:15 · 4624 logon type=10 (RDP) user=ana.ionescu src=10.8.0.14
Proposed action, waiting for your confirmation: Block the account temporarily · notify the IT lead Confirm Cancel
Capabilities
What cyberTENANT does, in short.
Six things the platform does. You can check each one in a demo.
IT log analytics
Any log source: firewalls, directory services (for example Active Directory), servers, computers, cloud accounts and services. The features of each log are extracted automatically, without hand-written parsers. Several detectors assess every event and must agree.
OT and industrial protocol coverage
The cyberTENANT platform analyses a copy of the industrial network traffic from a mirror port and decodes industrial protocols (Modbus/TCP and S7comm to start with). It installs nothing on controllers, does not scan the network and cannot send commands. The protocols covered are agreed for each site.
Groups alerts into campaigns and attack chains
Detections are grouped into attack techniques, and the techniques are linked in the order they happened. Linked attacks form a campaign, which updates as it progresses, from the office network to the industrial network.
Evidence and audit trail
Every alert points to the log lines it started from. Every explanation, every question put to the agent and every action it takes is recorded together with the evidence, ready to show an auditor.
Local AI agent
Investigates with approved tools, answers in plain words and points to its sources, prepares the 24-hour, 72-hour and one-month NIS2 reports. Any action that cannot be undone needs a person's confirmation.
model: local · external calls: 0 · audit log: on
06
Integrations and export
Reads logs from the collection system you already have (for example a SIEM) and complements it rather than replacing it. If you do not have one, the platform comes with its own. Campaigns, incidents and reports can be forwarded to a SIEM or a ticketing system.
Use cases
Sound familiar?
Four sectors where a company (subject to NIS2) has both an office network and an industrial network. Here is one example of an anomaly for each sector.
Energy and electricity
- The risk
- The attack starts in the office network and reaches the controllers of a generating unit or a substation.
- What cyberTENANT sees
- Logs from the office network and traffic from the industrial network, pieced together into one campaign.
- Example of an anomaly
- An engineering workstation writes to a protection relay outside the maintenance window.
Water and wastewater
- The risk
- Pumping and treatment stations run unmanned, and suppliers connect remotely according to their schedule.
- What cyberTENANT sees
- Every remote connection, every new device and every deviation from the industrial network's normal behaviour.
- Example of an anomaly
- A vendor VPN session opens at 03:00 and reaches an RTU that was not on the maintenance list.
Manufacturing
- The risk
- Production lines depend on equipment that cannot be patched and on an ERP that ransomware groups know well.
- What cyberTENANT sees
- The path from a compromised office account to the first industrial command.
- Example of an anomaly
- A service account logs in from a new address, then a new device appears on the production line network and sends Modbus commands.
Utilities and district services
- The risk
- District heating, gas distribution and municipal operators report to DNSC, often with very small teams.
- What cyberTENANT sees
- Related alerts grouped into campaigns (instead of hundreds of separate alerts), and the report drafts prepared from them.
- Example of an anomaly
- A SCADA server receives its first-ever connection from the guest Wi-Fi range.
Another regulated sector?
Tell us what your network looks like. If cyberTENANT is not a fit for you, we tell you in the first conversation.
Two delivery options
The cyberTENANT platform runs in your network. You choose who works with it: your team or certSIGN's specialists.
The same product, two equally good options. In both, logs stay with you and every conclusion comes with its evidence. In the industrial network, the platform only listens and touches nothing. The incident report to DNSC never leaves without a person's confirmation: you send it, under your signature.
With your team
The platform is installed in your network, and your team works with it, helped by the AI agent. You do not need hard-to-find specialists. An IT or automation specialist, or a junior analyst, can investigate, understand the attack and prepare the NIS2 evidence with the agent's help. Outside working hours, the agent can notify you through WhatsApp, Teams or e-mail.
How it is installed: On your servers, as a virtual machine, or on a small appliance mounted in the automation cabinet that only listens to production traffic and touches nothing. We install it, or your partner does.
Suited to: companies that want to work with their own team and stay in control.
With certSIGN's specialists
They watch your network 24/7. The specialists of certSIGN's security operations centre are alerted whatever the hour or the day. The platform still runs in your network, and you learn, in plain words, what happened and what you need to do.
What certSIGN receives: Only what you choose to send. Logs stay with you.
Suited to: Companies of any size that want certSIGN to handle the monitoring, including SMEs without a security team. certSIGN or your partner installs it.
your network boundary — the same on both pathspassive tap on the industrial segment
The same product and the same AI agent in both options. You can start with one and switch to the other at any time.
Not sure which option suits you? Talk to an engineerCompliance and NIS2
The evidence your auditor asks for.
Since 27 August 2026, DNSC Order No. 1/2026 requires all essential and important entities to calculate their cybersecurity maturity level and submit a remediation plan. Detection, continuous monitoring and incident handling are the areas where organisations in Romania are most exposed.
NIS2
Article 21 of the NIS2 Directive requires detection and continuous monitoring across the whole organisation, in the office network as well as the industrial network. Article 23 requires an early warning within 24 hours, a notification within 72 hours and a final report within one month. The platform prepares the drafts of these reports from the incident data, with every statement traceable to the log lines, and your team approves them.
GDPR
Because the platform runs in your network, the personal data in the logs stays with you, for as long as you decide, with no transfer outside the European Union and without falling under the jurisdiction of non-EU states. In the managed service, certSIGN, a Romanian company, receives only what you choose to send.
EU AI Act
AI systems used only for cybersecurity are not considered "high-risk" under Regulation (EU) 2024/1689. Even so, we built cyberTENANT on the same principles: recorded actions, openly stated limits and mandatory human confirmation for anything that cannot be undone.
The cyberTENANT platform does not exempt you from compliance requirements, but it gives you the evidence you need to demonstrate compliance.
Read the guide: NIS2 incident detection and reporting for operators with OT systems What cyberTENANT does not do
Who built cyberTENANT
Developed by a company that understands NIS2 obligations.
certSIGN has operated since 2006 and has more than 300,000 customers. It is a qualified trust service provider under eIDAS and runs its own security operations centre (SOC) and an incident response team accredited by Trusted Introducer. And, like your company, it is subject to NIS2: it files the same reports, within the same deadlines.
We built cyberTENANT for our own network first. The platform runs daily in the certSIGN SOC, on real data, and research continues with the University of Bucharest and the Petroleum-Gas University of Ploiești.
A Romanian company, European jurisdiction, data that stays with you.
Questions and answers
Short answers to the natural questions.
Does it require an internet connection?
No. Detection, analysis, the AI agent with its model and the audit log can all run in your network. Even if you disconnect the site from the internet, everything keeps working. If you do not have a graphics card (GPU) with 32–80 GB of memory, you can use an external AI model through an API, or certSIGN's managed service. In the managed service there is a single, controlled connection to certSIGN, used only for what you choose to send. Updates can also be delivered offline.
What happens to my logs?
Logs, detection models, the AI model and the questions you ask the agent stay in your network. If you work with your own team, nothing reaches certSIGN or the internet. In the managed service, certSIGN receives only what you choose to send, for example only certain types of alerts. An external AI model, reached through an API, can be used only if you switch it on yourself, through a separate contract with that provider, paid by you and under your responsibility.
I have no security specialists. Is it for me?
Yes. You do not need people highly specialised in cybersecurity. An IT specialist or a junior analyst investigates with the AI agent: the agent explains every alert and every campaign in plain words, shows the evidence and prepares the draft NIS2 report, and the specialist decides. If you prefer not to deal with it at all, choose the managed service: certSIGN monitors and investigates for you, 24/7, and you only approve and sign the NIS2 report.
Who sees an alert outside working hours?
It depends on the option you choose. In the managed service, the specialists of certSIGN's security operations centre are alerted, not you. If you work with your own team, the cyberTENANT platform monitors the network around the clock, and the AI agent notifies you with a message when a problem appears.
How do I know the AI is not making it up?
Because you can check every sentence. Every statement points to the log lines it relies on, and an automatic check rejects text that does not cite its evidence. When the system is not sure, it says so. And the AI agent never decides whether something is an attack: it explains a decision already made by classic detectors, which can be tested.
Does the AI make decisions on its own?
You can configure an automatic mode and an interactive mode, but for irreversible decisions the agent proposes and a person confirms. Nothing irreversible happens without explicit approval, and every action is recorded in the audit log.
What hardware does it need?
Detection, classification and correlation run on ordinary server processors, without a graphics card, and can probably run on the servers you already have. You need a graphics card with 32–80 GB of memory only if you want the AI agent to run locally. If you do not want to buy the card, you can work without a local model or connect the platform to an external model of your choice, under your own contract with that provider. We agree exactly what you need together, after we look at your infrastructure.
Which OT protocols are supported?
The industrial side is passive. We read the logs the control system already produces, and where equipment produces no logs, we analyse a copy of the network traffic from a mirror port and decode the protocols (Modbus/TCP and S7comm to start with). We install nothing on controllers, scan nothing, and the platform cannot send commands. Before we start, we agree together which protocols the platform will read at your site.
We already have a SIEM. Why would we buy another one?
The cyberTENANT platform does not replace your SIEM. It reads the logs you already collect and adds what the SIEM lacks: grouping alerts into campaigns, explaining them with the evidence attached, and answering your questions about them. If you have no central log system, the platform comes with its own. Nothing you have bought is lost.
How much does it cost?
We send you a personalised offer, in writing, after a short conversation about your network and what you want watched. The conversation commits you to nothing.
Do you support Romanian-language reporting?
Yes. The interface, the explanations and the reports the platform prepares are in Romanian and English, and support is provided in both languages by a team in Romania.
Book a demo
Do not take our word for it. See every capability demonstrated live.
Have thirty minutes? Pick the day and time, see the cyberTENANT platform at work, and we decide together which option suits you.
- Logs stay with you, in both options.
- Support in Romanian and English.
- The demo commits you to nothing.
Prefer to talk to an engineer first? Write to cybertenant@certsign.ro.