What NIS2 specifically requires
NIS2 Art. 21 obliges affected entities to implement comprehensive risk management measures — including continuous monitoring of the attack surface, detection of security incidents, management of supplier risk and regular reporting to the relevant authority. The key change from NIS1: continuous, not annual. A one-off pentest or an annual questionnaire is no longer sufficient.
Why classic approaches fall short
Most companies today meet NIS2 with a combination of annual penetration tests, supplier questionnaires and internal audits. The problem: an attacker needs hours — not 12 months. Leaked credentials, newly discovered vulnerabilities in software you use, or a compromised supplier go undetected between two audits. That's exactly why NIS2 explicitly requires continuous measures.
How Darkscope satisfies NIS2 Art. 21
Darkscope delivers continuous monitoring across all NIS2-relevant dimensions: dark web monitoring for leaked credentials and compromised systems (daily), attack surface monitoring for externally visible vulnerabilities, supplier monitoring via 360TPRM, credential monitoring for all company domains, automated incident alerting with escalation paths, and authority-ready reporting that can be used directly as NIS2 evidence.
NIS2 obligation: am I affected?
In Germany alone, NIS2 affects around 30,000 companies — significantly more than NIS1. Affected sectors: energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, public administration, space. Size threshold: from 50 employees or €10 million annual turnover in an affected sector. Suppliers to critical entities can also be indirectly affected.
Fines and liability
NIS2 has real teeth: fines of up to €10 million or 2% of worldwide annual turnover — whichever is higher. New: personal liability for management. Executives and managing directors can be held personally liable for violations. That makes NIS2 compliance a board-level matter — and continuous monitoring essential coverage.