Practical before perfect
The first product solves a real workflow before becoming a large SaaS platform.
Cyber readiness / Germany + EU
Cyber readiness,made actionable.
We help SMEs find cybersecurity gaps and fix priorities through a 10-day readiness sprint. Weighted scoring, prioritized risks and a 30/60/90-day roadmap in ten business days — automation where software is reliable, human review where judgement is required.
Current assessment scope
Microsoft 365AI usageExternal exposureIncident readinessSupplier riskNIS2 / compliance evidenceIndustrial / OT
10
business days per sprint
6
weighted readiness modules
Reviewed
every customer-facing finding reviewed before delivery
Measured, then reviewed
See the gaps before they become incidents.
One weighted view across your systems, suppliers, governance and incident readiness. Every customer-facing finding is checked by a cybersecurity lead before delivery.
READINESS OVERVIEW — SAMPLE6 MODULES
M365Microsoft 365 SecurityGap identified
AIAI Usage RiskNot yet reviewed
EXTExternal ExposureReviewed
IRIncident ResponseGap identified
SUPSupplier RiskNot yet reviewed
NIS2NIS2 Evidence-Gap MappingReviewed
This is what your overview looks like once we've been through your systems. Every report is specific to your business — this is a sample, not a real result.
Why
Why Cybnivo
Readiness you can act on — combining structured automation with findings the Cybnivo cybersecurity review has approved. No fear marketing.
Expert-reviewed
AI can draft explanations and reports, but the Cybnivo cybersecurity review approves every customer-facing finding.
Permission-based
No scanning or technical testing without clear written authorization and defined scope.
SME language
Management should understand the top risks without deep cybersecurity knowledge.
International core, local compliance layer
The technical readiness model is reusable; regulatory mapping changes by country and framework.
A home for your cyber readiness
M-0125%
Microsoft 365 security
The heaviest reading on the panel: identity, tenant configuration and admin hygiene across the platform most SMEs actually run on.
- MFA and conditional access coverage
- Admin account separation and privilege review
- Email authentication (SPF, DKIM, DMARC)
- Sharing, guest access and data-loss settings
M-0220%
Incident readiness
Whether a real incident would be handled or improvised — roles, contacts, escalation, backups and restore confidence.
- Documented incident plan and named roles
- Escalation and out-of-hours contact chain
- Backup coverage and last verified restore
- Customer, authority and insurer notification path
M-0320%
External exposure
What the internet can see and reach. Permission-based, non-intrusive checks against your authorized scope only.
- Internet-facing asset and domain inventory
- Exposed services, portals and remote access
- Certificate and DNS hygiene
- Known credential and data leak signals
M-0415%
AI usage risk
Which AI tools are used, what data goes into them, and which rules are missing — a rapidly evolving SME risk area.
- Inventory of AI tools and real use cases
- Confidential, customer and source-code data flows
- Approval, retention and human-review practice
- Written AI usage policy and staff guidance
M-0510%
Supplier risk
Third parties with access to your systems and data — MSPs, SaaS vendors, contractors and integrators.
- Critical supplier and access inventory
- Contractual security and breach-notice terms
- Offboarding and access revocation practice
- Concentration risk on a single IT provider
M-0610%
Governance & compliance evidence
Mapping the evidence you already have against what customers, auditors and frameworks keep asking for.
- Existing policies, owners and review dates
- Evidence mapping for NIS2 / ISO 27001 / SOC 2 questions
- Security responsibilities and decision rights
- Awareness training and onboarding records
The sprint
Ten business days, fully mapped
Two workshops, a document request list and read-only evidence. Everything else is on us.
Scope & authorization
Kick-off call, scope definition, access plan.
Output — Signed scope + authorization
Kick-off
Set up workspace, send questionnaire v1.
Output — Questionnaire issued
Evidence collection
Review responses, request missing evidence.
Output — Evidence pack
Microsoft 365 review
Identity, tenant and email authentication review.
Output — M365 findings draft
External exposure
Permission-based external checks.
Output — Exposure findings
AI & supplier risk
AI use-case mapping, supplier access review.
Output — Risk register entries
Success Stories
Success Stories
Our first pilot assessments are currently being prepared. Verified customer feedback and anonymized case studies will be published here only with customer permission.
Deliverables
Everything you receive on day 10
A management-ready package: one score, one prioritized risk list, one roadmap — plus the evidence gaps you will need if an auditor or customer asks.
See pricing- Management summary in plain business language
- Weighted readiness score across six categories
- Prioritized top risks with business impact
- 30/60/90-day remediation roadmap with owners
- Compliance evidence map (what exists, what is missing)
- Incident readiness gap list and contact chain
- Supplier and AI usage risk register
- Optional industrial/OT readiness annex
Resources
Discover our resources
Short, practical notes to help you move on readiness this week.
SME security basicsComing soon
A practical Microsoft 365 security baseline for SMEs
MFA is not a project. Conditional access, admin separation and email authentication are four important baseline areas we review during Microsoft 365 readiness.
In preparationAI-risk readinessComing soon
How to let your team use AI without leaking customer data
A clear AI policy, an approved-tool list and data-handling guidance can reduce common AI usage risks your staff are creating today.
In preparationCompliance evidenceComing soon
NIS2 is not a platform you buy — it is evidence you can show
Map what you already have before you buy anything. Many SMEs already have useful security evidence scattered across policies, systems and suppliers; the challenge is identifying what exists and what is still missing.
In preparationFrequently asked
Do you certify us for NIS2 or ISO/IEC 27001?
No. Cybnivo provides cybersecurity readiness assessments and evidence-gap mapping. NIS2 is a regulatory obligation for organizations within scope; Cybnivo does not issue a NIS2 certification. ISO/IEC 27001 certification, where pursued, is a separate process handled by an appropriate certification body.
Will you test or scan our systems?
Only with written authorization and an agreed scope. External exposure checks are permission-based and non-intrusive. We never run active tests on production or industrial systems.
Is the report written by AI?
AI drafts explanations and structure. The Cybnivo cybersecurity lead reviews and approves every customer-facing finding before it reaches you. That review gate is not optional.
How much of our time does the sprint need?
The sprint is designed to minimize customer effort: a kick-off, the questionnaire, two short interviews and the final 60-minute management readout. Exact customer time is confirmed during scoping and will be measured during our pilot phase.
We already have an IT provider. Does this replace them?
No. We give you a neutral picture and a prioritized plan. Your MSP or internal IT can use the roadmap to prioritize implementation.
Do you work outside Germany?
The technical readiness model is international. Germany and the EU are our first markets; the regulatory mapping layer changes by country and framework.
Get started
Request your readiness pilot
Tell us your size and sector. We will show you what the sprint would cover, what we need from your team, and what you receive on day 10.
Prefer to talk first? Book a discovery call — 20 minutes, no obligation.
Prefer email? info@cybnivo.com