NIS 2 law: a new review date is expected. Take your free pre-assessmentNIS 2 · ReCyF: sealed, timestamped pre-assessment
Cybersecurity for SMEs and mid-sized companies · hosted in France Digital sovereignty & active defence · hosted in France
Service up and running · servers in FranceSooner or later, someone will attack you. Find out where before they do. The infrastructure that neutralises threats without ever touching your systems unless you have signed.
Free · 30 seconds · no sign-up · nothing is sent to your machinesInstant passive scan · public sources · no sign-up
The website entered above will be analysed directly in the demo space.
We monitor what your business exposes on the Internet, explain every risk in plain English, and only act with your signature. Full platform: €390 incl. VAT per month, or €3,000 incl. VAT per year. Hosted in France. Passive discovery of your attack surface, KEV/EPSS prioritisation, A0 → A4 action broker under a signed mandate, append-only ledger. No language model in the authorisation path: formal rules, a SHA-256 fingerprint and a human countersignature.
Action mandate · level A3 pending
Proposed actionIsolate address 185.220.101.5
Scope1 host · 30-min window · rollback planned
Intent fingerprint (SHA-256)—
RequesterSIGNED · role verified in database ApproverPENDING · requester excluded
Simulation: a mandate takes two signatures, and nothing happens without that agreement. At your company, your signature is what counts. Demo: 2/2 quorum, fingerprint recomputed before the order is issued. The target's criticality is re-read from the database, never taken from the requester.
Invariant ledger · append-only log
The record of what was done is append-only: the application can neither alter nor erase it, not even with our own service accounts. In front of an insurer or a judge, it shows what was done, by whom and when. Hash chaining under a transactional lock. Mutation and truncation rejected by trigger, even for the table owner.
0 actions at your company without a mandate signed by you executions without an active, signed, unexpired
AuthorizationGrant2 different people must say yes before any serious action distinct approvals required at A3 — requester excluded, quorum bound to the intent
∞ the record of what was done cannot be altered or erased by the application, not even by us append-only log:
UPDATE, DELETE and TRUNCATE rejected at database levelProof before promises Live passive scan · same sources as the platform
See what an attacker sees of you. Right now, on your own name. Your external attack surface, computed live by the passive discovery engine.
Type in your website's name. In under thirty seconds, you get the number of addresses linked to you on the Internet, the ones that have been forgotten, and a score. Nothing is sent to your machines: we only read what is already public, exactly as an attacker planning a move would. Discovery via Certificate Transparency logs, CDX archives and DNS-over-HTTPS resolution. No packets sent to your infrastructure: public sources only, results cached for 12 h, rate-limited. The preview returns counts and a score; the named inventory, ports and CVEs are part of the platform.
- Zero contact with your systemsStrictly passive — no outbound packets to the target
- No sign-up, no email address requiredNo account, no cookie, no identifier stored
- The same engine as the platform, not a mock-upDiscovery code shared with the EASM module
Instant scan Exposure scan
What is your website's name? Root domain to scan
Scans are restricted to domains you own or are authorised to act for (terms of use). Nothing is sent to your machines.
0addresses linked to youaddress linked to youhostnames discoveredhostname discovered
0forgotten addressesforgotten addressnon-resolving names (NXDOMAIN)non-resolving name (NXDOMAIN)
0public sources responded just nowsources that responded
A few addresses we foundSample (4 of the total)
This is a preview. The platform runs the full scan — every address, what it exposes, the known and actively exploited flaws — then tells you what to do, in order, and touches nothing without your signature. touches nothing without your signature. The full analysis may therefore give a different score from this preview: it also counts known flaws. Sample-based preview. The full analysis (named inventory, ports and services, KEV/EPSS correlation, attack scenarios, timestamped PDF report) runs in the platform, under mandate.
The scan only reads public registers. It never connects to your machines. Five scans per minute per address. We keep the name tested for our statistics, never your IP address. Sources: CT logs (crt.sh, CertSpotter), subdomain.center, Wayback CDX, Google DoH. 5 scans/min and 30/day per address; results cached for 12 h; scanned domain logged, IP address never stored.
It doesn’t only happen to other people
They thought they were too small, or too well protected. Publicly recorded data breaches in France.
600+ data breaches recorded in France, and the list grows almost every day.
Well-known brands, health insurers, town halls, schools, SMEs: here are the latest organisations whose customer data ended up in the wild. Behind every name, thousands of people exposed to scams. Independent record of confirmed or claimed breaches (categories of data exposed per incident). Refreshed automatically every 6 hours from the public source.
Source: “Bonjour la fuite” public record (bonjourlafuite.eu.org). Names are listed as published by this source; NB Cyber Security has no connection with these organisations.
What we do
See, understand, act. In that order. Passive discovery, dual derivation, governed action broker.
Just three things, but done all the way. The rest is noise that people sell you at a high price. Three capabilities, each backed by an invariant verified by negative penetration tests on a real PostgreSQL database.
01
What an attacker sees of youExternal attack surface
We look at your business from the street, through the eyes of someone who wants to get in. Without touching anything, without breaking anything. Above all, we find what you have forgotten: the server a contractor set up three years ago, the address still lying around in your name. Strictly passive reconnaissance: Certificate Transparency logs, public subdomain records, web archives, public DNS. Five independent sources, no packets directed at the target — so no mandate required, and nothing to break.
02
The same fact, told two waysDual-Lens — pure derivation
One incident, two accounts: what it means for your business, and what needs fixing technically. The same figures on both sides. Nobody rounds things off to reassure you — it is exactly the button you just used. A business reading and a technical reading derived from a single fact by a pure function. No divergence possible: one source dataset, two vocabularies. Every figure shown in the executive reading is present in the technical reading.
03
Nothing moves without your signatureA0 → A4 action broker
Blocking an address, isolating a machine, cutting off access: every step is proposed, explained, then waits for your approval. Destructive actions are always refused, even if you insist. And everything leaves an append-only record. Five policy levels. A4 — destructive or irreversible — refused without exception, including via an AI tool. A2/A3 require a successful dry run. The intent fingerprint is recomputed before the order is issued: if it has changed, the approvals are void.
Our method
Four steps, and no magic promises. Four steps, each instrumented and provable.
01
We draw the mapInventory & perimeter discovery
What you own, what it is used for, and what stops if it goes down. Many businesses discover machines here that nobody even knew existed any more. Typed asset inventory, inter-asset relationships with tenant-scoped foreign keys, multi-source external discovery. Every host carries its provenance: a finding without a source does not stand up in an adversarial review.
02
We sort by what is actually being attackedKEV / EPSS prioritisation, not CVSS
There are official lists of flaws known to be in use right now. That is what we work on — not the four hundred red lines nobody reads. Correlation of CISA KEV (observed exploitation) and EPSS (30-day probability). An unexploited CVSS 9.8 comes after a 7.5 listed in the KEV catalogue: CVSS measures the severity of a successful exploitation, not its likelihood.
03
You decide, we carry it outMandate, quorum, controlled execution
We propose an action and tell you what it changes, how long it lasts and how we roll it back. You sign or you refuse. Without you, nothing happens. Mandate checked at execution time: status, signature, expiry, time window, scope, quotas. The target's criticality is re-read from the database, never taken from the requester. An approver who has lost their role no longer counts.
04
We leave you the means to prove itVerifiable chain of evidence
In front of an insurer, an auditor or a judge, you don’t say “we did what was needed”: you show it, dated and verifiable. Hash chaining under a transactional advisory lock, per client space. Mutation and truncation forbidden by trigger, even for the table owner. Full chain verification endpoint.
The founder
Najib Bredaa
President · NB Cyber Security — Advanced System
“Most businesses don't get caught out for lack of tools. They get caught out because nobody ever explained to them what they were risking, in plain language, without trying to sell them something along the way.” “A security tool that cannot say where a piece of information came from will not survive the first adversarial review. We built the opposite: every finding cites its source, every decision cites its mandate, every execution leaves proof.”
When we don't know, we write “we don't know”. Never “everything is fine”. A silent source returns “undetermined”, never “low”. Missing data is not good news.
The principle we never compromise on Uncertainty invariant — effect_unknown ≠ failed
Pricing
One price, all-inclusive, known in advance. Single subscription: full platform, no usage-based billing.
The whole platform, for your whole business: monitoring of what you expose, every risk explained simply, the action plan in order, the PDF reports and the evidence ledger. No hidden extras, no pricing “based on the number of alerts”. Full access to all modules: passive discovery (EASM), dual reading, A0 → A4 action broker, chain of evidence, PDF reports. No billing per alert, per scan or by log volume.
Monthly
The full platformPlatform · monthly billing
€390 incl. VAT per month
That is €325 excl. VAT per month.
- What a hacker can see of your business, monitored continuously.Continuous passive discovery of the exposed surface, KEV / EPSS prioritisation.
- Every risk explained twice: for you, and for your IT person.Dual reading derived from a single fact, figure parity tested.
- A full PDF report with every analysis, with an action plan in order of priority.Paginated PDF report: scenarios, KEV / EPSS vulnerabilities, 7 / 30 / 90-day plan, NIS 2 reading.
- Nothing is done at your company without your signature, and everything is recorded.Action broker under mandate, quorum, append-only chain of evidence.
- An assistant that answers your questions, in 6 languages, hosted in France.Local AI assistant (open model, server in France), NVIDIA backup at peak times, with no access to data and no decision-making power.
You remain the owner of your data and your records.
Choose monthlySubscribe monthly
Annual · best price
The full platform, by the yearPlatform · annual billing
€3,000 incl. VAT per year
That is €250 incl. VAT per month (€2,500 excl. VAT per year): €1,680 saved, more than four months free.
- Exactly the same full platform, with no limits at all.Same functional scope as the monthly plan.
- Twelve months of monitoring: your evidence ledger covers the whole year.Continuous 12-month chain of evidence, admissible with an insurer.
- A fixed, known security budget for the financial year.One annual invoice, no variables.
The price of two to three consultant days, for a whole year of monitoring.
Choose annualSubscribe annually
Before you pay anything: a 15-day free trial, no bank card required. I already have a code · Request a code · Need us to handle it for you? Najib Bredaa and his network of experts can step in on a quote basis.
What it's worth: prices charged elsewhere
To get separately what the platform brings together, here is what businesses in France pay today. Public prices observed in 2026, excluding VAT unless stated otherwise.
| Equivalent service | Market price | With the platform |
|---|---|---|
| Software to monitor what you expose on the Internet (foreign vendor) | $299 to $499 per month | Included, hosted in France |
| Part of the work of an external security manager: inventory, risk triage, action plan, follow-up (2 days per month) | €1,400 to €2,400 excl. VAT per month | Included, automated and explained |
| NIS 2 compliance support | €15,000 to €80,000 | Sealed pre-assessment + NIS 2 reading in every report |
| One-off external penetration test | €4,000 to €15,000 excl. VAT per test | Not included: the platform tells you where to run one, and keeps the proof |
The first two lines alone, at market pricenearly €20,000 excl. VAT per year, at the very least
The NB Cyber Security platform€3,000 incl. VAT per year
Sources (October 2026): penetration tests — Kolonell; daily rate of a part-time security manager (€700 to €1,200 excl. VAT) — daily rate simulator; monitoring software (Intruder Cloud and Pro plans) — Capterra; NIS 2 compliance — Ayi NEDJIMI Consultants. Orders of magnitude, to be confirmed by quote.
Trial
One code, fifteen days, your business under the microscope. Trial access: code valid for 15 calendar days on all your devices, immediate access to the full Command Center and the passive analysis.
No sales demo: you try everything, right away. As soon as you enter your code, the full management platform opens (dashboards, incidents, mandates, action broker, chain of evidence) on a demo company that is already filled in, with no email or password to create. Whenever you like, your space also analyses your own website: green, amber or red light, actions in order, a full 20-page report. Nothing is changed on your side: we read public sources and visit your website like an ordinary visitor. Trial space: full non-intrusive analysis of the domain (public sources + HTTPS visit of home pages, 5 per day), A–E grade, 7/30/90-day remediation plan, printable paginated report. Immediate entry into the Command Center (demo tenant, owner role; only the founder console remains closed) and real status of the arsenal's 50 capabilities. Access expires on its own at the end of the 15 days, with no renewal and no billing.
€0no bank cardno payment method requested
15days of free trialautomatic expiry, non-renewable
0commitment requiredautomatic expiry, nothing to cancel
Activate access
Enter your trial code
Have you received a code from Najib Bredaa by email or text message? Enter it here. Format: NB-XXXX-XXXX, or your partner demo code.
Open my space →
As soon as you enter it, everything opens: the full platform, the analysis of your website and the report, for 15 days. No email, no password to create. Your code remains valid for its whole duration, on all your devices. Already activated? Type it in again, or go back to your space.
No code yet? Request one in a minute.
First conversation
Start by finding out where you stand. External exposure scan, no commitment.
We look at what can be seen of your business from the Internet and give you a document you can actually read. It is passive: we don't touch any of your machines. You will then know whether you need us. Passive reconnaissance of your perimeter, KEV/EPSS correlation, attack scenarios inferred by deterministic rules, score broken down line by line. Frozen, timestamped, non-rewritable report.
Where we stand
Five things we refuse to tell you. Five deliberate breaks with the norm, each backed by a verifiable technical constraint.
The cybersecurity market thrives on fear and eighty-page reports. We take the opposite view on five points, and we put it in writing. Explicit positioning on five axes: executive accountability, determinism of the decision path, supply-chain (pivot) targeting, operational prioritisation, legal admissibility of evidence.
Break 01 · Governance
The end of impunity
If your system goes down tomorrow, the insurer and the judge won't ask which software you bought. They will ask who signed what.
Business leaders can no longer hide behind their IT provider: they are personally accountable. We don't sell antivirus software; we protect the decisions of the executive committee.The action broker (A0 → A4) and the double quorum produce the governance trail: no critical decision without control, no execution without a signed mandate, with status, scope and expiry checked in the database.
Break 02 · Engineering
The opposite of “magic AI”
In a crisis, handing your defence over to a probabilistic algorithm is an act of faith, not security.
An artificial intelligence that gets it wrong in the middle of an incident can shut down your production by mistake and make the crisis worse. With us, there are no automatic decisions.Zero language models in the decision loop: formal rules, deterministic code, SHA-256 fingerprint of the intent, mandatory dry run, human countersignature. The model is a drafting tool, never an authority.
Break 03 · Targeting
You are the back door
Modern conflicts no longer strike the fortress head-on: they go through its subcontractors.
If you hold a strategic contract, you are a stepping-stone target. We close the doors your providers forgot three years ago.Strictly passive discovery: Certificate Transparency logs, historical DNS, web archives, exposure records. An orphaned subdomain or an abandoned certificate is a beachhead — it is identified without a single packet being sent to your machines.
Break 04 · Prioritisation
An end to security theatre
An audit that gives you 300 urgent priorities doesn't help you; it just shifts the responsibility off itself.
We don't fix what might happen in theory: we deal with what attackers are exploiting today.Correlation of CISA KEV (observed exploitation) and EPSS (30-day exploitation probability). An unexploited CVSS 9.8 comes after a 7.5 listed in the KEV catalogue: CVSS measures the severity of a successful exploitation, not its likelihood.
Break 05 · Evidence
Your weapon against disputes
Saying “we were protected” is worth nothing. Showing it with an append-only ledger, sealed by a cryptographic fingerprint, dated and verifiable: that is what counts.
Insurers look for a lack of due diligence so they can refuse to pay out. We give you what you need to answer them, dated and verifiable.Hash chaining under a transactional lock, per client space. Mutation and truncation forbidden by trigger, even for the table owner. Full chain verification endpoint, replayable by a third party.
In one sentence
The defensive governance system
We are not yet another anxiety-inducing dashboard. We are the defensive governance system that helps business leaders steer and document their decisions in the face of operational and financial risk.
A single point of contact, a sovereign platform, a record that stands up legally. The rest are tools you can install yourself for free — and that nobody orchestrates.Execution sovereignty: hosted in France, no dependency on a foreign cloud provider in the decision path, auditable open foundation, a single declarative policy enforced at every level.
The arsenal
Fifty capabilities. And above all, what makes them usable. 50 sovereign capabilities, orchestrated under an action policy.
Anyone can install these tools for free. What is hard — and what we sell — is getting them to speak with one voice, sorting out what matters, and never touching anything on your side without your written consent. The foundation of each module is vetted: open licence, actively maintained project, no restrictive licence. The detailed composition of the foundation is provided under a non-disclosure agreement. The status of each module shows its action level in the broker.
Quadrant 01 · Passive reconnaissance · A0/A1
What an attacker sees of you, without us touching it
We look at your business from the street, through the eyes of someone who wants to get in — without breaking anything, without touching anything. What we find is mostly what you have forgotten. Certificate Transparency logs, public subdomain records, web archives, public DNS: five independent sources, no packets directed at the target. No mandate required, nothing to break.
Quadrant 02 · Dual-Lens engine · pure function
The same fact, told two ways
One incident, two accounts: what it changes for your business, and what needs fixing. The same figures on both sides — it is the button you just used. A business reading and a technical reading derived from a single fact by a pure function. No divergence possible: one dataset, two vocabularies, figure parity tested.
Quadrant 03 · Quorum matrix · A2/A3
Two signatures, never one
Before any serious action, two different people must say yes — and the person asking cannot approve their own request. Quorum bound to the intent fingerprint: if it changes, the approvals become void. An approver who has lost their role no longer counts.
Quadrant 04 · Unbreakable rule · level A4 refused
What we rule out by design
An exploitation framework, a command relay, an adversary emulator, a lateral-movement tool or a pivoting tunnel are all used to break into someone’s systems and move around inside them. A platform that monitors your business around the clock has no reason to carry them — and your insurer will ask you about it. Exploitation frameworks, command-and-control (C2) relays, adversary emulation, directory-based lateral movement and pivoting tunnels are excluded, whatever package would supply them: a command channel inside a multi-tenant defensive platform creates legal liability, not a feature, and contradicts the A4 invariant. Offensive auditing remains a separate trade, under a separate mandate.
3already in the platformnative capabilities
28usable without touching anything on your sideconnectable A0/A1 — read-only
14usable with your signatureconnectable A2/A3 — mandate required
5deliberately refusedoffensive — outside the defensive scope
Why we refuse five capabilities. An exploitation framework, a command relay, an adversary emulator, a lateral-movement tool or a pivoting tunnel are all used to break into someone’s systems and move around inside them. They are good tools — in the hands of an authorised audit team, within a written framework. A platform that monitors your business around the clock has no reason to carry them, and your insurer will ask you about it. We would rather settle the question before they ask it. A deliberate exclusion of offensive tooling. Exploitation frameworks, command-and-control (C2) relays, adversary emulation, directory-based lateral movement and pivoting tunnels are excluded by design, whatever package would supply them. A multi-tenant defensive platform carrying a command channel creates legal liability and an attack surface — not a feature — and contradicts the A4 invariant. Offensive auditing remains a separate trade, under a separate mandate.