Skip to content
Theme

NewKSC · NIS2 · KRI · GDPR · DORA · ISO 27001

Network visibility from day one. Evidence for the auditor, every day.

KSC compliance and network visibility from day one: no integration project, no data leaving the organisation. Gateway detects attacks and keeps the KSC incident register with statutory deadlines; One collects evidence and keeps documentation current. Both run in the organisation's own server room, also offline.

  • On-premises
  • Works offline
  • Polish-first
  • No telemetry
bersec · eventslive
  • highGatewayDCSync from 10.0.4.17 to DC01: detected by rule
  • highGatewayKerberoasting: 42 TGS requests from one workstation
  • mediumOnePassword policy: change proposed for approval
  • OKOneMFA evidence counted for KSC, ISO 27001, KRI and GDPR
  • mediumGatewayPESEL sent to an AI service: value masked
KSC readiness62%

KSC / NIS2KRIGDPRDORAISO/IEC 27001AI ActNIST CSF 2.0S46ISMSBCP / DRPDPIA

Two products, one philosophy

Network visibility and evidence for the auditor. On-premises.

Each product works on its own. Together they cover the path from an event on the wire to a document that passes the audit.

KSC compliance sensor

Sees more. Explains in Polish. Data stays in-house.

Works on a traffic copy (SPAN/TAP), with no agents and no integration project. Detects Active Directory attacks and risky protocols, keeps the KSC incident register so statutory deadlines are not missed, and signs every piece of evidence for the auditor.

Gatewaysensor-01 · traffic copylive
SPAN / TAPGATEWAY
  • 09:30:12DCSyncREJ-12 → DC-01high
  • AD attacks detected from minute one, no learning period
  • KSC register with 24 h / 72 h / 1-month clocks, so deadlines are not missed
  • Polish DLP: PESEL, NIP, REGON, IBAN with checksums
  • Map of AI tool usage by department and account
Explore Gateway
Compliance evidence and documentation

Audit-ready. Every day.

Compliance as a daily state, not a yearly project. Bersec One collects evidence, keeps compliance documents in step with it and shows the gap to audit for KSC, KRI, GDPR, DORA and ISO 27001, with no systems to connect.

Audit readiness

proven 52% · declared 22% · missing 26%

74%
  • KSC74%
  • KRI81%
  • GDPR68%
  • DORA57%
  • ISO 2700163%
  • First result from a spreadsheet: gap map and readiness score, target within 7 days
  • A licence instead of consultant days, with 19 document templates in Polish and English
  • Declarations checked against the organisation's own systems
  • Audit rehearsal with evidence citations, ready for the auditor
Explore One

Benefits

Less financial risk, less manual work, fewer IT projects.

Concrete figures from the product documentation and the Polish National Cybersecurity System Act (KSC). Estimates and targets are marked.

Finance

  • up to EUR 10mfines for an essential entity

    Or 2% of annual revenue, whichever is higher. Important entity: up to EUR 7m or 1.4% of revenue.

    KSC Act, art. 73(3) and (4)

  • up to 300%of the head of the entity's pay

    A fine can be imposed personally on the head of the entity. In a public entity: up to 100% of pay.

    KSC Act, art. 73a

  • Fixed pricea licence instead of consultant days

    New regulations and templates come with the licence, with no new engagement. Knowledge stays in the system instead of leaving with the consultant.

    Bersec One

  • 36 monthsprice guarantee

    For orders placed by 31.12.2027 in the first-deployment programme. The decision follows a 30-day pilot.

    Bersec Gateway

Operations

  • 24 hto the first-day report

    Device inventory, detections, outdated protocols and an AI usage map after the first day on the traffic copy.

    Bersec Gateway

  • 3 deadlinesKSC clocks run automatically

    24 h, 72 h and 1-month clocks account for public holidays and DST (115 test cases), so deadlines are not missed. Draft notifications in PDF and DOCX, with fields for S46.

    Bersec Gateway

  • up to 85%less work on documentation

    A complete set of ISMS, risk assessment, GDPR and business continuity documentation is ready 50-85% faster than without a tool.

    Bersec estimate, measured in pilots

  • 7 daysto the first result

    A gap map and a readiness score for the selected regulations, from a spreadsheet alone. A full set of draft documents in 30 days.

    Bersec One targets

  • No weekof collecting evidence before an inspection

    An evidence export for the auditor is available at any time. One reading, e.g. MFA, counts for KSC, KRI, GDPR and ISO 27001 at once.

    Bersec One

IT

  • 0 agentsand no network changes

    Gateway works on a traffic copy (SPAN/TAP) and sends nothing into the production network. A sensor failure does not stop the network.

    Bersec Gateway

  • 1 virtual machineinstead of new hardware

    The Start edition runs on an existing server: 8 vCPU, 32 GB RAM, no GPU.

    Bersec Gateway

  • No integrationto start

    Bersec One starts from a spreadsheet and a quick self-assessment. Connectors are optional and read-only.

    Bersec One

  • Existing SIEMand domain accounts

    Event export to the SIEM already in place (tested: Vector, Wazuh, Graylog, Filebeat) and sign-in with domain accounts, so no new identity silo.

    Bersec Gateway and Bersec One

  • Offlineno cloud, no telemetry

    Both products run in the organisation's own server room, also without internet access. Updates are signed and can arrive on removable media.

    Bersec Gateway and Bersec One

Fine amounts: articles 73 and 73a of the Polish National Cybersecurity System Act (Journal of Laws 2026 item 252). Fines can be imposed from 3.04.2028.

Why Bersec

Built for Polish organisations with no time for an integration project.

No data leaves the organisation: there are no outbound connections unless the Administrator enables them. Works in air-gapped networks; updates arrive on signed media.

Gateway needs only a mirror port; One needs a spreadsheet and a quick self-assessment. No integration project to start. Connecting systems is optional and read-only.

A signed, tamper-evident daily evidence chain. Every export includes an independent verification tool, so the auditor can check the evidence without taking it on trust.

Interface, reports, notification drafts and documents in Polish. Legal citations come from a local, versioned library of legal texts.

Rules and statistics detect, people decide. The local model only describes and selects template clauses, and it is off by default.

Together

From a packet on the wire to evidence in the documentation.

Gateway sees what happens in traffic. One turns evidence into documents and a readiness score. Connecting the two is planned; each already works on its own today.

  1. Network traffic

    Copy from a SPAN/TAP port

  2. Gateway

    Detections, KSC register, evidence

  3. One planned

    Documents, readiness, audit rehearsal

  4. Auditor

    Read-only panel, export

Bundle: incidents, AI usage map and personal-data flows from Gateway in Bersec Oneplanned

How it works

A first result in days, not months.

  1. step 01Day 0

    Connect a traffic copy or upload a spreadsheet

    Gateway: a virtual machine and a mirror port. One: a wizard, CSV/XLSX import and a quick yes / partly / no self-assessment. No integration project.

  2. step 0224 h · target: 7 days

    First-day report and gap map

    Device inventory, detections, legacy protocols and the AI map. A readiness score for every selected regulation.

  3. step 03Every day

    Ready every day

    Daily readings turn declarations into evidence. Changes in the organisation's systems propose document updates, and a person approves them.

Verifiable security

A security tool must be secure itself.

No need to take our word for it. The organisation's security team can verify each of these properties.

SEC-01

Signed evidence chain

Daily root signed with Ed25519; every change is detectable.

verifiable
SEC-02

Two-step verification

TOTP is mandatory; approvals require re-authentication.

verifiable
SEC-03

Encrypted secrets

AES-256-GCM for credentials, Argon2id for passwords.

verifiable
SEC-04

No telemetry

The “Data and connections” panel lists every outbound connection.

verifiable
SEC-05

Signed updates

Licences and updates as signed offline files, with rollback.

verifiable
SEC-06

SIEM export

Syslog RFC 5424/3164, CEF, JSON Lines over TLS, token-based API.

verifiable

By the numbers

Concrete, verifiable, counted.

  • 14/14

    attacks detected

    synthetic corpus

  • 16/16

    benign cases without an alert

    synthetic corpus

  • 24 h

    to the first-day report

    Gateway

  • 0

    integrations needed to start

    Gateway and One

  • 180

    controls in the library

    One

  • 2,008

    citable legal passages

    One, local library

  • 19

    document templates PL/EN

    One

  • 115

    KSC deadline test cases

    Gateway

Calculator

How much does Bersec save over three years?

Savings on compliance documentation and inspection preparation, next to the KSC fine exposure. Every value can be changed.

Who prepares the documentation today

Example value, editable

Entity type under the KSC Act

Savings over 3 years

up to PLN 225,000

from PLN 81,000 · documentation + inspection preparation

Compliance documentation

up to PLN 198,000

50-85% less work on the full document set

Inspection preparation

PLN 27,000

evidence ready at any time, over 3 years

Maximum KSC fine per entity

up to PLN 42.5m

or 2% of annual revenue if higher. The head of the entity can also be fined personally: up to 300% of pay (public entity: 100%).

Bersec estimate, measured in pilots: a complete set of ISMS, risk assessment, GDPR and business continuity documentation takes 50-85% less work with Bersec One, and evidence for the auditor is available without collecting it by hand before an inspection. Three years match the KSC audit cycle and the price-guarantee period. Daily rates and the EUR rate (4.25) are examples. Fine caps: KSC Act art. 73 and 73a. The result is not an offer or a guarantee.

Quote

An individual quote, fitted to the organisation.

The price depends on the scale and scope of the deployment. A quote follows a short conversation about the organisation's needs.

or write to kontakt@bersec.pl
  • What the price depends onThe number of seats, network throughput, the regulations covered and the number of entities served.
  • What the licence includesAn annual licence per organisation includes regulation, rule and template updates and support on working days.
  • A pilot first30 days on the organisation's own data. It ends with an export, data deletion and a signed deletion certificate.

Bersec Gateway first-deployment programme: for orders placed by 31.12.2027 the price is guaranteed for 36 months.

FAQ

Questions we hear most often.

Does any data leave the organisation?

No, unless the Administrator enables it. Both products run in the organisation's own server room, including air-gapped networks. The only optional outbound connection in Bersec One is the Microsoft Graph source (Microsoft 365 / Entra ID). Every connection is listed in the “Data and connections” panel.

Is an integration project needed?

No. Gateway delivers results from a traffic copy alone (SPAN port or TAP). Bersec One gives a first result from an asset spreadsheet and a quick self-assessment. Active Directory, CSV files and other sources are optional and read-only.

Does Bersec One guarantee compliance or certification?

No. The readiness score shows what is proven, what is only declared and what is missing. Compliance is assessed by an auditor or a supervisory authority. Legal content requires qualified review.

What role does AI play?

A supporting and optional one. Rules and statistics detect; people decide. The local model can describe incidents and select template clauses, but it never writes facts or approves documents. It is off by default.

Does Gateway submit notifications to CSIRT?

No. Gateway counts the 24 h / 72 h / 1-month deadlines and prepares drafts of the early warning, notification and final report (PDF/DOCX). The authorised person submits them in the S46 system.

Does Gateway replace a SOC, NDR or firewall?

No. Without a SOC it gives visibility and a KSC register from day one, and a partner SOC can provide 24/7 coverage. With a SOC it runs as a KSC sensor alongside existing tools and exports results to the SIEM already in place.

What does a pilot look like?

30 days on the organisation's own data; for large organisations, on a single network segment or limited scope. At the end, Bersec exports the register, deletes data and keys, and issues a signed Data Deletion Certificate.

When must the ISMS (SZBI) be in place?

It depends on the entity’s status. For entities covered on the day the amendment took effect (Dz.U. 2026 poz. 252): the ISMS by 3.04.2027 and the first audit of essential entities by 3.04.2028.

How much time and cost does Bersec save?

By Bersec's estimate, measured in pilots, a complete set of ISMS, risk assessment, GDPR and business continuity documentation takes 50-85% less work with Bersec One, and evidence for the auditor is available at any time. Bersec Gateway tracks KSC notification deadlines and drafts the notifications. The calculator on the site turns this into costs.

Start with a pilot

30 days on the organisation's own data. No risk.

Results on the organisation's own network and documents. At the end: export, data deletion and a signed Data Deletion Certificate.

kontakt@bersec.pl
I’m interested in

Book a demo or pilot

Bersec replies within one working day.