KSC compliance sensor
Sees more. Explains in Polish. Data stays in-house.
Network monitoring and a KSC incident register in one day, with no integration project and no data leaving the organisation.
- from connection to the first-day report
- 24 h
- integrations needed to start
- 0
- attacks detected (synthetic corpus)
- 14/14
- 09:30:12DCSyncREJ-12 → DC-01 · AD-DCSYNC-01AD attackinternalhigh
- 09:30:05AS-REP roastingUSG-GIN-02 → DC-01 · AD-ASREP-01AD attackinternalhigh
- 09:29:58TelnetADM-02 → SW-CORE · NET-CLEAR-03Risky protocolinternalmedium
- 09:29:51NTLM relaySERWIS-IT → DC-02 · NET-NTLMR-01AD attackinternalhigh
Detection basis: rule · no AI involved
TL;DR
What is Bersec Gateway?
Bersec Gateway is a KSC compliance sensor installed in the organisation's own server room. It detects Active Directory attacks and risky protocols on a traffic copy (SPAN/TAP) and keeps a KSC incident register with statutory deadlines. It suits KSC-regulated entities, with or without a SOC, runs on-premises, even offline, and delivers the first-day report within 24 h.
Benefits
Less financial risk, less manual work, fewer IT projects.
Concrete figures from the product documentation and the Polish National Cybersecurity System Act (KSC). Estimates and targets are marked.
Finance
up to EUR 10mfines for an essential entity
Or 2% of annual revenue, whichever is higher. Important entity: up to EUR 7m or 1.4% of revenue.
KSC Act, art. 73(3) and (4)
up to 300%of the head of the entity's pay
A fine can be imposed personally on the head of the entity. In a public entity: up to 100% of pay.
KSC Act, art. 73a
36 monthsprice guarantee
For orders placed by 31.12.2027 in the first-deployment programme. The decision follows a 30-day pilot.
Bersec Gateway
Operations
24 hto the first-day report
Device inventory, detections, outdated protocols and an AI usage map after the first day on the traffic copy.
Bersec Gateway
3 deadlinesKSC clocks run automatically
24 h, 72 h and 1-month clocks account for public holidays and DST (115 test cases), so deadlines are not missed. Draft notifications in PDF and DOCX, with fields for S46.
Bersec Gateway
IT
0 agentsand no network changes
Gateway works on a traffic copy (SPAN/TAP) and sends nothing into the production network. A sensor failure does not stop the network.
Bersec Gateway
1 virtual machineinstead of new hardware
The Start edition runs on an existing server: 8 vCPU, 32 GB RAM, no GPU.
Bersec Gateway
Existing SIEMand domain accounts
Event export to the SIEM already in place (tested: Vector, Wazuh, Graylog, Filebeat) and sign-in with domain accounts, so no new identity silo.
Bersec Gateway and Bersec One
Offlineno cloud, no telemetry
Both products run in the organisation's own server room, also without internet access. Updates are signed and can arrive on removable media.
Bersec Gateway and Bersec One
Fine amounts: articles 73 and 73a of the Polish National Cybersecurity System Act (Journal of Laws 2026 item 252). Fines can be imposed from 3.04.2028.
Who it’s for
Two kinds of organisation, one sensor.
Monitoring and a KSC register in one day
Municipalities, counties, county hospitals, important entities. One or two administrators, a firewall and antivirus, and obligations under the KSC act.
24/7 coverage via a partner SOC.
- Nobody sees traffic inside the networkAD attack detection from minute one, explained in Polish
- 24 h / 72 h / 1-month deadlinesRegister with clocks and document drafts with evidence, so no deadline slips
- The auditor asks about monitoring continuityDaily continuity proof, signed export with verifier
- Staff paste data into chatbotsAI usage map by department and account; PESEL in traffic (Full)
- Management needs a short briefWeekly report for management, quarterly for the auditor
A KSC sensor for an existing SOC
Central offices, large hospitals, utilities, essential entities. Gateway doesn’t compete with NDR or EDR: it runs alongside them as a sensor and KSC layer.
Recommended start: a 30-day pilot on a single network segment.
- AD attacks in east-west trafficAD and protocol detectors on the traffic copy, results to SIEM
- A vendor-independent KSC registerRegister, clocks, document drafts, evidence chain
- DLP for Polish identifiersFirewall-decrypted traffic mirror (ERSPAN/VXLAN/GRE/Geneve)
- No data shared with the vendorFully local; AD read-only with an explicit attribute list
- Run by an MSSP partnerMulti-tenant console, each organisation’s data separated
Detections
Detections that can be explained to an auditor.
Every alert points to the rule and the source events. No black box.
Rules, from minute one
9 / 9- DCSyncAD-DCSYNC-01
- KerberoastingAD-KERB-02
- AS-REP roastingAD-ASREP-01
- Pass-the-hashAD-PTH-03
- NTLM relayNET-NTLMR-01
- Lateral movementAD-LAT-04
- LLMNR / NBT-NS poisoningNET-LLMNR-02
- Kerberos user enumerationAD-KENUM-01
- SMBv1 and cleartext protocolsNET-SMB1-01
Detection basis: rule · no AI involved
Robust statistics, after 7 days of learning
baseline: 7 days- C2 beaconingdeviation +4.2σ
- DNS tunnellingdeviation +3.6σ
- Unusual outbound volumedeviation +5.1σ
- New foreign destinationsdeviation +2.9σ
KSC register
Statutory deadlines count themselves.
24 h, 72 h and one-month clocks counted per the act, including public holidays and DST changes, so statutory deadlines are not missed. The authorised person qualifies each incident with re-authentication.
- Drafts of the early warning, major-incident notification and final report (PDF/DOCX)
- 115 test cases for the deadline logic
- A person submits in S46; the product never submits on its own
Password hashes pulled from a domain controller (DCSync) by workstation REJ-12
- Early warning (24 h)Due: 08.10.2026, 09:30 CESTon time12:15left
- Incident notification (72 h)Due: 10.10.2026, 09:30 CEST⚠ deadline falls on a public holidayon time60:15left
- Final report (1 mo.)Due: 07.11.2026, 09:30 CETon time29 d 12 hleft
Polish DLP · Full package
A PESEL heading to a chatbot? Gateway sees it.
Recognises PESEL, NIP, REGON, IBAN, ID card and passport numbers with checksum validation. Values are never stored in clear.
- Receives firewall-decrypted traffic copies (ERSPAN, VXLAN, GRE, Geneve)
- AI usage map by department and account: ChatGPT, Gemini, DeepSeek, Ollama, MCP servers
- ChatGPT191.3 MBallowedhigh
- Gemini4667 kBoutside policyhigh
- DeepSeek251.9 kBoutside policyhigh
- Ollama1-not assessedheuristic
Ollama: local model inside the organisation's network (1 server)
Recognised by service name and address; volume is approximate, content is not read
Checksum validated · values never stored in clear
synthetic dataEvidence
Evidence that can be checked, not taken on trust.
A hash chain with a signed daily root and PCAP snippets. Every export includes the independent bersec-verify tool for Linux, Windows and macOS, so the auditor can verify it independently.
- Daily proof of monitoring continuity
- Warning when traffic reception stops
- Copy to the organisation's own WORM storage via export
- Block 098hash ccde…c21dprev f5c3…fcf8
- Block 099hash 3ee9…7747prev ccde…c21d
- Block 100hash 8265…2f11prev 3ee9…7747
- Block 101hash efd6…e9a1prev 8265…2f11
Visibility
The access that actually happened.
Named inventory
DHCP, Kerberos, NetBIOS, mDNS, LLMNR; vendor from MAC address.
Key systems
Who, over which channel, from where and when; after hours, bypassing PAM.
Vendor remote access
Register of 16 tools with approvals per tool and device.
Service accounts
Used from workstations, on many devices, dormant accounts, RC4/DES.
Foreign connections
Bundled local GeoIP database, no outside lookups.
Local models and MCP
Automations using AI, Ollama and MCP servers on the network.
Integration levels
Start from zero. Literally.
Traffic copy only
- Needed
- SPAN port or TAP, a virtual machine
- What works
- Inventory, AD detections, protocols, AI map, KSC register, reports
Supplementary data
- Needed
- A departments CSV file
- What works
- Departments in inventory, reports and the AI map
Active Directory, read-only
- Needed
- Read-only account, LDAPS
- What works
- Privileged groups, domain controllers, domain sign-in; no password hashes
At every level, nothing leaves the organisation. Level 0 is enough for a pilot.
Integrations
Fits the tools already in place.
Console
Inside the Gateway console.
Quote
An individual quote, fitted to the organisation.
The price depends on the scale and scope of the deployment. A quote follows a short conversation about the organisation's needs.
- What the price depends onThe number of seats, network throughput, the regulations covered and the number of entities served.
- What the licence includesAn annual licence per organisation includes regulation, rule and template updates and support on working days.
- A pilot first30 days on the organisation's own data. It ends with an export, data deletion and a signed deletion certificate.
Bersec Gateway first-deployment programme: for orders placed by 31.12.2027 the price is guaranteed for 36 months.
FAQ
Questions about Bersec Gateway.
How is Bersec Gateway deployed?
Bersec Gateway is installed in the organisation's own server room, on a virtual machine or a server, and connected to a mirror port (SPAN) or TAP that supplies a traffic copy. It works only on that copy and needs no agents on workstations. Docker Compose, Helm/Kubernetes and DEB packages are also available.
What attacks does Bersec Gateway detect?
From minute one, rules detect Active Directory attacks: DCSync, Kerberoasting, AS-REP roasting, pass-the-hash, NTLM relay, lateral movement and LLMNR/NBT-NS poisoning, plus SMBv1 and cleartext protocols. After 7 days of learning, robust statistics also flag C2 beaconing, DNS tunnelling and unusual outbound volume. Every alert points to its rule and source events.
How does Bersec Gateway count KSC reporting deadlines?
The KSC register in Bersec Gateway runs 24 h, 72 h and one-month clocks counted per the act, including public holidays and DST changes. The authorised person qualifies each incident with re-authentication, and Gateway prepares document drafts (PDF/DOCX) with evidence. The deadline logic is covered by 115 test cases.
What data does Polish DLP in Bersec Gateway recognise?
Polish DLP in the Full package recognises PESEL, NIP, REGON, IBAN, ID card and passport numbers in traffic, with checksum validation. Values are never stored in clear. Encrypted traffic is analysed on a copy decrypted by the organisation's firewall (ERSPAN, VXLAN, GRE, Geneve).
How can Bersec Gateway evidence be checked for alteration?
Every Bersec Gateway export includes the independent bersec-verify tool for Linux, Windows and macOS, which checks the hash chain and its daily root signed with Ed25519. Any change to the evidence is detectable. For long-term retention, evidence can be copied via export to the organisation's own WORM storage.
What hardware does Bersec Gateway need?
The Start package runs on a virtual machine with 8 vCPU and 32 GB RAM, up to 1 Gb/s; Full S on a server with an NVIDIA L4 GPU, up to 2 Gb/s; Full M on 32 cores, 128 GB RAM and 48 GB GPU memory, up to 20 Gb/s. Throughput is a design target, being confirmed by tests.
Does Bersec Gateway work without internet access?
Yes. Bersec Gateway works in air-gapped networks and makes no outbound connections unless the Administrator enables them. Rule and model updates and licences arrive as signed offline files that can be rolled back, and the GeoIP database is bundled locally.
How is Bersec Gateway priced?
Bersec Gateway is quoted individually, based on the number of seats, network throughput and the modules selected. The licence is annual, per organisation, and includes rule and model updates and support on working days. For orders placed by 31.12.2027 the price is guaranteed for 36 months. A quote follows a short conversation.
Start with a pilot
30 days on the organisation's own data. No risk.
Results on the organisation's own network and documents. At the end: export, data deletion and a signed Data Deletion Certificate.
kontakt@bersec.pl