What Vardion includes
Every capability, by area.
Attack surface
- Asset discovery
- Vulnerability scanning
- Email and DNS checks
- Every sender using your domain, from DMARC reports
- Personal data in exposed data stores, counted and never kept
- Lookalike domains
- Leaked credentials
- Cloud and identity settings
- Software inventory on Linux, Docker and Windows
- Code dependencies in GitHub and GitLab
- Internal network check
- Known exploited and ransomware-linked flaws first
- Attack paths, mapped to MITRE ATT&CK and D3FEND
- Results imported from Tenable, Qualys, Defender, Nessus, OpenVAS and Burp
- Exposed AI
Compliance and reporting
- NIS2 applicability check and scope memo
- What applies, proposed from your scope memo
- A countdown to your submission dates with Greece's National Cybersecurity Authority (ΕΑΚ)
- ΕΑΚ gap analysis and self-assessment
- Appointment checks for the security officer the law requires (ΥΑΣΠΕ) and a quarterly report to the board
- Policy acknowledgement by every employee, with reminders
- One answer proposed across ΕΑΚ, ISO 27001, NIS2 and DORA
- The authority's gap analysis workbook imported
- KYA 1689/2025 article by article
- ISO 27001 Statement of Applicability, ISMS records and internal audits
- One group Statement of Applicability, proposing answers in every subsidiary
- Each framework with its version and the day its source was checked
- DORA register of information and filing package
- 16 policy drafts in Greek and English
- NIS2, DORA and GDPR reporting clocks, playbooks and exercises
- Risk and exception registers
- FAIR loss scenarios in euros
- Supplier register and grades
- Greek registry status for each supplier
- Privacy records
- Executive summary, board pack and PDF report
- Insurer proposal answers and customer questionnaires
- A public trust page you control
Access and operations
- Five roles and two-step verification
- Single sign-on by OpenID Connect, and SCIM with groups
- A workspace per estate or client
- Every subsidiary of a group side by side
- Scanning authorisation letter in Greek and English, signed in the console
- Assets, suppliers, risks and incidents imported from a spreadsheet
- Your brand on every page, document and email
- Tamper-evident audit log
- The hosted console, or your own server with Docker
Other frameworks
- IR (EU) 2024/2690
- PCI DSS v4.0
- NIST CSF 2.0
- CIS Controls v8.1
- SOC 2
- NIST SP 800-53
Integrations
- Wazuh
- Splunk
- SIEM collectors (JSON and CEF)
- Jira Cloud
- GitHub issues
- Slack
- Microsoft Teams
- MISP
- Webhooks
- MCP
Data sources
- AWS
- Microsoft Azure
- Google Cloud
- Cloudflare
- Microsoft 365
- Google Workspace
- Tenable
- Qualys
- Microsoft Defender
- Nessus
- OpenVAS
- Burp Suite
- GoPhish
- GitHub and GitLab repositories
- Software inventory from Wazuh agents
- WordPress plugin flaws from Wordfence