EterShield — The Complete Guide

For years, cybersecurity and privacy regulation was seen as a problem for large organisations. GDPR, in 2018, was the first sign that this was changing: all organisations that process personal data of European citizens were covered, regardless of size. But it was between 2022 and 2025 that regulatory pressure became truly democratised.

NIS2 extended cybersecurity obligations to many more sectors. DORA imposed stringent requirements on the financial sector, including IT suppliers. The EU AI Act introduced obligations for organisations using high-risk AI systems. CSRD made sustainability reporting mandatory for a growing number of companies. In Portugal, Decree-Law 125/2025 transposed NIS2 with CNCS as the national authority — and it is the resulting Cybersecurity Legal Regime (RJC), not the directive, that Portuguese organisations must demonstrate. It is joined by the General Regime for the Prevention of Corruption (RGPC, DL 109-E/2021), which requires a compliance programme from every entity with 50 or more employees, and by the Data Act (Regulation (EU) 2023/2854), applicable since 12 September 2025 to manufacturers of connected products and providers of cloud and data-processing services.

Many organisations respond to regulatory pressure in the most obvious way: they hire a consultant, conduct an assessment, produce documentation, and pass an audit. A year later, the consultant is gone, the person who coordinated the process has moved to another company, and the organisation starts from scratch.

This is the problem EterShield was designed to solve. It is not a problem of lacking tools — it is a problem of knowledge that disappears. Every decision taken, every risk assessed, every policy approved should be a growing asset of the organisation.

The market has responded with solutions at the extremes: Enterprise GRC (OneTrust, IBM OpenPages) with prices of €50,000–€500,000 annually and implementations taking months; or isolated tools (Eramba, spreadsheets) with no integration or AI. The gap is clear: no affordable solution preserves organisational knowledge, integrates multiple European frameworks in Portuguese, and uses contextual AI — all in a single product for SMEs.

A vCISO (Virtual Chief Information Security Officer) externalises the function of strategic security leadership. A vCISO platform is the technological evolution: software that structures, automates, and systematises the functions of a CISO in an interface that any IT or compliance manager can operate — without being a security specialist.

EterShield is a vCISO platform, but goes further: it is an organisational security knowledge management system that collects and structures everything the organisation knows about its own security, uses AI to transform that knowledge into actionable assessments and policies, and accumulates value over time.

• Knowledge that stays — unlike an external consultant, when the person who led the certification leaves the company, the knowledge remains in the platform with all its justification.
• AI that reads the real context — before suggesting a policy or analysing a gap, the AI reads the organisation's Knowledge Base. A logistics company receives different suggestions from a health clinic.
• European regulatory by design — NIS2, DORA, GDPR, EU AI Act were designed for the European context. EterShield was built from the start in Portuguese, with data in the EU, with ANACOM and CNCS as references.
• Single scope for a complete IMS — ISO 27001, ISO 9001, ISO 45001, GDPR, CSRD integrated in a single platform, eliminating silos and data duplication.
• Progressive modularity — pay for what you use — not every organisation needs everything at once. The base plan includes the GRC core (compliance frameworks, risk, TPRM, audits); the operational modules (ISO 9001, OH&S, HR Security, ESG/CSRD, BCM, Fleet, Facilities, NetworkAlerts) and additional frameworks are activated individually, as the organisation grows or when a specific regulatory requirement arises. There is no need to upgrade the plan to access a single additional module.

Instead of going through 93 ISO 27001 controls manually, the user activates the AI Gap Analysis. Based on the organisation's profile and accumulated Knowledge Base, the AI automatically identifies the most likely gaps, suggests remediation priority, and proposes response texts for each control. The compliance score (0–100%) updates in real time by category and by framework.

Control exceptions with expiry: when a gap cannot be closed immediately, the organisation can record a control exception — a temporary risk acceptance with justification and an expiry date. When an approved exception expires without renewal, the platform automatically reopens the underlying gap and notifies the requester, so a stale risk acceptance never becomes permanent by omission. The expiry sweep runs daily inside the platform's in-process scheduler.

An ISO 27001 control can simultaneously satisfy NIS2 and DORA requirements. An organisation working ISO 27001 in parallel with NIS2 and DORA can have 60–70% of DORA controls already answered by the work done on ISO 27001. No duplicate questions, no redundant effort.

The policy repository generates contextualised drafts — not generic templates. Based on the organisation's profile, sector of activity, and active frameworks, the AI creates a policy that references the specific reality of the company. Full versioning with revision history, approvals, and next scheduled review.

A group with several companies does not always need the same framework in all of them: RJC may apply to three companies and TISAX to just one. Each framework can be contracted for the whole group or per entity. A framework contracted per entity only appears in the companies that contracted it — in assessments, in maturity-index coverage, in dashboard alerts and in the context used by the AI — and its price is agreed entity by entity.

The RGPC framework (Portuguese DL 109-E/2021) was built from the text of the law: 31 controls, one per independently sanctioned duty, with priority derived from the fine bracket. It comes with the code of conduct as a dedicated policy type and 16 corruption risks in the risk library, anchored in the offences listed in Art. 3. Management of the Risk Prevention Plan, the Compliance Officer and conflict-of-interest declarations is under development.

In Portugal, the obligation does not arise directly from NIS2. It arises from the Cybersecurity Legal Regime (RJC) — Decree-Law 125/2025 of 4 December, which transposes Directive (EU) 2022/2555 into Portuguese law. This is the instrument the competent authority enforces, and the one against which an organisation is assessed. Anyone who has already worked through NIS2 has part of the road behind them, not all of it: the RJC adds obligations of its own, deadlines of its own, and a registration cycle the directive never describes.

EterShield treats the RJC as a first-class framework, not as an alias for NIS2. It carries 126 control objectives derived from the statute — governance duties (art. 25), cybersecurity risk management (arts. 26 to 29) and the minimum measures of art. 27 read together with Annex III of Regulation 756/2026 — applicable to the essential and important entities in the critical and highly critical sectors listed in Annexes I and II to the decree-law.

MyCiber — the registration and qualification cycle. Meeting the technical measures is not enough: the entity must exist in the regulator's eyes. MyCiber is the electronic platform of the Portuguese National Cybersecurity Centre (CNCS) where that cycle takes place, and EterShield tracks it with 13 control objectives under Chapter II (arts. 6 to 19) of Regulation 756/2026 and arts. 8 and 35 of the RJC: initial self-identification, follow-up of the qualification, definitive registration, permanent updating of the data, and notification of the security officer.

The frameworks cover the same ground in layers: cross-mapping means a piece of evidence uploaded once answers the RJC control and the QNRCS control at the same time. In Portugal the working framework is the RJC; NIS2 remains as the European reference and, because the two are mutually exclusive, is not active at the same time as the RJC for the same client. The work is done once; the demonstration is made several times.

Technical Instruction 01/2026 of the Portuguese National Cybersecurity Centre, approved on 24 June 2026 under art. 20(1)(h) and art. 38 of the RJC, sets the requirements for identifying vulnerabilities and disclosing them in a coordinated manner. It defines what is expected of each of the three parties: whoever identifies the vulnerability, the manufacturer or supplier of the vulnerable technology, and the CNCS as coordinator.

EterShield has a dedicated framework with 21 control objectives covering the full cycle: publication of the disclosure policy and point of contact, intake and triage of reports, response and remediation deadlines, communication with the reporter, and an auditable record of every step — which is, in practice, what you present if compliance is ever questioned.

Most risk tools stop at coloured matrices. EterShield quantifies risks financially using the FAIR model (Factor Analysis of Information Risk) with Monte Carlo simulation: 10,000 simulations produce an annual expected loss (ALE) distribution with P10, P50, and P90 percentiles in euros.

FAIR quantification requires parameters that few IT managers know how to estimate. The AI proposes frequency and magnitude parameters with justification based on benchmarks from DBIR (Verizon), ENISA, and CNCS, presenting a TransparencyBadge with the complete reasoning and sources used.

For each implemented security control, EterShield automatically calculates the risk reduction in euros — allowing investments to be prioritised by financial return, not intuition. Each risk enters a formal treatment plan with milestones, owners, approval, and linkage to the compliance calendar.

A dedicated KRIs (Key Risk Indicators) page complements the risk register: each indicator carries a warning threshold, a critical threshold, a configurable direction (higher-is-worse or lower-is-worse), and either a manual or an automatic source. The automatic source L3_CONTROL_TESTS feeds directly off continuous control monitoring: the indicator is the failure rate of automated control tests (FAIL=1, PARTIAL=0.5), recalculated at the end of every hourly monitoring cycle. State transitions — into warning, into critical, or back to normal — trigger deduplicated notifications, with no noise while an indicator sits steady.

Every change to a risk automatically stores a complete snapshot of the previous version — likelihood, impact, treatment, owner, FAIR parameters. The record can be browsed version by version and restored to any point; restoring creates a new version and never deletes history. It answers a common auditor question: "how was this risk assessed in March?"

A loss events register grounds risk management in actual financial outcomes rather than opinion: events categorised as cyber, operational, fraud, legal/compliance, or reputational, with direct, indirect, and recovered loss values, root cause, and lessons learned. Optional links to an existing risk, incident, or CAPA avoid duplicate data entry; a running summary of total and per-category net loss gives management a factual baseline to calibrate FAIR parameters.

EterShield uses an adaptive TPRM questionnaire with 33 questions distributed across 5 modules, activated automatically based on the vendor's profile. An office supplies vendor answers 8 questions. A personal data processor with direct CRM access answers all 33.

The vendor does not need to create an account. They receive an email with a unique token link, access a secure public page, respond, and submit. The token expires after submission or deadline. All interaction is tracked and audited.

After submission, the AI analyses each response: score 0–100, red flags identified with reasoning, and overall recommendation (Approve / Conditional / Reject / Defer). The responsible party records the formal decision with a justification note — direct evidence for ISO 27001 and NIS2 auditors.

Employees with or without an account, users and invitees live in a single directory, with one record per person (department, job title, certifications, training). Invitations have their own lifecycle and an entity scope — someone invited to a company joins that company. With SAML or OIDC single sign-on, automatic provisioning on first login creates the account for employees of the organisation's domain, with the role chosen by the administrator.

The access lifecycle tracks Joiners (new employees with a provisioning checklist), Movers (role changes with access review), and Leavers (departures with a revocation checklist). Each event generates an assigned task with a deadline and completion confirmation. JML and access reviews have real effect: a completed departure or an approved revocation deactivates the account on the platform, and a reduction lowers the role — with the change recorded as evidence.

Automated periodic access reviews: a cron job schedules the review, the responsible party receives the access list, approves or revokes each entry, all recorded with a timestamp. Background checks with status and validity. Disciplinary process with PII fields encrypted in AES-256-GCM (GDPR Art. 9).

GDPR Art. 15–20 requests with entry date registration, 30-day legal countdown, status tracking (Received → Under review → Responded), and complete history for compliance demonstration.

Accident records with root cause analysis and automatic ACT report; hazard register with risk assessment and controls; PPE management per employee; documented worker consultation (clause 5.4 ISO 45001 requirement). Dedicated per-role permissions: users who can only view cannot create or delete hazards, PPE records or consultations.

Critical physical systems (HVAC, CCTV, alarms, sprinklers, UPS) registered as assets with preventive maintenance plans, inspection history, and imminent maintenance alerts. Direct linkage to ISO 27001 physical and environmental security controls.

Vehicle and driver records, fuel tracking, maintenance history, and document expiry calendar (inspection, insurance, service). Fuel data feeds directly into the GHG Scope 1 emissions module.

The CSRD report editorial cycle follows a Draft → Under Review → Approved → Published flow. The report is generated from records already existing on the platform — no manual re-entry of data.

All AI in EterShield is auditable. Every generated result includes a TransparencyBadge visible to the user — relevant for organisations subject to the EU AI Act.

EterShield's deepest differentiator: a per-entity Knowledge Base system with contextual semantic search in four phases.

The meeting ingestion pipeline: the transcript is sent via API or uploaded manually; the AI extracts risks, gaps, tasks, and decisions; items appear in an approval inbox; approved items go directly into the corresponding modules and the Knowledge Base. A 2-hour meeting produces 15 structured entries in 10 minutes.

With the proliferation of AI systems in business processes, AI risk management has become a formal requirement (EU AI Act, ISO 42001). EterShield includes a set of specialised modules for organisations that develop or use AI systems.

The ARIA Framework (Agentic Risk Intelligence Assessment) is a proprietary agentic AI risk assessment methodology structured in 7 phases, aligned with NIST AI RMF, MITRE ATLAS, MAESTRO, OWASP AIUC-1, and AIVSS. It covers 15 risk vectors: A1–A8 (agentic system risks: objective manipulation, planning hallucination, privilege escalation, context exfiltration, reasoning loop, tool abuse, irreversible impact, malicious coordination) and D Series D1–D7 (development phase threats, OWASP AI Exchange: data poisoning, backdoors, model attacks, inversion, extraction, adversarial evasion, dependency injection).

AI suggestions live inside the form the person is already working in, on one principle: AI proposes, the human decides. The "Suggest with AI" button is available in more than 60 create and edit forms — risks, policies, incidents, assessment answers, statement of applicability, tasks, suppliers, gaps, assets, GDPR records (DPIA, RoPA, breaches, data-subject requests, TIA), quality, business continuity, OH&S, contracts, minutes, objectives, KRIs, loss events, SWOT and ESG.

• Field-by-field review — the person sees what would change and accepts or rejects each field; they can fill only the empty ones, rewrite, or ask for a single field, and choose tone, length and language. Nothing is saved until the form is submitted.
• Only what the person could already do — anyone without permission to save the record cannot ask for suggestions; the AI respects each user's entity scope, and personal data (names, emails, tax IDs) is never sent to the model.
• Reasoning on record — each suggestion is stored with its transparency package (confidence, sources, limits) and its outcome — accepted, edited or rejected — for audit. Suggestions are kept for 12 months.
• Own quota — form suggestions have a monthly quota separate from other AI calls, set by the plan.
• History and restore — every editable record gets a timeline showing the origin of each change (person, AI, integration, import), comparison between versions and restore. Risks gain a risk matrix over time, and editing an approved policy sends it back for approval.
• Explain, Challenge, Ask Vera — on calculated values and suggestions, the person can ask for an explanation, ask Vera, or challenge; a challenge goes to a review queue and never changes the value by itself.

AI agents — systems that act with autonomy, use tools and access data — get a register and a governance record on the AI Agents page ("AI Security" group).

• One record per agent — owner, purpose, model and provider, data and privacy, tools (with impact and human approval), autonomy level (suggests only, acts with approval, acts alone), human oversight, and links to the model card, the AI Act, AI incidents and ARIA assessments.
• Credentials as metadata only — type, scope, who manages them and rotation. The value of a key or password is never stored, and the form rejects text that looks like a secret.
• What is missing and why — a completeness percentage and a list of missing fields, each with the reason and the framework that requires it (ISO/IEC 42001, AI Act, GDPR, OWASP for agents), plus alerts — suggested DPIA, high-impact tools without approval, transparency duty (AI Act Art. 50).
• Actions — generate one task per group of missing fields, assigned to the owner; prepare the agent's ARIA assessment with the context already filled in; periodic review on the calendar (6 months for high risk, 12 for the rest). A DPIA is only suggested, never created automatically.
• Registering with Vera, with human confirmation — Vera can lead the registration by conversation, but only creates drafts; a person always confirms, edits or rejects on the card. Drafts expire after 7 days.
• Dedicated AI permissions — administrators have full access, managers read, create and update; auditors and viewers can only view.

This is the first phase: the register is declarative, filled in and confirmed by people. It does not include automatic discovery of agents or runtime monitoring.

ANACOM routing automatically identifies the competent authority based on the sector and Decree-Law 125/2025 — eliminating manual research during a crisis.

Formal internal audit planning with audit team, agenda, findings, and non-conformance classification (Major / Minor / Observation). CAPAs with structured root cause, owner, deadline, status, and effectiveness verification. Evidence with automatic OCR — text extracted from any PDF or image, searchable and linked to the control it supports.

Automated evidence (e.g. a connector-collected screenshot or an OCR-extracted document) carries a freshness / TTL flag: once validity expires, the evidence is marked stale and the control it supports drops out of the "fresh" bucket until re-collected. A continuous coverage view shows, per framework, the split between fresh, stale, and manual evidence — giving the CISO a single screen to answer "what still needs a human this week." Google Drive Livesync links a Drive folder directly to a control: files added to that folder are picked up automatically and attached as evidence, with no manual upload step. Evidence by link records an external URL (Drive, intranet, ERP) without downloading and re-uploading the file. Verifiable integrity: the SHA-256 hash of every evidence file is stored at upload and checked periodically, and the audit log is hash-chained — any later change or removal becomes detectable. Recurring obligations in the compliance calendar generate their next occurrence on their own, on the last day of the month when the original day does not exist.

Dedicated portal for external auditors with controlled access to assessments, evidence, and reports — without access to platform configuration or data from other modules. Revocable access, with all queries recorded in the audit trail.

A weekly job polls RSS feeds from EU regulatory sources — the European Data Protection Board (EDPB) and the European Commission's Digital Strategy publications — and runs each new item through AI classification: which framework it affects, likely impact, and any inferable compliance deadline. Classified items land in a human review queue, where a CISO or compliance officer publishes or rejects each one before it reaches end users. Published items are pushed straight into the tenant's regulatory calendar, alongside internal read-time deadlines, so a new EDPB guideline or Commission proposal shows up next to the organisation's own compliance milestones — no manual trawling of regulatory websites.

Per-tenant regulatory impact: each update in the regulatory calendar now shows its concrete impact on the tenant — a badge with the number of active frameworks affected and the total control count, plus an expandable panel listing them (code, name, control count, active or not). Matching between an update's free-text framework name and the catalogue code is fuzzy — alphanumeric normalisation, cross-matching by code and by name, and known aliases — and codes with no match are declared as such rather than silently dropped.

The /dashboard/issues page pulls everything in the organisation that needs attention into a single per-tenant feed: open gaps, integration findings (Wazuh, EterScan, Prowler), audit findings, CAPAs, failed control tests — both manual and from continuous L3 monitoring — and unresolved incidents. Exact count cards per source, filters by source and normalised severity, drill-down into the originating module. Read-only in v1, with a 100-item-per-source cap and a clear truncation indicator. The GET /api/v1/issues route returns an {data, meta:{total, counts}} envelope.

The TIA module addresses the GDPR obligation to assess the impact of international personal-data transfers, as established in GDPR Art. 44–49, grounded in the Schrems II judgment (CJEU C-311/18) and EDPB Recommendations 01/2020 on supplementary measures.

Regulatory trigger: Following the collapse of the EU–US Data Privacy Framework (DPF) on 29 June 2026 (Trump v. Slaughter), transfers based on that adequacy decision lost their legal basis. Organisations relying on the DPF must now use an alternative mechanism — Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or Art. 49 derogations — and, in any case, conduct a formal Transfer Impact Assessment whenever there is a risk of access by authorities in third countries.

• TIA register: creation and management of assessments by destination country and legal mechanism (Adequacy Decision | SCCs | BCRs | DPF | Art. 49 Derogations)
• Lifecycle: DRAFT → UNDER_REVIEW → APPROVED / REJECTED / NEEDS_REVISION, with a mandatory periodic review date
• Assessment fields: analysis of the surveillance risk in the destination country; supplementary measures adopted; residual risk (LOW / MEDIUM / HIGH / CRITICAL); decision and rationale
• Optional links: Data Flow, RoPA entry, Vendor or DPA already on the platform — no data duplication
• Access control: ADMIN, MANAGER, AUDITOR and SUPER_ADMIN roles; fully multi-tenant
• Route: /dashboard/transfer-impact-assessments

DPF Watch is a dashboard card that auto-derives — with no manual data entry — all Data Flows and DPAs in the tenant that involve a DPF-based or adequacy-based transfer to the US and have no approved TIA associated. When uncovered flows exist, the card displays a red alert listing the affected transfers, ensuring that no high-risk transfer goes undetected after a legal-framework change such as the collapse of the DPF in June 2026.

Legal basis: GDPR Art. 44–49; Schrems II (CJEU C-311/18); EDPB Recommendations 01/2020; GDPR Art. 46.

The organisation's governing bodies — board of directors, security committee, ethics committee or any body defined by the client — each have their own minute book: sequential page numbering, a hash chain that makes any later alteration detectable, approval and signature by those present. Historical minutes in PDF can be imported for consultation and search; they are marked as imported and kept outside the hash chain — history comes into the platform without pretending it was born there.

The Contracts module checks every agreement with cloud and data-processing providers against a 16-item Data Act checklist (Regulation (EU) 2023/2854): mandatory switching clauses (Art. 25), the black and grey lists of unfair B2B terms (Art. 13), transition and erasure. Score per contract, a dedicated panel, and AI pre-filling. It applies to all new contracts since 12 September 2025.

The role (Admin, Manager, Viewer, Auditor or a custom role) remains the baseline. On top of it, the administrator defines person by person what each one can do (73 permissions, grant or deny), which menus and pages they see (hiding a page also closes its URL) and which entities' data they see. Simple, auditable precedence: deny > grant > role. Two safeguards come with it: an escalation ceiling (nobody grants a role above their own) and last-administrator protection. Page and entity restrictions are rolled out gradually in each organisation: first they record what they would block, and only after review do they start blocking.

One person can belong to several organisations with the same account — the typical case is the consultant or vCISO who looks after several clients. Anyone who belongs to more than one organisation sees an organisation switcher in the status bar, with the active organisation always visible; switching organisation takes one click, with no new sign-up. Within the same organisation, a person can also work across several entities.

The client stays in control. External members join by invitation from the organisation's administrator, are labelled «External» (with their home organisation) in People → Access, and can be deactivated in that organisation only without affecting the account or the other organisations. Each organisation can, in its security settings, refuse external members. A second factor is always mandatory to sign in as an external member, and a client organisation's SSO only accepts accounts from that organisation — the client's identity provider never authenticates the consultant in the other clients. An external member coming from a partner does not count towards the plan the client has contracted.

Each organisation sets its own policy in Settings → Security: mandatory MFA for nobody, administrators only or all users; whether to accept the email code as an alternative to the authenticator app; a maximum idle time (5 minutes to 8 hours) and a maximum session duration (1 hour to 7 days). Expiry is enforced on the server, not just in the browser, and is recorded in the audit log. The organisation's policy can only tighten the platform's minimum requirements, never loosen them.

SSO (SAML 2.0 and OIDC) is configured per organisation, with each one's own email domains: a domain can belong to only one organisation. From the settings, the administrator generates a SCIM token for the identity provider — Microsoft Entra ID, Okta or compatible — which then creates, updates and deactivates accounts and groups (departments) automatically; the mapped groups set the role of the people it creates. The SCIM token works for SCIM only, has an expiry date and can be revoked. Deactivating an account in the identity provider ends its sessions in under a minute, and the last administrator is never deactivated.

Whoever submits, creates or owns a record should not be the one who approves it — the «four eyes» control that a due diligence (DORA Art. 28, ISO 27001 A.5.3) looks for. Each organisation chooses the mode in Settings → Security: off, log only (the default — the conflict is flagged and recorded, but the approval goes through) or mandatory (the approval is refused). The choice belongs to the organisation because many SMEs have a single administrator. It applies to policies, control exceptions, minutes, quality documents, management review, vendor assessments and access reviews.

The entities of an organisation can be arranged in a tree: the parent entity (the holding) has its subsidiaries beneath it. Anyone with access to the parent entity sees the consolidated group view — dashboard, assets, contracts and the other records of the parent and of all its subsidiaries —, with the role inherited from the nearest entity. Contracts inherit the vendor's entity. Only administrators can change the parent entity, so that a manager with a restricted scope cannot widen their own access.

How much is being spent on security today, on what, and how much of that spend already works for each framework. The Cybersecurity Investment page records annual spend lines — tools, licences, services, audits and certifications, training, insurance —, with CSV import, renewals in the next 90 days and CAPEX amortisation. Each line can be allocated to controls, risks or assets; the spend on a control is split across the active frameworks it covers (including mapped ones), so the total per framework does not double-count, and the screen also shows what is still unallocated and what is shared between frameworks. People costs are recorded by role, never by person, and are hidden from anyone without the specific permission. In this version the currency is the euro.

The platform's periodic tasks — reminders and notifications, access reviews, integrity checks, synchronisations, watches and reports — run on a persistent queue with automatic retry on failure, and the same task never runs twice at the same time (no duplicate emails). A final failure raises an alert to the operations team, and super-administrators have a task status view.

EterShield applies Chapter VI of the Data Act to itself: full export of the organisation's data as a ZIP (records and evidence files), available to the administrator and via API; a public /trust-center/data-act page with the structures, formats and switching procedure; and Terms of Service that guarantee switching, portability and erasure with no switching charges.

Each organisation sets its default language (PT or EN) and each user their own. The interface, notifications, the vendor portal, the Statement of Applicability and the control catalogue are available in European Portuguese and English. In a group with a subsidiary in another country, the foreign entity can work in English and see the group's shared records — AI Act, SoA, CAPA, objectives, management review, Trust Center — in its own language, with the same login and no duplicated data. Features that only make sense for some clients are modules per organisation: they appear when the matching framework or integration is active, or when the administrator turns them on — vulnerability watch, for example, only appears to organisations with technical monitoring connected.

Wazuh → EterShield: Security alerts and findings automatically imported as incidents or evidence. A critical intrusion alert in Wazuh automatically generates an incident in EterShield with NIS2 countdown.

EterShield → Wazuh: All mutations on the platform are recorded in the audit log and forwarded to the Wazuh SIEM in real time — immutable audit trail outside the platform for external auditors.

Managed agents: for clients with EterSOC monitoring, the Wazuh agent installer (Linux and Windows) is generated per organisation, with an enrolment token of limited validity and number of uses; the connection to the Wazuh API validates the certificate by pinned fingerprint.

EterShield integrates with a host-level Suricata NIDS sensor running the ET Open ruleset for real-time network alert ingestion. Alerts reach the NetworkAlerts module through an authenticated ingest channel; severity is mapped automatically (CRITICAL / HIGH / MEDIUM / LOW), and CRITICAL alerts automatically generate an Incident with the NIS2 countdown active. The Network Alerts dashboard centralises events with filters by severity, outcome, protocol and source IP, and allows manual escalation for any alert.

Less noise, more signal: a full ruleset fires constantly against any server exposed to the internet. Before it can open an incident, every alert goes through five layers of automatic triage — the observed outcome of the attack (a blocked attempt is never CRITICAL), a service that does not exist on the target, correlation of attack families by source, archiving of scans and reputation hits with no evidence of success, and exclusion of responses to requests made by Eter Growth's own crawlers. A CRITICAL still means something.

EterShield also ships integration services for cloud and identity posture: GitHub, Microsoft 365 / Entra ID (via Microsoft Graph), Google Cloud Platform, and Google Workspace (Admin SDK) — feeding findings and posture data into the same Gaps/Risks pipeline as manual assessments.

Vulnerability feed from the EUVD (ENISA) and the NVD, enriched with EPSS and the CISA KEV catalogue, with risk-based prioritisation and time-to-patch metrics. It is a module that switches on for organisations with technical monitoring (Wazuh, EterScan or OpenCTI) and records each CVE only once, whichever source it comes from.

Bidirectional synchronisation: GLPI assets appear automatically in EterShield. When a gap is approved, a remediation ticket is automatically created in GLPI with priority and deadline.

Remediation tasks can push automatically to external ITSM systems, with the sync toggled per integration so a tenant can enable Jira, ServiceNow, both, or neither. The Jira webhook was hardened with HMAC signature verification on inbound calls, rejecting any request that cannot be authenticated as originating from the configured Jira instance. A new ServiceNow connector joins Jira and GLPI as a supported ticketing target for remediation tasks generated from gaps, findings, and CAPAs.

Integration with any automatic transcription system (Teams, Zoom, Google Meet) via webhook or direct call.

A compliance platform holds what an organisation keeps most closely about its own security posture: what remains undone, where the gaps are, which incidents occurred. The client's legitimate question is not whether the platform is secure — it is how they verify that it is. What follows is the answer in verifiable terms.

Isolation and access profiles. Isolation by organisation is enforced on every data operation, not as a coding convention but as a condition of each query — there is no path by which one organisation's data surfaces in another. That isolation is reinforced by layered controls: the session's membership of the organisation is validated on every request, an automatic guard flags any query without an organisation filter (in an observation period) and the application connects to the database with a role without administrator privileges. On top of that, granular access profiles (RBAC) per entity and per module let an organisation with several companies or business units give each team exactly what belongs to it.

Second factor mandatory on administrative accounts. Accounts with administrative privileges require a second factor — an authenticator application (TOTP) or an email code as the alternative method. It is neither optional nor deferrable by client configuration: an administrative account without a second factor can no longer complete sign-in.

Privileged access, visible to the client. There are moments when the Eter Growth team needs to enter a client's organisation to diagnose a problem. That access is not a standing administrator privilege: it is a temporary grant, with a recorded reason, a defined term and an automatic end. While it lasts, the client sees that we are there — a persistent notice in the interface states that the session is running under a grant and how much time remains. Every visit is recorded to the second in the organisation's own audit log, which they can consult without asking us for anything.

Artificial intelligence and exit. Requests to the AI pass through our own intermediary service, with usage logging; content is not used to train models. The organisation can export all of its data at any time — as a ZIP with the records and the evidence files, or as JSON — with no request, no waiting period and no retention used as commercial leverage. The ability to leave is part of the offer: a compliance platform that holds a client's data hostage becomes, itself, a continuity risk to record in that client's risk register.

OneTrust is irreplaceable for multinationals operating across multiple jurisdictions. For the Portuguese SME market, the cost is prohibitive and the complexity excessive.

Drata/Vanta are excellent for English-speaking startups focused on SOC 2. For a European SME that needs NIS2, DORA, ISO 27001, and ISO 9001 in Portuguese with data in the EU — EterShield is the natural choice.

Base + 3 frameworks + Operations Bundle = €149 + €60 + €149 = €358/month — all operational modules without changing platform.

• NIS2 Compliance: typical SME fine for non-compliance: €100,000. EterShield provides technical and documentary evidence of compliance. Positive ROI from the first avoided compliance event.
• ISO 27001 Certification: external consultants cost €15,000–50,000 and take 6–18 months. With EterShield, the process is accelerated by AI and already-structured evidence. Consultancy cost reduction: €10,000–30,000 per cycle.
• Knowledge that stays: an SME that depends on an external consultant pays €2,000–5,000/month. When the consultant leaves, the knowledge disappears. EterShield preserves that knowledge — the next person in charge starts where the previous one left off.

EterShield is SaaS — no software installation, no servers to configure. A modern browser (Chrome 120+, Firefox 120+, Safari 17+), an internet connection, and an email address.

Single price list; outside Portugal a market multiplier applies. Full price list available on request. Online payment through Stripe checkout is being activated; until then, subscriptions are arranged directly with Eter Growth.

Security compliance has moved from a peripheral concern to a strategic factor in competitiveness. Organisations that build real security management capability — not just pass audits — gain access to larger clients, public contracts, cyber insurance with lower premiums, and partnerships that require certifications.

EterShield was built for a specific reality: the European SME facing growing regulation without resources for an internal CISO, without budget for enterprise platforms, and without patience for tools that don't speak their language.