CTEM and Security Operations Platform
Detect. Respond. Govern. Prove.
ZephSense unifies endpoint and network detection, automated response, and risk & compliance governance in a single interface - more than a SIEM.
Security doesn't have to be expensive. ZephSense is an open-source CTEM and SOC platform, fairly licensed per operator and per tenant - the first seat is free, entry starts at €8 per month. Instead of running five separate tools, ZephSense correlates events from endpoints, network and servers centrally, triggers automated responses, and delivers audit-ready evidence for BSI OH SzA, NIS2, ISO 27001 and other frameworks.
On-premises, private cloud or managed by inducio · EU/DACH-native, full data sovereignty · air-gap capable · no per-event licensing
Threat detection is more than yet another dashboard
Security teams are drowning in tools and alerts - and still arrive too late.
Alert overload
Thousands of alerts per day, most of them false positives.
Fragmented tools
SIEM, EDR, NDR, GRC and ticketing in separate systems - no full picture.
Response too slow
Hours between alert and containment; attacks take minutes.
Compliance as a constant burden
BSI OH SzA, NIS2, ISO 27001 require evidence, processes and maturity.
The answer: a SOC that runs itself
ZephSense automates the entire tier-1 routine. Over 70% of operational detection & response tasks run without manual intervention. Your team only handles the real exceptions, an expensive 24/7 team becomes unnecessary.
- Review & enrich: alerts are correlated, enriched and prioritized automatically.
- Initial response: block in under 30 seconds, process stop on the endpoint in under 100 milliseconds.
- Proof: notification reports and evidence at the push of a button.
- No 24/7 team needed: a small team or the lean MDR service is enough. More under Autonomous SOC.
One platform: detect, respond, govern, prove
ZephSense brings detection, response, governance and evidence into a single interface - an integrated system that correlates context across endpoints, network and servers.
- Detect: real-time correlation, behavioral analysis and threat intelligence along MITRE ATT&CK.
- Respond: automated playbooks and immediate actions - containment in minutes, not hours.
- Govern: risk register, maturity measurement and multi-framework mapping (CTEM).
- Prove: live coverage reports and exportable evidence packs.
The platform in numbers
Detection/correlation rules (real-time)
Network signatures (inline)
Threat IOCs from 30+ feeds
Response at the endpoint
Compliance controls, 6 frameworks (indicative)
Security maturity score
Capacity values (as-delivered scope). Outcome values are experience-based / target values from reference environments, not a guarantee.
Capabilities
Central log collection & SIEM correlation
Events from endpoints, network and servers correlated in real time.
Host-based detection (EDR/HIDS)
Behavioral analysis, process trust scoring, forensics.
Network-based detection (NDR/NIDS)
DNS, flow and IOC correlation to uncover C2 activity.
SOAR & incident response
Automated playbooks from creation to containment.
Threat intelligence
Over 160,000 IOCs from 30+ feeds, synced hourly.
GRC, compliance & audit
Risk register, maturity score, evidence packs.
More than a SIEM, more than an EDR
A classic SIEM collects and correlates logs. An EDR-only tool protects endpoints. ZephSense connects both - and adds network detection, automated response, exposure management and compliance evidence to form a CTEM and SOC platform.
| Capability / property | Classic SIEM | Cloud EDR/XDR | ZephSense |
|---|---|---|---|
| Centralized log correlation | Yes | Partial | Yes |
| Host-based detection (EDR/HIDS) | No | Yes | Yes |
| Network detection (NDR/NIDS) | Partial | Partial | Yes |
| Automated response (SOAR / Active Response) | Partial | Yes | Yes |
| Vulnerability/exposure management (CTEM) | No | Partial | Yes |
| Compliance mapping & evidence packs | Partial | Add-on | Yes |
| Data sovereignty (EU / on-prem / air-gap) | Rare | Vendor cloud | Yes |
| Technology base | proprietary | proprietary | open-source, no lock-in |
| Optional SOC/MDR operation | Add-on purchase | Optional | Integrated |
| Licensing model | volume/data-based | subscription per endpoint | per seat & tenant, no per-event |
CTEM positioning: ZephSense performs Continuous Threat Exposure Management - continuous, measurable governance of the attack surface instead of point-in-time scans.
Security doesn't have to be expensive
Fairly licensed
Per seat (€47.50/month, the first one free) and per tenant (from €8/month). No per-event licensing.
AIMSTRONG appliance + installation
A ready-to-use SOC/CTEM out of the box.
Large environments
AIMcompute servers on request.
Open-source core, no vendor lock-in. Certain optional third-party premium extensions may incur cost. All prices on the pricing page.
Service & operations
Two building blocks, freely combinable.
| Building block | Tiers | Coverage | from (net/month) |
|---|---|---|---|
| Platform service (support, updates, tickets) | Basic · Advanced · Professional · Elite | 9×5 to 24/7 | €190 |
| SOC service (detection & response) | Response time NBD to 15 minutes, co-managed to MDR | 8×5 to 24×7 | €990 |
Prices are indicative and a basis for quotation - finalized after technical scoping. Details on the pricing page.
Compliance across multiple frameworks - provable
- Frameworks: BSI OH SzA, ISO 27001:2022, NIS2, NIST 800-53, PCI DSS 4.0, HIPAA (GDPR additionally).
- Evidence: Live coverage report, exportable evidence pack, risk register, security maturity score (0-100).
- Reporting: BSI 24h/72h reporting on demand.
Note: ZephSense supports meeting regulatory requirements; responsibility for and assessment of conformity remain with the operating organization. No blanket compliance guarantees.
Get started with ZephSense
Start lean from €8 per month - or have inducio deliver and operate a ready-to-use solution. We map your BSI OH SzA, NIS2 and other compliance requirements in a structured way.