Continuous third-party and ICT supply chain risk from public data. One Risk Score per supplier, published weights behind it, and the same engine turned on your own estate.
EU SaaS, private cloud or on-premise · no agents · no card
Runs in our EU cloud or entirely inside your own infrastructure, air-gapped if needed. See deployment models
Deployed across regulated sectors
Looking for a single toolset? See how PuReAI works as attack surface management tools.
PuReAI is built first for the risk that arrives through someone else's systems. The same twelve modules then answer the same question about your own estate.
Primary use case
Score every supplier from the outside, continuously, on the same model. Dated evidence per finding for the ICT register, supervisory questions and renewal decisions under DORA and NIS2.
Third-party riskSecond use case, same platform
One seed domain in, the whole reachable estate out: subdomains, hosts, certificates, technologies, leaks and misconfiguration, including the shadow IT the CMDB never listed.
Attack surface managementAuthenticate with your credentials and complete the 2FA verification step.
Choose a registered domain associated with your company. 12 OSINT modules run against it — subdomains, CVEs, leaked credentials, lookalikes, supply chain and more.
Review findings on the Risk Dashboard, identify exposure points, and prioritize remediation by severity and CISA KEV status.
Open the threat-intel chat and ask analytical questions in plain language: which actors target your sector, which vendor CVEs are actively exploited, recent incidents in a country.
Apply fixes, update finding statuses, and let scans + daily threat-feed ingestion re-run to track improvements and surface emerging threats.
Subdomains, CVEs, leaked creds, lookalikes, dark web, supply chain. Pick a module — see what it actually pulls and where it lands in the Risk Score.
Real-time summary of the organization's overall security posture in one place. Surfaces the Company Risk Score, open findings by severity, and updates immediately as statuses change across Vulnerability, Misconfiguration and Lookalike.
Ask in plain language — any language. Get answers grounded in a Neo4j graph of actors, TTPs, CVEs and incidents, with sources instead of hallucinations.
Supports the underlying capability both regulations require: continuous third-party and ICT supply-chain threat monitoring. DORA (financial sector, in force since Jan 2025) mandates ICT third-party risk management — covered by the vendor-CVE and actor-attribution graph. NIS2(cross-sector, critical infrastructure) explicitly requires supply-chain security and addressing supplier vulnerabilities — covered by the vendor + sector-targeting features.
How PuReAI supports DORA & NIS2
Every segment produces its own 0–100 score, then they combine into a single Company Risk Score:
Every Vulnerability, Misconfiguration and Lookalike finding has a status. The score moves as you actually close them — not just when something is detected.
Leaked accounts, Git leaks and Google Dorks — the highest weight, because an active compromise is direct, immediate risk.
Vulnerabilities + misconfigurations across the attack surface, scored by highest confirmed severity and the overall distribution.
Third-party vendors and dependencies — weighted average across all identified dependencies by criticality.
Total discoverable surface (domains, subdomains, IPs, services) factored by how well-controlled that exposure is.
Monitor the external attack surface, track CVEs, and ask the threat graph about ransomware actors, MITRE ATT&CK TTPs and active campaigns — in plain language.
Find misconfigurations, exposed services and shadow IT, then prioritize what to fix using CISA KEV and actor-attributed CVEs.
Continuous third-party / ICT supply-chain monitoring with vendor-CVE attribution — built to support DORA (financial) and NIS2 (cross-sector) obligations.
Oversee clients, manage users, assign licenses, and track organizational coverage across surface and threat intelligence.
