The regulation is here

The regulation already applies to you. The deadline is the only thing left.

NIS2 and ISO 27001 are enforced now. Lulu turns them into day-to-day workflows so your evidence builds itself — no separate compliance team required.

Deadlines that do not slip
Every incident ticks toward its 24h / 72h / 30-day reporting deadline. Lulu tracks them and generates your CSIRT report when it is due.
Evidence that proves itself
Every threat you find, every change you make, every control you check, attached automatically to the incident and the audit file.
From breach to audit trail in one view
A detected threat becomes a tracked incident with evidence and outcome, then a record in your compliance file. No copy-paste between tools.
One control engine, two frameworks
Evidence you collect for NIS2 pre-fills your ISO 27001 Statement of Applicability. Both auditors see the same truth.

AI control plane

Ask, and it's done.

Tell the AI assistant what you need in plain language. It creates monitors, answers compliance questions with cited sources, opens incidents, and runs commands — all within your team's permissions, all audited.

Speak in plain language
Ask it to "alert me if memory spikes on Kubernetes" or "show me attacks on production this week" — no query syntax, no menu hunting.
Respects your permissions
The assistant honors your roles. A junior teammate can ask, but cannot run what is outside their access. Every action is audited.
You decide, it executes
The assistant proposes what to do, you review and approve, then it runs the commands. Full control, no surprises.

What are our incident-reporting deadlines under NIS2, and where is that defined?

Three deadlines run from the moment you become aware of a significant incident: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month. They're set out in Article 23(4):

“…(a) an early warning … without undue delay and in any event within 24 hours … (b) … an incident notification … within 72 hours …” — illustrative excerpt
Art 23(4)Directive (EU) 2022/2555 · EUR-Lex ↗

deterministic floor, AI ceiling — verbatim & cited, never fabricated

Endpoint security built in

A breach starts on one machine. We watch every machine.

Every machine you monitor is covered. The endpoint agent watches deeply, learns what is normal for you, and stays quiet on baseline noise — so you see real threats, not false alarms.

Installed by default
Endpoint security is built in from day one — no extra agent to deploy, no separate bill, no added complexity.
Learns your normal, stays quiet on it
Every machine builds its own baseline. What is normal for your apps never pages you — so you only hear about what actually matters.
One attack pattern, one alert
See the same technique on three machines and you get one clear signal, not three separate noise alerts.

Incident response

When something breaks at 3am, the right person already knows.

One alert storm becomes a single incident, routed to whoever is on call. If they do not answer, it escalates — automatically. Paging and incident response are built in, not a separate tool you wire up.

Storms collapse into one incident
Dozens of alerts from the same root cause become one clear incident, so you respond to the problem, not the noise.
The right person, paged in seconds
An alert fires, the on-call schedule is checked, and the primary is notified over chat, SMS, or email. No answer in a few minutes? It moves to the backup.
Nothing extra to buy
Rotations, escalation, and acknowledgements are part of the platform. One bill, one login, no paging add-on.

Trust & sovereignty

Your data, your infrastructure, your call.

Your infrastructure or ours

Start on EU-managed cloud, or run the whole platform on your own servers. Same codebase, same features, your choice of where the data lives.

Secrets never exposed

Every credential is encrypted at rest, fetched for a single action, then gone from memory. Built for teams that handle real secrets.

See everything that matters

Every login, every rule change, every command — in the audit log, encrypted end to end, so the record of what happened cannot be quietly erased.

The difference

Everything on one screen. Nothing hidden in a silo.

Every team sees the same data — no separate tool for security, no blind spot between monitoring and response, no secrets scattered across five places.

luluOPERATIONAL CENTER

See every machine, every request, every connection

Trace a request from entry point to database and back

Catch breach techniques in real time, without false alarms

Inventory and manage your whole cluster

Page the right person when it matters

Prove compliance as you go: NIS2 and ISO 27001

Control access, encrypt secrets, audit everything

One login, one bill, no integrations to maintain

01Metrics, tracing & APM toolobservability

+ integration glue

02EDR / security agentdetection

+ integration glue

03Synthetic / uptime toolexternal

+ integration glue

04K8s observability stackkubernetes

+ integration glue

05On-call / paging toolincident

+ integration glue

06GRC spreadsheetcompliance

Pricing