· 9 min read
What this article is, and is not
NIS2 (Directive (EU) 2022/2555) is a real EU directive, transposed into national law across member states. No tool makes an organization "NIS2 compliant": compliance is an organizational and legal state that depends on governance, people and process, not on a scanner or an agent. What a technical tool can do is help you demonstrate specific obligations with evidence. That is the only claim we make here, and everything below is limited to what the Darkmoon platform actually produces.
Article 21 of NIS2 requires essential and important entities to take "appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems", and it names, among those measures, policies on risk analysis, incident handling, and policies and procedures to assess the effectiveness of cybersecurity risk-management measures. That last clause is where offensive validation earns its place: assessing effectiveness means testing whether a control actually stops an attacker, not whether it exists on a checklist. Darkmoon is an autonomous offensive testing platform, so this is a natural fit, but the fit has to be described precisely.
What Darkmoon produces that is relevant to NIS2
Every Darkmoon campaign ends in a report that is generated server-side from the findings the agent pushed. It is deterministic: the body is assembled from stored evidence rather than written by the model. Each finding carries a severity, a CVSS score and vector, a status, and where the agent could establish them, a MITRE ATT&CK technique and an ISO 27001 Annex A control. The overall methodology recorded on every report is ISO 27001 / NIST SP 800-115 / MITRE ATT&CK. Those are the frameworks the product genuinely maps to. There is no NIS2 control field in the code, and we are not going to invent one: NIS2 does not publish a control catalogue the way ISO 27001 does, it sets obligations. The honest bridge is that ISO 27001, NIST SP 800-115 and MITRE ATT&CK are exactly the reference frameworks used to demonstrate the effectiveness obligation in practice.
Mapping the obligations to what the platform actually does
The table below maps NIS2 Article 21 measures to concrete Darkmoon output. Read the right column as "evidence this obligation is being worked", not as "this obligation is satisfied".
| NIS2 Art. 21 measure | How Darkmoon helps demonstrate it |
|---|---|
| Risk analysis and information system security | Autonomous assessment that maps the attack surface, chains findings, and grades each by demonstrated impact, feeding a real-world risk picture rather than a theoretical one. |
| Assessing the effectiveness of risk-management measures | Offensive validation with proof of exploitation: a control is shown to hold or to fail against an actual attack, with the exact request, response and extracted data recorded. |
| Handling of incidents (detection and evidence) | Each finding is timestamped and attributed to the agent that found it; the run's JSONL log is the auditable record of what was attempted and when. |
| Testing, audit and security hygiene | Scheduled and recurring campaigns (daily, weekly, monthly) turn a point-in-time test into a repeatable one, so effectiveness is re-checked as the estate changes. |
| Reporting to management and authorities | A management summary in plain language plus a full technical report, exportable to PDF, that a CISO can hand to a board and an assessor can read line by line. |
Proof of exploitation, not a probability score
The reason offensive validation is useful for the effectiveness obligation is that it does not stop at "this looks vulnerable". Every Darkmoon agent assigns a status by demonstrated impact: EXPLOITED means the impact was executed end to end, CONFIRMED means it was demonstrated with the exact request and raw response, and UNCONFIRMED is a lead that is capped at low severity because it was not proven. An assessor asking "did you test whether that control works?" can be answered with the transcript of the attack, which is a stronger form of evidence than a vulnerability score. We wrote about that distinction separately in why proof of exploitation beats AI vulnerability scores.
Continuity: the part NIS2 cares about that a one-off pentest misses
NIS2 frames security as an ongoing duty, not an annual event. Darkmoon’s scheduler runs a background task that checks for due campaigns every 60 seconds and launches them, with a recurrence of none, daily, weekly or monthly. That means the effectiveness of a control can be re-validated on a cadence rather than once a year, and every run leaves the same auditable report behind. The mechanics are in how the Darkmoon scheduler works and, for pipeline-triggered runs, in autonomous penetration testing in your CI/CD pipeline. For why point-in-time testing ages badly under both NIS2 and DORA, and where repeatable testing fits without replacing the mandatory human red team, see continuous pentesting for NIS2 and DORA.
Data protection: keeping the evidence trustworthy and contained
Evidence is only useful to a regulator if it is trustworthy, and it is only safe to keep if sensitive values are handled with care. Darkmoon runs on a local model by default, and its privacy gateway feeds the model deterministic placeholders instead of real hosts, paths and credentials; the CONFIDENTIAL report is rehydrated with the real values only at the single point where it is written to disk, server-side. This is defence in depth with activation conditions and known limits, not an absolute guarantee that no data ever reaches the model. The full, caveated treatment is in how to run an AI pentest without sending your data to the LLM.
The honest boundary
Darkmoon helps demonstrate the technical-testing and effectiveness-assessment parts of NIS2 Article 21, and it produces the kind of evidence an assessor expects, mapped to ISO 27001, NIST SP 800-115 and MITRE ATT&CK. It does not cover governance, supply-chain contracts, incident reporting timelines to a CSIRT, business continuity, or the many organizational obligations NIS2 also imposes. Treat it as one strong instrument in a wider compliance programme, and take legal advice on your specific national transposition.
FAQ
Does Darkmoon make my organization NIS2 compliant? No. Compliance is a legal and organizational state. Darkmoon helps you demonstrate specific technical obligations, chiefly the assessment of the effectiveness of your security measures, with proof-of-exploitation evidence.
Which frameworks does the report actually map to? ISO 27001 Annex A controls and MITRE ATT&CK techniques per finding, with the overall methodology recorded as ISO 27001 / NIST SP 800-115 / MITRE ATT&CK. There is no separate NIS2 control mapping, because NIS2 sets obligations rather than a control catalogue.
Can I show a regulator a repeatable test, not a one-off? Yes. Scheduled and recurring campaigns produce the same report on a daily, weekly or monthly cadence, so effectiveness is re-validated over time and each run is auditable.
Darkmoon is our open source project (GPL-3.0): github.com/ASCIT31/Dark-Moon, docs.