Four real runs, step by step.
Each example was run in Ansvar on 29 October 2026. Open a step to see what went in, which sources were read, and what came out.
A NIS2 gap analysis, with the Swedish layer.
One finding from a full gap analysis on a fictional company. The run checked all ten NIS2 Article 21 measures, read the Swedish law and the agency rules, and wrote down every gap with its source.
- Company
- Nordvik Logistik AB, fictional, 320 staff
- Run time
- 14 minutes
- Whole result
- 1 largely met, 8 partial, 1 not in place
- Plan
- One assessment a month on the free plan
Ansvar asks one question at a time. Here: who handles incidents, what the procedure says, and who you would report to. Nordvik answered that it has a procedure, an outsourced security operations centre, and no regulatory deadlines in either.
- NIS2, Article 23(4)EUR-Lex“(a) without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning …”
- Cybersäkerhetslag (2025:1506), 2 kap. 5 §Riksdagen“Verksamhetsutövare ska upplysa den myndighet som regeringen bestämmer om en betydande incident så snart det kan ske, dock senast 24 timmar efter det att verksamhetsutövaren har fått kännedom om incidenten.”
Followed by 6 § (notification within 72 hours), 7 § (interim reports on request) and 8 § (final report within a month).
- MCFFS 2026:8, incident-reporting rulesMCF
Excludes postal and courier operators from its chapters on what counts as significant. Ansvar flags that Nordvik must confirm its thresholds with the authority.
- NIS2 technical implementation guidance, 3.1ENISA
How to set up incident handling in practice.
- No test of whether an incident is significant under 2 kap. 5 §.
- No workflow for the 24-hour warning, 72-hour notification, interim reports and one-month final report (2 kap. 5–8 §).
- The receiving authority and reporting channel are not named; under MCFFS 2026:8 the thresholds for a courier operator must be confirmed.
- The security operations centre contract does not oblige the provider to help classify incidents or meet the deadlines.
Missing evidence stays a gap, never a pass. Your team reviews each finding and can overrule it with a reason.
Is this week's PHP flaw a problem for us?
A vulnerability published a week ago. Your AI's training data has never seen it, so Ansvar fetches the facts live and shows where each one comes from.
- Recorded
- 29 October 2026, in Ansvar
- Tools used
- CVE details, known-exploited status, exploit prediction
- Plan
- CVE lookups are included on the free plan
Asked in a chat with the Ansvar connector. The same question works in Claude, ChatGPT, Copilot or your own agent.
- NVD recordNIST
Published 21 Oct 2026. CVSS 3.1 score 9.8, network attack, no login needed.
“Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).” - Known Exploited Vulnerabilities catalogueCISA
Added 26 Oct 2026 as “PHP Memory Corruption Vulnerability”. Due date for US federal agencies: 29 Oct 2026.
- Exploit prediction score (EPSS)FIRST
0.99999, scored 27 Oct 2026.
- Security advisory 2026-018CERT-EU
“Critical Vulnerabilities in PHP”, 23 Oct 2026.
- Advisory NCSC-2026-0443NCSC-NL
“Kwetsbaarheden verholpen in PHP”, 21 Oct 2026. Likelihood high, damage high.
- Exploit 52704Exploit-DB
A verified proof of concept, published 22 Oct 2026.
CERT-EU content under CC BY 4.0; Ansvar reduced the HTML to text.
- Severity
- CVSS 9.8, remote code execution
- Exploited
- Yes, on CISA’s list since 26 Oct
- Fix by
- 29 Oct for US federal agencies
- Exploit
- Public proof of concept since 22 Oct
- In Europe
- CERT-EU and NCSC-NL advisories
A threat model for a customer portal.
Describe the system and Ansvar works through every part, threat by threat, with the techniques and weaknesses each threat rests on. You approve the scope, the list and the scores along the way.
- System
- Customer portal, fictional
- Result
- 21 threats: 2 critical, 9 high, 10 medium
- Plan
- One assessment a month on the free plan
Customers log in, see orders and invoices and update their details. Hosted in an EU cloud region, login through an external identity provider. Ansvar draws the data flows, shown above, and asks you to confirm the scope before it starts.
- STRIDE, part by part
Spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege, checked for each of the eight parts.
- ATT&CK, CAPEC and CWEMITRE
Each threat is tied to the attack technique and the weakness behind it, for example T1190 and CWE-639.
- GDPR, Article 32EUR-Lex
Where customer data is at stake, the security duty it falls under.
- Your approvals
Scope, threat list, scoring and mitigations each wait for your confirmation.
CriticalCustomers open other customers’ orders by changing an ID
- Where
- Portal API · Tampering · CWE-639
- Attack
- A logged-in customer changes the order or customer ID in the request, and the API does not check ownership.
- Fix
- Take the customer ID from the login token, never from the request, scope every query by it, and test each endpoint for this in CI.
CriticalCredential stuffing and MFA fatigue at login
- Where
- Identity provider · Spoofing · CWE-307
- Attack
- Bots replay leaked passwords and spam push approvals until a customer accepts one.
- Fix
- Screen breached passwords, throttle per account and IP, and use passkeys or number matching instead of plain push.
ATT&CK®, CAPEC™ and CWE™ are trademarks of The MITRE Corporation.
What’s coming for your products.
Describe the product and where you sell it. Ansvar works out which EU acts apply, gives the date each one starts for you, and asks when a fact it needs is missing instead of guessing.
- Company
- A fictional Swedish maker of connected packaging machines
- Recorded
- 29 October 2026, in Ansvar
- Plan
- Team and above
Ansvar turns the answer into a product profile: a machine with network connection and firmware updates, sold across the EU since 2024, built by a medium-sized Swedish manufacturer.
Ansvar checks the product against 25 EU acts, from the Cyber Resilience Act and the Machinery Regulation to the Data Act and the Batteries Regulation. Each date comes from the act that sets it, and units already on the market are treated separately from units placed later.
9 Dec 2026 · New product liability rules
Strict liability of the manufacturer for damage caused by a defective product, with software in scope. Applies to units placed on the market from this date.
Directive (EU) 2024/2853, Art. 2 and 22 · EUR-Lex
11 Dec 2027 · Cyber Resilience Act in full
Essential cybersecurity requirements, conformity assessment, CE marking and the manufacturer obligations for a product with digital elements.
Regulation (EU) 2024/2847, Art. 71 · EUR-Lex
Pending · Digital Omnibus
A proposal that may change the Data Act, NIS2 and GDPR. No date until the law fixes one, so Ansvar shows its stage, not a guess.
COM(2025) 837 · Legislative Observatory
A question before 20 Jan 2027
Is the machine one of the electrical products the Machinery Regulation leaves to the Low Voltage Directive? The answer decides whether the Machinery Regulation applies from 20 January 2027.
Regulation (EU) 2023/1230, Art. 2(2)(p) · one of the questions Ansvar asked to settle what is still open