Unified cloud vulnerability scanning for NIS2 compliance

Why unified cloud scanning matters now

Cloud technologies are at the core of modern corporate IT, and as their use grows, so does the risk of cyber attacks on cloud infrastructure. With the EU's NIS2 Directive, organisations now have to check every part of their IT estate for vulnerabilities on an ongoing basis, cloud environments included. NIS2 explicitly requires organisations in scope to obtain information about technical vulnerabilities in their network and information systems, assess their exposure to them and take appropriate measures to fix them. Organisations must also prove that they run this kind of vulnerability management, for example through documented scan results, records of fixed vulnerabilities and the use of vulnerability scanning tools.

In practice, cloud security and compliance go hand in hand. Cloud providers offer many security features, but misconfigurations or undetected gaps in the cloud quickly create serious risk. Isolated tools, one for each cloud or only for on-premises systems, are not enough. What is needed is unified cloud vulnerability scanning that covers every cloud resource and brings the results together. This is where cloud scanning in blacklens.io comes in.

NIS2: New requirements for vulnerability management and cloud visibility

The NIS2 Directive entered into force in January 2023. It tightens cyber security obligations in critical sectors and beyond. Organisations in scope ("essential" and "important" entities) must demonstrate much broader risk management, including continuous vulnerability management. ENISA's implementation guidance on NIS2 makes it plain: without systematic vulnerability management, there is no NIS2 compliance. Organisations therefore need processes and tools to identify, prioritise and fix vulnerabilities on an ongoing basis.

Cloud environments in particular must not become a blind spot. NIS2 speaks generally of network and information systems, and today cloud infrastructure is part of that. Company data, applications and identities often live in AWS, Azure, GCP and other clouds, so they have to be on the security team's radar too. CISOs and heads of IT face several challenges here:

• Incomplete visibility: different tools for on-premises and various clouds leave gaps. There is no continuous, consistent control of the entire digital attack surface, including cloud services that can be reached from outside.
• No real-time information: without a central solution, teams often learn about new threats or cloud misconfigurations too late. Dynamic cloud assets such as new VMs, serverless functions or changed permissions need continuous monitoring.
• Evidence and documentation: NIS2 requires auditable reports. Many organisations struggle to prove the technical security measures in their cloud, for example whether critical vulnerabilities were patched in time.

Without the right platform, it is hard to live compliance day to day rather than only on paper. An integrated solution built to implement these requirements efficiently and traceably helps here.

Unified cloud scanning with 500+ CIS-aligned checks

With an update, blacklens.io significantly extended and unified its cloud scanning. The platform runs automated security checks across all major cloud environments, AWS, Google Cloud, Microsoft Azure and Entra ID (Azure AD), under one roof. For every connected cloud account, it syncs the resource inventory and audits the configuration with more than 500 checks aligned with the CIS Benchmarks (Center for Internet Security). A regular configuration audit is an important step towards a solid security baseline and towards many compliance requirements.

In concrete terms, the audit looks at identities and at how individual resources can be reached: for example whether multi-factor authentication is enabled, whether storage buckets are publicly accessible, or whether a resource has a public IP address or a public API endpoint. The result is a security profile of the cloud infrastructure. Misconfigurations and vulnerabilities appear as findings with a severity and concrete remediation recommendations. This saves security teams laborious manual checks.

Connecting every cloud account

Connecting the cloud providers is simple. In the integrations overview, you pick the provider (AWS, Azure or GCP) and follow a short set-up process. You then decide whether all of the provider's assets, such as IP addresses, VMs, load balancers and web apps, should be imported automatically, and whether existing resources such as IAM users and roles or other service-specific components should be audited. This way the platform captures the organisation's entire cloud estate.

Asset synchronisation is particularly useful. Once an account is connected, the platform also detects new resources automatically. If a new VM is created in Azure or a new S3 bucket in AWS, the asset shows up in the inventory at the next sync. Inventory sync and configuration audit run every 168 hours by default, so once a week. If you do not want to wait after a change, Run scan now starts the scan straight away. Security teams no longer have to chase every change by hand.

Results in context

An example from our own team: after we enabled the cloud scan for a Microsoft Azure tenant, the first scan revealed a weakness in a Conditional Access policy. It would have allowed an attacker to bypass the policy and sign in with a single factor, a serious risk to account security. The problem was fixed straight away and showed as resolved in the next scan.

The scan results are laid out clearly in the dashboard. Security owners see straight away which vulnerabilities were found, how critical they are and where action is needed. The platform adds context: which asset types are affected, whether they are publicly exposed or internal, what the CVSS score is and how an attacker could exploit the weakness. That makes the findings easy to prioritise. Critical cloud gaps, such as publicly reachable sensitive services without authentication, go to the top; less urgent items follow. Each finding also comes with clear remediation recommendations, often with a link to the cloud provider's documentation.

Another benefit: cloud findings run in the same workflow as external and internal vulnerabilities. Cloud assets also feed into the scope of the external attack surface analysis as suggestions, so publicly reachable resources can be checked from the outside as well.

One platform for CISOs and heads of IT: more overview, fewer gaps

For CISOs and IT leaders, the unified vulnerability management platform from blacklens.io adds strategic value. Instead of managing dozens of separate tools, you get one central view of every vulnerability in the organisation, whether in traditional infrastructure, in cloud services or in areas that get less attention, such as IoT devices. The platform combines scanning for cloud, on-premises infrastructure and web applications in one interface. The result is a complete vulnerability inventory without blind spots. Cloud risks that used to be easy to miss now sit alongside on-premises findings in the overall report.

This consolidation pays off directly in compliance. Organisations with distributed infrastructure (multi-cloud, hybrid IT, remote work) and demanding regulatory requirements (for example ISO 27001, NIS2, TISAX) benefit from central control. blacklens.io was built for exactly these scenarios.

Reporting and audits also become much easier. The platform produces PDF reports, from the executive report for management to the vulnerability report, at the push of a button or on a schedule (daily, weekly or monthly) for set recipients. They serve as a basis for NIS2 evidence, ISO 27001 audits or management reports. Every finding moves through traceable statuses from opened through in progress to closed, with comments and a retest after the fix, and an activity log records what happens in the platform. This transparency makes it easy to show auditors that vulnerabilities are handled systematically. The Jira, ServiceNow, GitHub and GitLab integrations also create tickets automatically for new alerts, so security processes are anchored in day-to-day operations.

Finally, blacklens.io also covers areas such as Dark Web Monitoring and threat intelligence to warn early about external threats, but that is beyond the scope of this article. What matters is this: with one central platform, CISOs keep the overview, address risks in order of priority and meet requirements such as NIS2 more efficiently.

Conclusion: unify cloud security

Unified cloud vulnerability scanning is an important step for organisations that want to improve their cloud security. By combining broad coverage (AWS, Azure, GCP, Entra ID) with a regular configuration audit of 500+ CIS-aligned checks, cloud scanning closes the gap between different environments. NIS2 compliance becomes much simpler, because every required measure, from continuous monitoring to scheduled reports, can be managed from one platform.

This turns conventional vulnerability scanning into strategic vulnerability management with lasting effect. Instead of just "producing" lists of vulnerabilities, the platform delivers concrete security improvements: risks are assessed in context, responsibilities are assigned and progress is tracked. The cloud is no longer viewed in isolation but as an integral part of the overall attack surface: visible, controlled and secured.

Organisations that adopt this unified approach early are better prepared for cyber threats and meet regulatory requirements without last-minute scrambles. If you want to make your cloud infrastructure secure and NIS2-ready, now is the right time to look at it through an attacker's eyes.