How do we map subsidiaries and sites?

Through a tenant and its workspaces. Each company or site gets its own workspace with its own scope, modules, reports and notification policies. Group IT sees every workspace in the portfolio dashboard, while local teams only see their own through their role. AI features are also enabled per workspace.

Does blacklens.io support single sign-on?

Yes. Sign-in runs on OpenID Connect with Microsoft Entra ID and Google, and MFA is available as well. You control access through 8 predefined roles, 50 individual permissions and custom roles. The audit log records activity with direct links to the affected objects.

How do we connect our SIEM and ticketing?

For Microsoft Sentinel there is a Content Hub solution with a data connector, an analytics rule and an ARM template; the Elastic integration is in beta. Tickets are created in Jira or ServiceNow, and notifications go to Microsoft Teams, Slack or to your own systems via webhook. Everything else runs through the REST API with more than 250 endpoints and Swagger documentation.

How does Sentry scale in large networks?

Sentry runs as a VM on VMware, Hyper-V or Proxmox, or as a Docker container. The number of agents is unlimited, so every site gets its own. An agent with 8 vCPUs and 16 GB RAM scans up to 2,500 hosts; small sites with up to 100 hosts need 2 vCPUs and 4 GB. Sentry checks servers, clients, OT components and Active Directory, and an agent outage is reported after 15 minutes.

Where is our data processed?

The platform runs in ISO 27001 and SOC 2 certified data centres in the DACH region. External scans come exclusively from Austria, Germany and Switzerland and from fixed source IP ranges that you can allow in your firewall and IDS. The AI features run on a self-hosted LLM without external providers. The vendor is snapSEC GmbH in Austria.

How is blacklens.io licensed for corporate groups?

By scope: monitored assets such as domains, networks, IP addresses, cloud resources and Sentry assets, plus users for dark web monitoring. Modules are chosen per workspace. For corporate groups we prepare a quote that fits your structure; reports, API and integrations are included.

Enterprise

Every subsidiary and site in one view

Subsidiaries, acquisitions and cloud accounts in one platform: a workspace per company, prioritised centrally and connected to your SIEM, ticketing and identity provider.

Book a demo Start free trial

Large environments, distributed responsibility

Every company in the group runs its own IT, while attackers see one shared attack surface.

Grown structures

Subsidiaries, sites and acquisitions with their own IT and service providers.

Unknown networks

IP ranges and domains from projects and acquisitions are missing from every inventory.

Tools without context

Scanners, cloud consoles and threat feeds deliver raw data in separate silos.

Evidence for regulators and customers

NIS2, DORA, ISO 27001 and customer audits require provable processes.

A platform that mirrors your group structure

Steer centrally, own locally: each company sees its own findings, group IT sees them all.

Corporate group5 workspaces

Holding22

Linz plant583 critical

Poland subsidiary411 critical

Sales DACH15

Acquisition 2025New735 critical

Users and roles8 roles plus custom

HHead of ITSSO via Microsoft Entra ID

EExternal service providerSSO via Google

PPentesterSign-in with MFA

50 permissions, checked server-sideRBAC

Tenant Beispiel GmbHSeparate workspaces, revocable API keysIsolated

Microsoft SentinelContent Hub

Data connector

Analytics rule

ARM template

Incident from a blacklens.io alertvpn.beispiel-gmbh.atCritical

Search alerts and findingsElastic, KibanaBeta

Alert to SOAR or NACWebhookJSON

Identities and MFA3 directories

312Identities

17No MFA

9Privileged

12Stale (90 days)

admin.it@beispiel-gmbh.atPrivileged role without MFA, Entra IDCritical

m.hu•••@beispiel-gmbh.atWeak authentication only, GoogleHigh

c.wi•••@beispiel-gmbh.atPasskey, Entra IDPhishing-resistant

Visuals show sample data.

Including the networks nobody remembers

Scope suggestions from RIPE data, threat intelligence and connected cloud accounts surface IP ranges and domains from acquisitions and old projects. Internally, Sentry scans every site.

Scope suggestions3 new

beispiel-gmbh.atin scope

198.51.100.0/28Network, RIPE netnameAdd

api.beispiel-gmbh.atDomain, Azure accountAdd

203.0.113.24IP address, Threat intelligenceAdd

Visuals show sample data.

Scope suggestions
New networks and domains to approve, instead of manual lists.
Sentry per site
As a VM or Docker container, unlimited agents, including OT and Active Directory.
Technology inventory
New CVEs matched in real time against the inventory of every company.

Evidence for the board, regulators and audit

Scheduled reports per company, a supplier watchlist checked against ransomware leak sites and pentests on an agreed schedule: evidence for NIS2, DORA and ISO 27001.

Evidence for auditors and insurersas PDF

Vulnerability reportNIS2 Art. 21 (2) emonthly

Executive reportISO/IEC 27001 A.8.8weekly

Supplier watchlistNIS2 Art. 21 (2) dcontinuous

Visuals show sample data.

Executive report per company
Exposure score with trend, scheduled by email.
Supply chain in view
Supplier watchlist via CSV, matched against ransomware leak sites.
Pentests on your schedule
Weekly to yearly per target, with retest and report.

How the rollout works

1
Demo
Map your structure
We show the platform with your domains and plan workspaces, roles and integrations.
2
Pilot
One company first
14 days with full functionality, your external attack surface from day one.
3
Rollout
Company by company
More workspaces, SSO, Sentry per site, alerts in your SIEM and ticketing.

Permissions across system and custom roles: 53
Endpoints in the REST API: 250+
Integrations, incl. Sentinel and Elastic: 15
Hosts per Sentry agent, unlimited agents: 2,500

Used by manufacturers, retailers, software companies and IT service providers across the DACH region.

Frequently asked questions

: Through a tenant and its workspaces. Each company or site gets its own workspace with its own scope, modules, reports and notification policies. Group IT sees every workspace in the portfolio dashboard, while local teams only see their own through their role. AI features are also enabled per workspace.
: Yes. Sign-in runs on OpenID Connect with Microsoft Entra ID and Google, and MFA is available as well. You control access through 8 predefined roles, 50 individual permissions and custom roles. The audit log records activity with direct links to the affected objects.
: For Microsoft Sentinel there is a Content Hub solution with a data connector, an analytics rule and an ARM template; the Elastic integration is in beta. Tickets are created in Jira or ServiceNow, and notifications go to Microsoft Teams, Slack or to your own systems via webhook. Everything else runs through the REST API with more than 250 endpoints and Swagger documentation.
: Sentry runs as a VM on VMware, Hyper-V or Proxmox, or as a Docker container. The number of agents is unlimited, so every site gets its own. An agent with 8 vCPUs and 16 GB RAM scans up to 2,500 hosts; small sites with up to 100 hosts need 2 vCPUs and 4 GB. Sentry checks servers, clients, OT components and Active Directory, and an agent outage is reported after 15 minutes.
: The platform runs in ISO 27001 and SOC 2 certified data centres in the DACH region. External scans come exclusively from Austria, Germany and Switzerland and from fixed source IP ranges that you can allow in your firewall and IDS. The AI features run on a self-hosted LLM without external providers. The vendor is snapSEC GmbH in Austria.
: By scope: monitored assets such as domains, networks, IP addresses, cloud resources and Sentry assets, plus users for dark web monitoring. Modules are chosen per workspace. For corporate groups we prepare a quote that fits your structure; reports, API and integrations are included.

Integrations

Sentinel, Elastic, ServiceNow, Jira, Teams and REST API.

Sentry: internal scanning

Servers, clients, OT and Active Directory at every site.

Supply chain monitoring

Spot suppliers on ransomware leak sites early.

NIS2

What NIS2 requires technically and how you prove it.

Let us plan your structure together

In a demo we show workspaces, roles, SSO and the SIEM connection, using your own domains. Then you start with one company as a pilot.

Book a demo Start free trial

14 days free, all features
No credit card required
We walk you through your first findings

Every subsidiary and site in one view

Large environments, distributed responsibility

A platform that mirrors your group structure

Including the networks nobody remembers

Evidence for the board, regulators and audit

How the rollout works

Frequently asked questions

Related pages

Let us plan your structure together