NIS2 and NISG 2026 for Software Vendors
NIS2, in Austria the NISG 2026, reaches software vendors through the supply chain. Roughly 4,000 essential and important entities in Austria are directly in scope, plus an estimated 50,000 supply-chain partners. The Squad turns the directive's obligations into technical evidence about the software you ship.
Why software vendors are in scope
The directive demands state-of-the-art risk management, strict incident reporting to national authorities and personal liability for company management. Risk management covers cryptography, access control and supply-chain security (Article 21). Entities in scope must manage the risk of their suppliers, so the questions arrive at software vendors in procurement: what is inside your app, which libraries and versions, which keys, which endpoints?
The national authority's information at nis.gv.at is the reference for whether and how the law applies to your company. The audit does not decide applicability. It supplies the technical facts that your answers depend on.
From obligation to technical control
No checklist replaces looking at the actual systems. We map the obligations against your code, your configuration and your data flows, and translate them into controls your infrastructure team can implement:
- Cryptography: hardcoded keys and credentials, TLS and network security configuration, certificate pinning.
- Access control: authorization logic, permissions and API authorization, trust boundaries between app and backend.
- Supply-chain security: third-party dependencies and SDKs with their versions, and the companies behind the endpoints your app contacts.
- Incident readiness: Article 23 sets strict reporting timeframes. A complete inventory of components and data flows is what makes those timeframes workable.
What you receive
A written report with the evidence behind each finding, severity ranked with CVSS where applicable, an analysis of what an attacker could realistically do, and remediation guidance. Every report includes a base knowledge graph that links findings, SDKs, endpoints and weaknesses. Human specialists re-verify every finding.
The report is technical evidence for your risk-management documentation. It carries no certificate. The Security offer on the Access page states a delivery estimate of 5 business days.
Method and independence
The audit reads the software as shipped. It follows OWASP ASVS, the OWASP Top 10 and CWE, and uses the same method as our public ledger. The Squad is built for software security investigation, and the institute behind it publishes its methodology, its disclosure policy and the frameworks it audits against: NIS-2, GDPR, the EU AI Act and ISO/IEC 29147, 30111 and 27001.
Evidence from audited software
The public ledger lists 387+ audited apps and 262+ critical findings. These full reports show supply-chain and cryptography findings in software from established vendors:
- SAP: A Chinese push SDK in a field-service app, and Firebase keys hardcoded across five apps.
- Nike: Development and production push credentials hardcoded in the shipped build.
- Strava: A hardcoded key and a security configuration that protects nothing.
- Revolut: The largest third-party SDK in the series and what it sends to a US company.
Start with the free check
The free check examines one domain from the outside: read-only, from a European IP address, with no login and no payloads. A researcher reviews your request and replies within one business day. It is an initial external assessment and does not replace a source-code review.
See the plans for a full audit on the Access page, and the frameworks we audit against on the Standards page.
See plans and pricing → · Meet The Squad → · Standards and frameworks →
The initial check is read-only, performed from a European IP address, with no login and no payloads. Your systems remain unchanged.
A researcher reviews your request before any check begins and replies within one business day. You receive a short written report with our findings, likely attack scenarios, the potential financial impact and clear next steps, plus a knowledge graph of everything we found. All free.
Questions about NIS2 and software vendors
Does NIS2 apply to our company?
That depends on sector, size and role in a supply chain. The national authority's information at nis.gv.at is the reference. The audit supplies technical facts and leaves the applicability decision to you and your counsel.
Do you certify NIS2 compliance?
No certificate is issued. The deliverable is a written technical report with evidence for your risk-management documentation.
How long does an audit take?
The Security offer on the Access page states a delivery estimate of 5 business days.
Do you test our live systems?
No. You send the material you want examined, and the audit works on that material.
