This page describes the ecosystem from the point of view of the projects Fidem delivers. The individual product pages, with pricing and activation, are on defensio.technology: continuous vulnerability scanning, network security monitoring, attack surface management, SOC as a service and email identity protection.
Defensio: Fidem's Cybersecurity Ecosystem
An Integrated Security Ecosystem
Defensio is the proprietary cybersecurity ecosystem developed by Fidem to meet a concrete challenge: giving companies a cyber defense system that is not a disorderly sum of separate products, but a coherent, integrated ecosystem designed to work as a single security platform.
Unlike traditional approaches to cybersecurity, where each function works in isolation, Defensio unifies detection, response, vulnerability management and compliance in a distributed architecture in which every component communicates natively with the others, sharing data, context and intelligence in real time.
The Seven Components of the Ecosystem
The Defensio ecosystem is structured in seven distinct components, each with a specific role. What one component learns, the whole ecosystem knows.
Inside the company network
Defensio Sensor
The sensor is installed inside the company network, as a physical or virtual appliance. It works in standalone mode, with all detection and assessment capabilities built in, or connected to the SOC for centralized fleet management. Built-in capabilities:
- Threat Detection: deep traffic inspection, rules aligned with MITRE ATT&CK
- Vulnerability Assessment: priority on the exploits that are really circulating
- Deception: decoy services on the network, where every touch is an almost certain alarm
- Network inventory: every device catalogued, even those never inventoried
- Devices and applications: type, brand and model; applications by name
- Shares and passwords: the paths ransomware really uses
- Post-access verification: in-depth checks on shares and the domain
- Web application testing: OWASP categories on internal and exposed apps
- Digital identity: credentials found in breach databases
- Attack surface: subdomains, DNS and certificates as seen from outside
- Data transfers: exfiltration and unauthorized remote access
- CVEs in images and containers: the layer network scans do not see
- Software bill of materials: what each component really contains
- Exposed secrets: credentials forgotten in repositories and file systems
- Cloud posture: audits against recognized benchmarks
- Reporting: Executive, Technical and Compliance, included
External perimeter · on-premise
Defensio XT
Defensio XT is the on-premise version of Defensio SECaaS. Installed on the client’s infrastructure, it includes the same complete stack of external scanning and assessment engines as the cloud platform, with full local control of the data.
- Continuous external scanning: the public perimeter analyzed as a real attacker would
- AI prioritization: every vulnerability put in context with threat intelligence and prioritized on the real risk of exploitation
- Digital Identity Protection: always-on breach monitoring run locally
- SOC-connected mode: external scans can be delegated to the DENG engines at the operations center
Dedicated engines · driven by the SOC
Defensio DENG
The ecosystem’s dedicated scan engines, driven by the SOC. When a Sensor is connected to the operations center, all analysis of the external perimeter is delegated to them: redundant instances, with dedicated IP addresses and infrastructure isolation for every monitored organization. Scans therefore start from addresses separate from browsing traffic, and the load never weighs on the observed network.
Operations center · MDR
Defensio SOC
The SOC (Security Operations Center) is the operational heart of the ecosystem: the control room receives the telemetry of all sensors and scan engines, has it analyzed by the AI pipeline and brings to the analysts only what deserves a human decision.
- Fleet Management: health and remote management of the entire sensor fleet from the control room
- Real-time Threat Detection: triage dashboard with severity classification and searchable history
- Cyber Threat Intelligence: multi-dimensional correlation and enrichment from multiple intelligence sources
- Task Orchestration: centralized scheduling and management of scans across the whole monitored network
- Morning Briefing: the summary of overnight events, ready every morning for the incoming shift
- Incident Storyline: attack chains reconstructed automatically, event after event
- Escalation Inbox: every decision taken stays recorded in a searchable audit trail
- SOAR advisory: response recommendations that always require a person’s approval
- Guided escalation: precise neutralization instructions, delivered to the IT team that has to act
- NG Reporting: Executive, Technical, Compliance and Custom, generated and distributed automatically
Cloud · self-service
Defensio SECaaS
The self-service cloud platform for Attack Surface Management: continuous external scanning of assets exposed on the Internet, AI prioritization on the real risk of exploitation and audit-ready reporting. No infrastructure to install: you enter the targets and monitoring starts. Also available in white label for MSSPs and technology partners.
Email domain
Defensio Identity Shield
It defends the organization’s email identity from spoofing, BEC fraud and lookalike domains: continuous monitoring of the domain’s posture (SPF · DKIM · DMARC), scheduled spoofability tests, surveillance of domains that imitate the brand and oversight of transport encryption. It is activated with a single DNS record and changes nothing in the mail flow.
Cross-cutting · in every product
Defensio Report
The Next Generation reporting engine turns raw data into high-fidelity professional documents: a compliance-ready format with tactical visualizations, severity charts, exposure maps and operational recommendations. Included in every product of the ecosystem, in Executive, Technical and Compliance formats.
Included in every product
The Multi-Stage AI Pipeline
The distinctive element of the Defensio ecosystem is the multi-stage AI pipeline that handles the triage of security events: every day a huge volume of events enters the operations center, and only the few decisions that deserve human attention reach the analyst.
1 · ML Gatekeeper
A machine learning model filters out the noise and the benign mass of events in milliseconds, letting only real anomalies through.
2 · Contextual Enrichment
Each suspicious event is enriched with Sensor data, such as the asset involved, known vulnerabilities and the network’s usual behavior, and cross-checked with public threat intelligence sources, to give the AI all the context available.
3 · Triage
Specialized language models classify each alert and produce clear explanations, not jargon.
4 · Independent Cross-Validation
A second, independent model re-evaluates the same evidence: if the verdicts agree the outcome is final, otherwise the case moves on to deep analysis.
5 · Deep Reasoning
The final analysis correlates events from different sensors, maps the threat to the MITRE ATT&CK framework and generates a tactical briefing ready for the analyst.
The Human Analyst: Strategic Command
The alert reaches Fidem’s control room already pre-analyzed, correlated, mapped to MITRE and classified by severity. The analyst wastes no time deciphering logs or rebuilding context, and focuses on tactical assessment and incident containment. Each confirmation or correction periodically retrains the models: the pipeline learns the noise and context of every network.
Privacy by Design: Fully On-Premise AI
Defensio’s AI architecture is designed to operate fully air-gapped. The language models run locally on proprietary hardware: no client network data ever leaves the perimeter of Fidem’s infrastructure. No calls to external APIs, no transit through third-party clouds. Full GDPR compliance and guaranteed data sovereignty.
Three Operating Modes
The Defensio ecosystem supports three operating modes, enabled according to the client’s resources and needs:
Manual · Entry
The analyst decides
Analysts handle triage from the proprietary correlation dashboard, without algorithmic filters: for those who want human control over every single event.
Hybrid · Balanced
AI filters, the analyst decides
The ML gatekeeper filters the noise, the assessment stays human: drastically reduced alert fatigue and full analyst control over every decision.
Full AI · Elite
The analyst decides, with the full picture
The complete pipeline is active, with cross-validation and automatic briefings: investigations reach the analyst ready for a decision.
Guaranteed supervision: the performance of the AI pipeline is monitored constantly and human control is structural in every operating mode.
Purchase Model
The Defensio ecosystem follows a modular model: each component can be bought and used independently of the others.
- Defensio Sensor: available on its own as an on-premises sensor for internal monitoring of the company network, with sixteen analysis engines built in and reporting included, installable as a physical or virtual appliance
- Defensio XT: available on its own for those who only want continuous external scanning of the Internet-facing perimeter, installable on their own infrastructure
- Defensio SECaaS: available on its own as a cloud service, with no infrastructure of your own required; details at defensio.technology/secaas
Defensio SOC: the Command Center
Organizations that choose Defensio SOC get the ecosystem’s command center: Sensors connected to the operations center, the dedicated DENG engines, the multi-stage AI pipeline, NG reporting and the oversight of Fidem analysts in the control room. The other components, XT, SECaaS (also under your own white-label brand) and Identity Shield, are activated when needed. The SOC is available managed by Fidem or under license, for those who want to run it themselves with their own sensors and their own clients.
From the same operations center Fidem delivers Custos, the system administrator and privileged access logging service required by the Italian Data Protection Authority and by NIS2. The same deployment model, with an on-site presence and the operations center in Italy, is also used by RAISE, Fidem’s predictive risk management platform for strategic infrastructure.
Certifications
Fidem is certified ISO/IEC 27001, ISO/IEC 27017 (cloud security), ISO/IEC 27018 (protection of personal data in the cloud) and ISO 9001; the Defensio ecosystem is registered at CSA STAR Level 1 (Cloud Security Alliance). How the products are built, where data resides and how tenants are separated is documented publicly in the defensio.technology Trust Center.
Activate the Defensio Ecosystem for Your Company
Whether you are an SME that needs managed protection or an enterprise that wants to equip its IT team with advanced tools, the Defensio ecosystem adapts to your needs with a flexible, scalable deployment model.
Contact us for a consultation on the Defensio ecosystem or to assess how it can protect your organization.
Explore the individual components: Defensio Sensor · Defensio SOC · Defensio XT · Defensio SECaaS · Defensio Identity Shield