Fidem designs and installs the probe in your network. The complete product data sheet, with pricing and activation, is network security monitoring with a passive probe on defensio.technology.
Defensio Sensor: Continuous Monitoring of the Internal Network
Defensio Sensor is the on-premise component of the Defensio ecosystem deployed in the client’s infrastructure. It performs real-time threat detection on network traffic, internal and external vulnerability assessment, attack surface management, port and service mapping, detection of shared network folders and checks for unauthorized SMB access, traffic flow analysis and credential leak monitoring. It needs no agents on individual endpoints: it works passively alongside the network, is compatible with mixed IT/OT infrastructure and with the continuous monitoring obligations of NIS2 (Italian Legislative Decree 138/2024).
The Sixteen Analysis Engines
Specialized, automatically updated engines work in parallel inside a single appliance. None of them requires software installed on endpoints.
Threat Detection
Deep, real-time traffic inspection, with proprietary rules aligned with MITRE ATT&CK.
Vulnerability Assessment
Priority on the exploits that are really circulating, not on the theoretical score of the flaw.
Deception
Decoy services that imitate the real ones: every single touch is an almost certain alarm.
Network inventory
Every device that appears on the network is catalogued, even those never inventoried.
Devices and applications
Type, brand and model of devices; applications recognized by name.
Shares and passwords
Reachable shares and weak credentials: the paths ransomware really uses.
Post-access verification
In-depth checks on shares and the domain, after authentication.
Web application testing
OWASP Top 10 categories on internal and exposed web applications.
Digital identity
Company credentials that ended up in breach databases, with early warning.
Attack surface
Subdomains, DNS configurations and certificates: the perimeter as seen from outside.
Data transfers
Monitoring of outbound transfers and unauthorized remote access.
CVEs in images and containers
The application layer that classic network scans do not see at all.
Software bill of materials
What every installed component really contains, component by component.
Exposed secrets
Credentials and keys forgotten inside repositories and file systems.
Cloud posture
Configuration audits against recognized benchmarks for cloud environments.
Reporting
Executive, Technical and Compliance reports, generated on real data and included.
Coverage, in Numbers
Capabilities can be described, coverage can be counted. These are numbers measured on the sensor, not estimates, and they grow by themselves with the automatic updates.
over 224,000
active checks
the total of what the Sensor verifies
over 115,000
detection rules
applied to traffic in real time
over 95,000
vulnerability tests
on systems and services
over 12,900
targeted templates
the rapid response when a new flaw comes out
over 640
cloud posture checks
against recognized benchmarks
over 900,000
known vulnerabilities
the reference database for the supply chain
The count also includes network scanning scripts, web application rules and post-access verification modules. Of the known vulnerabilities in the database, more than 1,600 are actively exploited: they are the ones that weigh most in prioritization.
The Intelligence on Board the Sensor
The analysis is not a single block: it has six layers, and the distinction matters. The first four are deterministic and run entirely on the appliance, with no AI and no GPU: on their own they are the complete standalone product. The last two are optional and are added on top, they do not replace anything.
Deterministic · on board
Normalization and enrichment
Every source is brought back to a common schema and entities are resolved: device, flow, domain, user. Each one is linked to the criticality of the asset and to the context already collected by the other engines.
Deterministic · on board
Correlation rules
Rules written, versioned and tested like code, each mapped to MITRE ATT&CK. They do not look at the single event but at the combinations and thresholds that matter.
Deterministic · on board
Anomaly detection
Classic machine learning on behavioral baselines: suspicious periodicity, rarity, statistical deviations. No language model, no GPU.
Deterministic · on board
Risk scoring and case building
The previous layers and the context come together in a score per entity; events are deduplicated and grouped into a case with evidence, associated techniques and confidence level.
Optional · on board
Natural language summary
A small model running on the appliance explains the case in understandable words and suggests the next step. It is anchored to the evidence of the previous layer and never decides in its place.
Optional · only if connected
Link to the SOC
The case already built goes up to the operations center, where it enters the correlation across different sensors and the deeper reasoning.
What It Really Sees on the Network
Encrypted traffic
Applications by name
Knowing that a device “talks HTTPS on 443” helps nobody. The Sensor resolves encrypted traffic into the names of real applications, such as video, social media, cloud storage, updates and remote access tools, starting from data it already captures, without adding any probe. Over a day about 90% of encrypted connections are attributed to a named application, from a catalog of over 6,000 signatures for more than 200 applications. The rest is honestly marked as unknown: modern traffic is designed to hide its destination, and anyone who promises 100% is not measuring.
Passive inventory
Who is on the network
Every device that appears is catalogued without agents and without querying it: addresses, manufacturer, exposed services, usual behavior. Recognition goes down to type, brand and model, such as printer, camera, PLC, phone or company laptop, derived exclusively from signals already present in the traffic. No packet sent to the device means no risk for a PLC on the production line. Every client has its own record and timeline: when it appeared, what it contacted, how it usually behaves. It is the inventory NIS2 demands and that in most networks does not exist or is two years out of date.
From Vulnerabilities to the List You Act On
A scan that returns three thousand “critical issues” is not a result: it is another way of not knowing where to start. Every finding is enriched with the official catalog of actively exploited vulnerabilities and with the observed probability of exploitation, then cross-checked with what that device really is and how exposed it is. “Critical on paper” is one thing; a flaw with an exploit circulating today, on a reachable service, is another. Web applications are tested by two independent engines and the results deduplicated, so the same thing is not counted twice. For every newly published vulnerability we develop the test that detects it in-house.
The vectors that really lead to ransom
Ransom does not come from an exotic exploit: it comes from a share open to everyone, a weak reused password, a remote access tool installed by someone and never removed. The Sensor looks for exactly this. It finds exposed shares and actually verifies the strength of credentials, with a controlled test that is safe against account lockouts: it tries one password at a time across all users, not all passwords on one user, so no account gets locked. It recognizes unauthorized remote access tools and monitors outbound data transfers, the moment when a compromise becomes a breach that has to be notified.
The Software Supply Chain
Vulnerabilities are not only in operating systems: they are inside the images and containers that make up modern applications, a layer that classic network scans do not see at all. The Sensor runs a scheduled daily scan of images and containers, produces the software bill of materials (what each component really contains) and looks for credentials and secrets exposed in repositories and file systems, which is the fastest way for an attacker to get from outside to inside. For cloud environments, posture audits against recognized benchmarks are added. We apply it to ourselves first: the platform analyzes its own images with the same yardstick it uses for yours.
An Appliance That Runs Itself
A sensor that needs someone sitting in front of the machine is not a product: it is a commitment. The Sensor runs as real server software, with no graphical interface: the engines are supervised system services, they restart by themselves and nobody can switch them off by closing a window by mistake. Disks are encrypted at rest, and if the machine restarts at night it stays stopped and secure until the volumes are unlocked. The operator sees the status and logs of every engine from the browser, from anywhere, without console access. Detection content updates itself, at different intervals depending on how quickly it ages, with no maintenance windows and without interrupting traffic capture.
How It Fits into the Network
Defensio Sensor is deployed as a dedicated appliance, physical or virtual, in the client’s network, connected via a SPAN port, passive TAP or mirror port on the core switch. It adds no latency. Traffic is analyzed as a copy: nothing inline, no impact on production traffic.
Client access always guaranteed: Fidem manages the configuration and the administration of the platform, but the client has direct, independent access to its own instance, the same complete platform and not a reduced view: dashboards, real-time alerts, asset inventory, scan and assessment results, traffic flows, reports and module status. No “black box”.
Connection to the Fidem SOC (optional): when the Sensor is connected to the Fidem CSOC, alerts are sent in real time to the analysts through an encrypted VPN tunnel, activating managed monitoring and response.
Ways to Use It
Standalone, managed by the internal team
The client uses the Sensor independently. Fidem provides the platform, signature updates and technical support. Triage and response to alerts are handled internally. Ideal for organizations with a structured IT team that wants full visibility without outsourcing alert management.
CSOC Managed, connected to the Fidem SOC
The Sensor becomes part of Fidem’s managed monitoring service. The CSOC team handles triage, escalation and incident response. The client always keeps full access to and visibility of its own instance.
Defensio Sensor and NIS2 Compliance (Italian Legislative Decree 138/2024)
For organizations subject to NIS2, the Sensor directly covers the obligations of Art. 21:
- Continuous network monitoring: Art. 21(2)(b), continuous detection of anomalies and incidents
- Vulnerability management: automated VA with scoring and a documented remediation plan for the ACN evidence pack
- Up-to-date asset inventory: automatic mapping of the infrastructure as a mandatory NIS2 baseline
- Supply chain security: Art. 21(2)(d), visibility of traffic towards suppliers connected to the network
- OT Security: fully passive mode, no interference with OT/SCADA industrial protocols
- Early warning with deception: the built-in decoys reveal lateral movement and internal reconnaissance before they touch real assets, supporting incident management (Art. 21(2)(b))
- Detection of exfiltration and unauthorized remote access: Data Transfer Analytics and RMM Detection identify anomalous outbound channels and unlisted remote control tools
For the complete compliance path: NIS2 Compliance with Fidem
NG Reporting Included
Like every component of the ecosystem, the Sensor includes the NG (Next Generation) reporting engine: monitoring and assessment data become professional, compliance-ready documents, Executive, Technical and Compliance, generated and distributed on schedule.
Request an Infrastructure Assessment
Every deployment starts with an analysis of the network topology to identify the best connection point (SPAN, TAP, mirror port) and configure the Sensor correctly on your infrastructure.
Full product data sheet
The up-to-date data sheet of the passive network probe for company network monitoring is on defensio.technology, together with the SOC as a service that receives its telemetry and the continuous vulnerability scanning of the external perimeter.