IT environment

Integrations

Integrations are the connect-first funnel. The tab starts with Per integration: for each connection, what it feeds and when it was last read (for example Read in full on 27 Oct 2026 · 1 of the 29 seen). Below that, 1. Foundation is where you pick your identity provider, and 2. Marketplace holds the other integrations. One sync per source covers CyFun Basic, Important, and Essential, whichever tier your framework is set to.

Microsoft 365

Connect Intune (Microsoft's device-management service) and Entra ID (Microsoft's user directory) once; Sync now whenever you want fresh data. The card shows live counts for devices, users, policies, and evidence, plus a Recent syncs panel with duration and outcome per run. Clicking log on a failed row opens the error detail. Google Workspace sits next to it, as an alternative or alongside.

The card also shows how the controls it covers stand, for example 6 pass · 5 partial · 9 fail. That feeds the status of each control on Audit.

EDR & endpoint protection

EDR stands for Endpoint Detection and Response: the always-on security agent that runs on each laptop and server. In the Marketplace, filter on the category Endpoint protection (EDR). Today you can connect Bitdefender GravityZone, SentinelOne Singularity, Sophos Central or Checkpoint Harmony Endpoint. Click Connect and enter the API credentials from your provider's console. If a provider stops accepting them, the card says Connection failing with the reason; create a new key there and click Reconnect.

Aikido Security (Application Security)

Application Security (AppSec) covers the things EDR can't see: vulnerabilities in your code and dependencies, secrets accidentally committed to a repository, misconfigured cloud settings, and unpatched container images. If your team builds or maintains its own software, connect Aikido Security with the Client ID and Client secret from your Aikido workspace. Each sync feeds Audit with vulnerability findings and repositories under scan. The card has Sync, Show history and Disconnect.

Size

An auditor will ask: "is what you show me all of your estate?" The Size tab is where you answer that once, explicitly. The top of the tab shows seven cards (devices, accounts, employees, applications, suppliers, workplaces, networks), each with the actual count next to the declared one. Under Declared estate, enter the real counts. Each field shows what the integrations currently see ("App sees 29"). Click Confirm when the numbers are right.

If Microsoft 365 only sees 12 devices and you declare 83, the audit punch list flags the difference as a population gap. Until you confirm, it cannot detect population gaps at all.

Accounts and Employees are two separate lines: Microsoft 365 counts every account (shared mailboxes included), training and read confirmations count people. Employees can be a number you enter or the members of a Microsoft 365 group. See Accounts and employees.

Inventory

One list of every device, employee, and application. Filter by type with the chips (All / Device / Employee / Application / Supplier / Network / Workplace, each with a count), and by Protection status (All / Covered / Not covered). Each row shows where it comes from (via integration or added by you), whether it is covered, and which groups it counts in.

Click Import CSV to add entities in bulk. The AI-assisted importer auto-detects column types and entity kind (device vs. employee vs. application) from the header row. NL/FR/EN are all supported. See Importing devices and employees for the full guide.

What falls outside NIS2

Not everything you own counts for NIS2. On the Size tab, the Outside NIS2 section shows every exclusion and why it is there, in three parts: Whole groups (Put a group outside NIS2), Single items (Put something outside NIS2) and Rules. A whole group could be the phone systems you host for customers; a single item, one old laptop. Every exclusion needs a reason, and your auditor reads it. What is outside is not assessed anywhere.

More on scope.