Every signal mapped.
Every decision evidenced.
DeGoyle connects external cyber intelligence to management-body governance — so accountability is documented, treatments are tracked, and evidence is structured before the auditor asks.
Built for CISOs, risk leaders, executives, and boards responsible for evidencing cyber-risk governance across critical operations.
Every signal,
mapped to what matters.
Incoming cyber advisories, CVEs, and sector alerts are automatically matched to the assets, suppliers, and dependencies that matter to your operating environment — not a generic threat feed.
- ✓Configurable ingestion of advisories, CVEs, and sector alerts
- ✓AI-assisted confidence scoring and relevance filtering
- ✓Mapped to your asset, supplier, and dependency graph
- ✓Re-scoring as asset, supplier, and dependency context changes
Every obligation,
tracked in one place.
The Obligations Register surfaces every governance obligation in scope — deadlines, owners, status, and evidence requirements — so the board can see exactly where things stand without manual reporting.
- ✓Compliance horizon with upcoming obligation deadlines
- ✓Owner assignment and accountability tracking
- ✓Evidence status mapped to each obligation
- ✓Board-ready visibility at all times
Named decisions.
Evidenced sign-offs.
Under NIS2 Article 20, management bodies must approve cybersecurity risk-management measures and oversee implementation. DeGoyle supports a defensible governance workflow — every decision named, timestamped, and linked to the scenario it addresses.
- ✓Management-body approval workflow with named owners
- ✓Pending action queue surfaced to the board
- ✓Controlled audit trail of every sign-off
- ✓Evidence packs structured for regulator, auditor, and board review
Test every scenario.
Know where you stand.
Run structured assessments against realistic cyber scenarios mapped to your operating environment. The heatmap makes likelihood and impact visible — so the board sees posture at a glance, not buried in a report.
- ✓Scenarios mapped to critical infrastructure sectors
- ✓Likelihood × impact heatmap with inherent and residual views
- ✓Per-service resilience scoring across all operating domains
- ✓Assessment completion tracking for regulatory obligations
From external intelligence
to accountable governance.
A governed workflow connecting cyber events to leadership review, treatment oversight, and structured evidence — without collapsing the line between operations and the board.
Signal intake
Cyber advisories, vulnerability disclosures, sector alerts, and dependency context — curated for relevance to essential operations.
Exposure mapped
What is affected, where it matters, and how it connects to the operations you cannot afford to let fail.
Board and executive review
Decision-ready risk context for named approval. Treatment, residual exposure, and sign-off status — in one place.
Structured evidence output
A controlled trail of decisions, sign-offs, and escalations — structured for board reporting, audit review, and regulatory scrutiny.
When a cyber issue requires leadership attention, DeGoyle helps teams move from technical detail to a clear governance record: what changed, why it matters, who owns the decision, what action is underway, and what evidence is available for review.
Six capabilities. One governance layer.
Six connected capabilities for visibility, ownership, treatment, review, and evidence.
Visibility into what matters
Map incoming cyber advisories to the assets, suppliers, and dependencies that actually matter to your operating environment.
Cyber signal to decision context
A current view of exposure, treatment status, and residual risk — not scattered technical updates the board cannot use.
Treatment & residual exposure
Track whether risk has been accepted, reduced, transferred, or deferred — and what residual exposure still remains.
Scenario resilience assessments
Assess how your organisation would perform against realistic cyber scenarios relevant to critical infrastructure.
Named sign-off, evidenced
Management-body approvals, pending actions, and oversight through a visible governance workflow.
Structured evidence
Maintain a decision trail designed to support board scrutiny, regulator inspection, and incident-era evidence requests.
Distinct, but connected.
NIS2 separates operational cyber risk management (Article 21) from management body oversight (Article 20). DeGoyle maintains the separation while connecting both layers — so cyber risk signals flow to board-ready decisions and produce auditable evidence.
Operational cyber risk management
Entities must implement technical and organisational measures to manage cyber risk. DeGoyle supports the governance workflow around those measures.
- Planned threat intelligence integration
- Risk register & treatment tracking
- Scenario resilience assessments
- Incident response documentation
- Vulnerability triage workflow
- Supplier & dependency mapping
Management body oversight
Management bodies must approve cybersecurity risk-management measures and oversee their implementation. DeGoyle keeps governance distinct but connected.
- Management-body dashboards
- Approval & sign-off workflows
- Governance audit trail
- Regulatory evidence record
- Escalation & pending-action queue
- Board-ready reporting packs
DeGoyle supports governance workflows and evidence management. It does not provide legal, regulatory, audit or assurance advice. Entities should seek independent professional advice for their specific regulatory obligations.
Not SIEM. Not GRC. The governance layer between them.
DeGoyle does not replace your SOC, SIEM, vulnerability scanner, or GRC platform. It connects relevant outputs from those systems into governance workflows — for ownership, treatment, approval, and structured evidence.
- Your SOC or SIEM platform
- Vulnerability scanners or penetration testing
- Generic GRC or risk-register tools
- Compliance workflow management
- Board reporting tools
A governance workflow layer being built for cyber-risk decisions, ownership, treatment oversight, and evidence — sitting above operational security tooling without replacing it.
- Structured decisions with named owners and sign-offs
- Treatment oversight and residual risk visibility
- Obligation tracking across governance deadlines
- Evidence structured for board, auditor, and regulator review
Being built for sensitive operational environments.
DeGoyle is being designed with governance, access, and auditability as core requirements — not afterthoughts. The specifics of the security model will be shared with pilot participants as part of the discovery process.
Common questions.
Is DeGoyle only for Irish operators?
DeGoyle is built specifically for the Irish and EU regulatory context — NIS2, CER, and Irish management-body governance obligations. Any operator within the NIS2 scope across the EU will find it relevant, but Irish infrastructure is the primary focus at launch.
Does it replace our existing security tools?
No. DeGoyle sits above existing tools as a governance layer. It ingests signals from your environment and connects them to management-body decision-making — it doesn't replace your SOC, SIEM, or technical security controls.
How does management-body sign-off work in practice?
Management bodies receive a clear decision-ready summary of a risk scenario — likelihood, impact, proposed treatment, and residual exposure. They approve or escalate with a named, timestamped sign-off recorded in a controlled audit trail.
What data does DeGoyle need access to?
DeGoyle operates at the governance layer. It requires access to your governance workflows and a mapping of your assets and dependencies — not system-level access to your OT or IT infrastructure.
When is the platform available?
General availability is targeted for September 2026. A pilot programme is open now for a limited number of qualified operators. Early participants will have direct input into the product roadmap.
How long does onboarding take?
The team works closely with each operator to scope and configure the platform for their environment. Onboarding is structured and supported — the pace depends on the complexity of your operating environment and governance baseline.
See DeGoyle in your context.
A 30-minute call with the team. No commitment, no sales process — a direct conversation about your governance obligations and how the platform can support them.