Critical functions rarely fail alone. They fail through dependencies — ICT services, providers, contracts, infrastructure, data and recovery capabilities.
VigieObs turns dependency risk into resilience decisions.
Registers, contracts, provider lists, test reports and evidence folders each hold part of the picture. VigieObs connects them into one operational model, so every function can be traced to its dependencies, every dependency to its evidence, and every exposure to a decision.
Leaders are now personally accountable for resilience, for third parties and for AI. They need to show what they decided, on what evidence, and what it changed.
Sources: Splunk, The CISO Report 2026: From Risk to Resilience in the AI Era (survey of 650 CISOs worldwide, all sectors); European Banking Authority, final report on the guidelines on the sound management of third-party risk.
VigieObs maps the relationships that determine whether critical operations can withstand disruption. Select any object to see what it connects to.
What happens if a critical provider fails? Don't just document resilience. Simulate it.
A provider fails, or a rule changes: VigieObs propagates the shock through the same operational model, prepares the options, and keeps the decision, its owner and its effect.
Services, critical functions and recovery objectives affected, hour by hour, with the fallbacks that hold and the exit plans that are missing.
Arrangements to amend or to upgrade at renewal, providers and critical functions concerned, controls to redo, effort and time left before application.
Options, choice, justification, owner and re-examination date, approved by a second reviewer, re-opened automatically when a linked item changes.
Key indicators tracked over time, and for every approved decision, the state of linked items before and after. The answer to the 41% of CISOs who cannot link remediation to risk reduction.
Illustrative data.
VigieObs connects regulatory requirements to operational reality.
A checklist. The organization behind it stays invisible.
A living model of how the organization actually operates, and of what it can prove.
VigieObs connects scenarios to the actual functions, dependencies and providers, then tracks the tests, findings and remediation that follow.
Every conclusion remains connected to the evidence and operational data behind it.
Intelligent agents accelerate resilience work without taking control away from the people accountable for the decision.
Signals, anomalies and changes, from identifiers to new rules.
Dependencies, exposure and impact across functions and providers.
Extreme but plausible disruptions on your own model.
Tests, evidence requests, reports and options, with sources cited.
Recommendations are grounded in the VigieObs operational model and remain subject to human validation.
Built for DORA, designed beyond it. Each framework runs on the same operational model, so the work you do once counts everywhere it applies.
Every deliverable prepared from the data, with the trail behind it.
ICT under DORA, non-ICT under the EBA guidelines, in one lifecycle.
For entities outside DORA, measures pre-filled from DORA and ISO 27001.
Extreme but plausible scenarios and two-hour resumption, mapped to the CPMI-IOSCO texts.
Which critical functions rely on a model, and what happens if it fails.
VigieObs supports the people accountable for compliance; it does not certify it. Summaries and mappings are prepared by VigieObs and linked to the official texts.
VigieObs checks the register of information continuously as the data changes, detects the anomalies that would get it rejected, and generates the official submission package, validated against the EBA's own rules.
Invalid LEIs, duplicates, broken links, missing exit strategies, one provider under several names, EU critical providers.
Article 30 requirements extracted, every value cited, contradictions with the register flagged.
The EBA package, run through its own validation rules: rejections known before you file.
Each anomaly assigned to its owner, with a deadline; corrections reviewed before they land.
Import the entities' files or last year's EBA package; VigieObs rebuilds the four tables with their links, flags every anomaly and assigns it to the entity that owns it.
Pre-contract analysis, risk assessment, due diligence, periodic review and exit, with the strengthened requirements shown only where a critical function is supported.
Pick a provider and a duration, or an extreme but plausible scenario: VigieObs propagates the failure through services, functions and recovery objectives.
22 DORA tests: VigieObs executes those it has the data for, AI pre-assesses the others with cited evidence, and the auditor concludes.
Every reference in a report leads to its source. When the data or a reference text changes, VigieObs shows what depends on it and proposes the update.
Sealed documents, assessed controls, cited contract clauses and audit tests are mapped to DORA, NIS2, the EBA guidelines and CPMI-IOSCO.
Versioned official texts: when a paragraph changes, VigieObs measures the arrangements, providers, critical functions, controls and deliverables affected, and the effort before the application date.
Treat, accept, transfer or avoid a risk, or plan compliance: options, choice, justification and owner, approved with four eyes and measured afterwards.
Generic AI can generate text. VigieObs knows what the text is about, which operational object it refers to, what evidence supports it, what changed, what remains unresolved and what decision follows.
This is where enterprise AI value is moving: governed context graphs that ground agents in reality. VigieObs builds that context for digital operational resilience, from risk to decision.
Understand your dependencies, and what breaks when a provider fails or a rule changes.
Choose with the evidence in front of you, approve with four eyes, re-examine when reality changes.
Show what each decision changed, with a trail an inspector can follow.
DORA is the entry point: mandatory, recurring and audited. The engine underneath is a governed context graph that every resilience framework, and every AI agent, can rely on.
DORA has applied since January 2025, with an annual register of information and supervision now in its control phase. The EBA's new third-party guidelines extend the register to non-ICT services. Leaders carry personal accountability for resilience, third parties and AI.
One operational model for DORA, the EBA third-party guidelines, NIS2, CPMI-IOSCO and AI dependencies, with ISO 27001 imports. Two shocks in one graph, decisions on record, and measured resilience gained.
The operational context: functions, providers, contracts, versioned texts, evidence, decisions and their effects, linked and kept current. Propagation is deterministic and auditable; AI prepares, humans decide.
Annual subscription per group, scaled by entities; licences for audit and advisory firms per engagement; additional frameworks as packs on the same engine.
Regulatory change impact from official sources; a context server so agents such as Claude or Copilot ground their answers in VigieObs; a dedicated AI governance product line once validated with clients.
A working product covering DORA, the EBA third-party guidelines, NIS2, CPMI-IOSCO and AI dependencies. Now opening design-partner pilots with financial institutions.
DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), sets common rules for ICT risk management, ICT-related incident reporting, digital operational resilience testing and ICT third-party risk for financial entities in the European Union. It has applied since 17 January 2025.
It is the register of all contractual arrangements with ICT third-party service providers that financial entities must maintain at entity, sub-consolidated and consolidated level. Its templates are set by Implementing Regulation (EU) 2024/2956, and it is submitted to the competent authority, which passes it on to the European Supervisory Authorities.
Check the register before filing against the EBA reporting format and validation rules: identifiers such as LEI codes, mandatory fields, references between templates, code lists and file structure. VigieObs runs these checks continuously and generates the submission package so that rejections, quality errors and warnings are known in advance.
Article 30 of DORA lists the key provisions that contracts with ICT third-party service providers must contain, such as service descriptions, data locations, service levels, audit and access rights, termination rights and, for critical or important functions, exit strategies. VigieObs reads contracts, extracts these provisions and cites the exact clause.
Financial entities must review their ICT risk management framework at least yearly and after major incidents or supervisory findings, and document the review in a report. Its content is set by Article 27 of Delegated Regulation (EU) 2024/1774. VigieObs prepares the report from the review file and seals it.
VigieObs links critical or important functions to ICT services, providers and contracts in one resilience graph. It shows which functions depend on a single provider, where several providers belong to the same group, and what happens to recovery objectives when a provider fails.
Official texts are versioned. When a paragraph changes, VigieObs propagates the change through everything that depends on it: arrangements and providers, critical functions, audit tests, findings, review report sections and register data. It shows which contracts need an amendment before the application date or can be upgraded at renewal, and estimates the effort with assumptions you can adjust.
Each decision is an object: options, choice, justification, owner and re-examination date, linked to the providers, arrangements, functions or texts concerned and approved by a second reviewer. VigieObs then tracks key indicators over time and shows what changed on the linked items after the decision.
No. VigieObs supports the people accountable for compliance: it prepares, checks and traces the work, and every conclusion remains a human decision. Compliance is assessed by the financial entity, its auditors and its supervisors.
AI reads contracts, pre-assesses audit tests and drafts reports, always citing the evidence it relies on. Sensitive data is masked before any request, every exchange is logged, and nothing is applied without human validation.
Build a living view of your critical functions, providers, evidence and decisions, and prove what each decision changed.
A demonstration on your own questions, a pilot, a partnership for your audit engagements, or an investor conversation: tell us what you need and we will come back to you within two business days.