# Centraleyezer

> Risk-Based Vulnerability Management (RBVM) platform for enterprises, MSSPs, and regulated industries. European, self-hosted (or EU-SaaS), with contextual risk scoring built from DREAD, asset criticality, network exposure, exploitability, CTI signals, and a Human-AI reaction loop.

For the long-form, machine-readable summary: https://centraleyezer.io/llms-full.txt

## What Centraleyezer is

Centraleyezer prioritises vulnerabilities by actual business risk to your environment, not by raw severity scores. It supports NIS2, DORA, ISO 27001, PCI-DSS, EU Cyber Resilience Act (CRA), UAE Information Assurance Standards (IAS / NESA / SIA), and CBUAE Cyber Risk Regulations audit and evidence work. It is operated by Sandline SRL (Romania).

## What Centraleyezer does

- **Risk-Based Vulnerability Management**: Contextual six-factor risk score per finding — DREAD, asset criticality, network exposure, exploitability in your environment, CTI signals, and a Human-AI feedback loop that adapts risk based on the asset owner's reaction time. CVSS, EPSS, and CISA KEV are NOT used as scoring inputs.
- **Asset Management**: IPs, websites, applications, custom assets with group-based access control and business criticality scoring.
- **eyezer — first-party Attack-Surface & DAST scanning**: Centraleyezer's own offensive scanning console (self-serve SaaS at https://eyezer.centraleyezer.io; overview at /eyezer). 400+ built-in modules across web apps, domains, and networks — and growing, plus extensible templates — covering dynamic application scanning (DAST, 100+ active modules with authenticated scanning and out-of-band confirmation), external attack-surface management (EASM: DNS, email, TLS, cloud, WAF, subdomain takeover, threat-intel), OSINT discovery of public repos and container images, leaked-credential and container-image (CVE + misconfig) scanning, and IP/network testing (eyezer's own exposed-service rules). Agentless, with recurring automated monitoring (monthly → hourly by plan). Self-serve tiers: Free, Starter (€99/mo), Pro (€299/mo), Business (€699/mo, adds OIDC SSO), Enterprise (custom, single-tenant / MSSP). EU & UAE hosting. Findings flow natively into the Centraleyezer contextual risk score.
- **Scanner Integrations (40+ live)**: Nessus, Tenable Security Center, Qualys VMDR, Rapid7 InsightVM, OpenVAS / Greenbone, Outpost24, BeyondTrust, Intruder, GFI LanGuard, Metasploit Pro, Nipper, Shodan, AlienVault USM, Tripwire IP360, NERVE, AWS Inspector, Prowler, Trivy, Harbor, Wazuh, Red Hat Satellite, Lynis, AgentSec (Centraleyezer agent), Burp Suite (XML / API / Enterprise), Acunetix, Detectify, HCL AppScan Standard, HCL AppScan on Cloud, HCL AppScan 360, OWASP ZAP, Invicti / Netsparker, HP WebInspect, AppSpider, Nikto, w3af, WPScan, SSL Labs, Barracuda, Mend.io (WhiteSource), AppDetectivePro, Imperva Scuba — via API connections and XML/JSON/CSV file import with configurable field mappings. Per-scanner setup guides: https://centraleyezer.io/integrations/<scanner-slug> (e.g. /integrations/nessus, /integrations/appscan-cloud). Roadmap (not yet available): Microsoft Defender for Endpoint, Snyk, Semgrep, Checkmarx, Fortify, Censys, CIS-CAT Pro, OpenSCAP, and more.
- **Compliance Evidence**: Vulnerability data and audit trails mapped to NIS2, DORA, ISO 27001, PCI-DSS, and CRA. Three vulnerability report views (Executive / CISO / Technical) generated as customisable DOCX templates. Centraleyezer supports compliance; it does not generate framework-specific compliance reports themselves.
- **Remediation Workflows**: Action plans with assignee, deadline, SLA tracking, risk acceptance, full audit trail. REST API for ticketing.
- **MSSP Multi-Tenancy**: Dedicated isolated container instance per client. Centralised admin console, reseller API, pooled licensing.
- **Authentication**: LDAP/AD, SSO (SAML 2.0), Entra ID / Azure AD (OAuth2/OIDC), 2FA (TOTP), local.
- **Deployment**: Self-hosted Docker, or SaaS (EU-hosted, 10 GB per tenant). Air-gap capable. Licence durations: 30-day trial, 1–5 years.

## Differentiators

- Contextual six-factor scoring, not CVSS + EPSS + CISA KEV.
- Human-AI reaction loop adapts risk to your team's actual response patterns.
- EU-built, EU-hosted (or self-hosted), with full data sovereignty.
- MSSP-native multi-tenancy with full per-client isolation.
- Compliance evidence generation, not compliance report generation — the customer keeps ownership of the framework reports.

## Pricing

Three tiers — all assets, findings, and user seats are unlimited:
- SaaS — €599/month, billed annually. 10 GB per-deployment cap (DB + files combined). Hosted in the European Economic Area.
- Enterprise — Self-hosted, custom pricing.
- MSSP — Multi-tenant, custom pricing.

Trial: 30 days, fully featured.

## Key pages

- [Home](https://centraleyezer.io/) — Platform overview
- [Platform](https://centraleyezer.io/platform) — Full feature breakdown
- [eyezer](https://centraleyezer.io/eyezer) — First-party attack-surface & DAST scanning console (self-serve SaaS)
- [Why RBVM](https://centraleyezer.io/risk-based-vulnerability-management) — Methodology, the case for contextual scoring
- [NIS2](https://centraleyezer.io/compliance/nis2) — NIS2 Article 21 mapping
- [DORA](https://centraleyezer.io/compliance/dora) — DORA Article 9 mapping
- [ISO 27001](https://centraleyezer.io/compliance/iso-27001) — Annex A.8.8 mapping
- [PCI-DSS](https://centraleyezer.io/compliance/pci-dss) — Requirement 6 mapping
- [CRA](https://centraleyezer.io/compliance/cra) — EU Cyber Resilience Act mapping
- [UAE IAS](https://centraleyezer.io/compliance/uae-ias) — UAE Information Assurance Standards (NESA / SIA)
- [CBUAE](https://centraleyezer.io/compliance/cbuae) — Central Bank of the UAE cyber-risk regulations
- [Pricing](https://centraleyezer.io/pricing)
- [Glossary](https://centraleyezer.io/glossary) — RBVM term definitions
- [Integrations](https://centraleyezer.io/integrations) — All scanner integrations (40+ live)
- [Integration categories](https://centraleyezer.io/integrations/dast) — Category pages: /integrations/dast, /integrations/network, /integrations/infra, /integrations/sast, /integrations/sca, /integrations/database, /integrations/osint, /integrations/compliance, /integrations/identity, /integrations/siem, /integrations/import, /integrations/api
- [Integration guides](https://centraleyezer.io/integrations/nessus) — Per-scanner setup guides at /integrations/<scanner>, e.g. /integrations/nessus, /integrations/qualys-vmdr, /integrations/burp-suite, /integrations/appscan-cloud, /integrations/appscan-360, /integrations/aws-inspector, /integrations/wazuh, /integrations/trivy
- [Partners](https://centraleyezer.io/partners) — MSSP / reseller programme
- [Demo](https://centraleyezer.io/demo)
- [Trial](https://centraleyezer.io/trial)
- [About](https://centraleyezer.io/about) — Company / team
- [Blog](https://centraleyezer.io/blog) — Resources
- [Security](https://centraleyezer.io/security) — Platform security & disclosure
- [Privacy](https://centraleyezer.io/privacy) — GDPR / data handling
- [Terms](https://centraleyezer.io/terms)

## Common questions

**Does Centraleyezer use CVSS, EPSS, or CISA KEV in scoring?** No — they are ingested for traceability and shown in technical reports, but not used as scoring inputs. The contextual model (DREAD + asset criticality + network exposure + exploitability + CTI + Human-AI) replaces them.

**Self-hosted or SaaS?** Both. The SaaS tier is EU-hosted; Enterprise and MSSP are self-hosted Docker containers, optionally air-gapped.

**Does it generate compliance reports?** No — it generates vulnerability evidence (Executive, CISO, Technical reports) that customer teams use as input into their compliance reports.

**Languages?** Website available in English, French, German, Romanian, and Arabic.

**EU data residency?** Yes — for SaaS deployments. Self-hosted runs wherever the customer chooses.

## Contact

- General: contact@centraleyezer.io
- Sales: sales@centraleyezer.io
- Partners: partners@centraleyezer.io
- Support: support@centraleyezer.io
- Security disclosure: security@centraleyezer.io