NIS2 requires incident detection in 24 hours. Deception helps.

NIS2 requires "essential" and "important" entities in the EU to implement technical measures to detect and respond to cyber incidents. The directive does not prescribe specific tools, but it does require organisations to prove they can detect an intrusion and report it within 24 to 72 hours. Deception technology is one of the most defensible ways to show you can.

What NIS2 actually requires

Article 21 of NIS2 calls for risk management measures that include incident handling, network monitoring, and intrusion detection. Article 23 requires incident notification: a preliminary report within 24 hours, a detailed assessment within 72 hours.

The challenge is that most organisations cannot meet the 24-hour window reliably. Average breach dwell time in Europe is still measured in weeks. You cannot report in 24 hours an intrusion you haven't detected.

Why deception helps

Deception collapses dwell time. A decoy is found during the reconnaissance or lateral movement phase — before the attacker reaches their target — and that event is unambiguous. There is no "was this legitimate traffic?" question to answer before you open an incident.

For NIS2 specifically, decoys provide something auditors find compelling: a complete, timestamped audit trail of every interaction with the decoy, with no false positives to explain away. When you report to your national CSIRT, you can say exactly when the intrusion was detected, what the attacker did, and what you did in response.

The 24-hour window in practice

If a decoy fires at 02:00, Kandaro creates an incident, explains it in plain English, and sends an alert to your team. Your on-call engineer does not need to be a network forensics expert to understand it. By 03:00 you have a preliminary report ready: source IP, attacker behaviour, affected systems (none — it was a decoy), and the steps you took.

That timeline is what NIS2 asks for. Kandaro makes it achievable for teams that don't have a 24/7 SOC.

Read more about Kandaro and NIS2, or deploy your first decoy.