How are you handling supplier security under DORA and NIS2? Still spreadsheets?

Hi everyone 👋 I’m Gorka, founder of HodeiShield.

Since DORA and NIS2 arrived, a lot of European companies have discovered that their suppliers’ security is now their compliance problem. In most teams we talk to, this still lives in spreadsheets, email questionnaires and a folder of PDFs that nobody re-checks.

We built HodeiShield to put it in one place:

• Continuous monitoring of your vendors’ external exposure (certificates, open ports, headers, CVEs)

• Questionnaires with evidence, mapped to your own controls

• DORA, NIS2, ENS, ISO 27001 and EU AI Act in every plan, with no per-framework fees

• A Trust Center where you publish a cryptographically signed security posture your customers can verify

• Hosted in the EU, and built so MSSPs can manage many clients

Our free 3-month beta starts on 2 November, and we’d love your input before launch day:

1. How do you track third-party risk today?

2. What’s the most painful part: questionnaires, evidence, audits, or incident deadlines?

3. If you’re an MSSP, what would a tool need to do for you to roll it out to your clients?

Every reply helps shape the product. Happy to answer anything about how it works under the hood.