--- title: Software for IT, OT, and SaaS governance canonical: https://www.secnostic.com/en language: en dateModified: 2026-08-30 alternate-de: https://www.secnostic.com/de --- # Software for IT, OT, and SaaS governance - URL: https://www.secnostic.com/en - Markdown: https://www.secnostic.com/en/home.md secnostic connects inventory, sensing, alerting, and SaaS governance into a dependable software baseline for IT and OT decisions. secnostic is modular software for IT/OT asset inventory, controlled asset discovery, platform governance, and alerting. It connects assets, technical context, and open risks in a shared operating picture for IT, OT, and compliance. ## Products Four standalone modules that share one model. Start with one and build out step by step, instead of taking on four more silos. - [secnostic inventory](https://www.secnostic.com/en/products/inventory): secnostic inventory turns IT, OT, and infrastructure assets into a shared source of truth for security, operations, compliance, and modernization. (Markdown: https://www.secnostic.com/en/products/inventory.md) - [secnostic sensor](https://www.secnostic.com/en/products/sensor): secnostic sensor inspects endpoints and networks directly, finds assets and their connections, and reports what is actually there. (Markdown: https://www.secnostic.com/en/products/sensor.md) - [secnostic platform](https://www.secnostic.com/en/products/platform): secnostic platform handles tenants, identities, roles, access, and onboarding in one place, so no app has to reinvent any of it. (Markdown: https://www.secnostic.com/en/products/platform.md) - [focusAlert](https://www.secnostic.com/en/products/alert): focusAlert collects events from machines, monitoring, SCADA, or email and brings the right alarm to the right person, not to everyone. (Markdown: https://www.secnostic.com/en/products/alert.md) ## Use cases Production, machine and plant builders, critical utilities, building automation, central IT, managed services. Each one starts with a real problem, not a feature list. - [Manufacturing & production](https://www.secnostic.com/en/solutions/production): secnostic shows which machines, controllers, HMIs, engineering systems, and suppliers a line really depends on. Your team finds incidents faster, plans maintenance more cleanly, and keeps cyber risk in check without slowing production down. (Markdown: https://www.secnostic.com/en/solutions/production.md) - [Machine & plant builders](https://www.secnostic.com/en/solutions/machine-builders): secnostic documents which digital components are installed in every delivered machine, at which firmware level, and with which communication relationships. That creates a reference state at delivery, and from it one central view of the installed machine base. (Markdown: https://www.secnostic.com/en/solutions/machine-builders.md) - [Critical infrastructure and utilities](https://www.secnostic.com/en/solutions/infrastructure): secnostic shows which facilities, IT/OT systems, networks, and suppliers keep your critical services running. Operations and security see dependencies, maintenance risks, vulnerabilities, and response paths in one shared picture. (Markdown: https://www.secnostic.com/en/solutions/infrastructure.md) - [Building automation and building management systems](https://www.secnostic.com/en/solutions/building-automation): secnostic connects building automation, building management systems, and technical building services in a dependable OT view. Facilities, IT, and security teams can see assets, communication paths, remote access, vulnerabilities, and ownership without unnecessarily touching live building functions. (Markdown: https://www.secnostic.com/en/solutions/building-automation.md) - [Central IT administration](https://www.secnostic.com/en/solutions/it): One current data baseline for endpoints, servers, cloud, SaaS, identities, software, and ownership. So IT operations, security, and the service desk work from the same facts. (Markdown: https://www.secnostic.com/en/solutions/it.md) - [Managed service providers](https://www.secnostic.com/en/solutions/msp): secnostic connects IT and OT environments, assets, risks, and evidence, cleanly separated per tenant. MSP teams work from a current technical view of each customer environment. (Markdown: https://www.secnostic.com/en/solutions/msp.md) ## Practical guidance backed by named sources Technical guides connect concrete operating questions with named authors, an updated date, and the sources behind each claim. - [CRA, CE, and asset discovery for machinery](https://www.secnostic.com/en/resources/cra-ce-asset-discovery-machinery): The main CRA obligations apply from 11 December 2027 to new products with digital elements. Where their product falls within scope, machine builders need to assess cybersecurity risks, maintain technical evidence, handle vulnerabilities throughout the support period, and declare conformity before placing the product on the market. The CRA does not literally mandate an automated inventory of every network device. A current OT asset inventory does, however, provide operational data for checking product scope, firmware states, and change. (Markdown: https://www.secnostic.com/en/resources/cra-ce-asset-discovery-machinery.md) - [ITAM vs. OTAM in operations](https://www.secnostic.com/en/resources/it-vs-ot-asset-management): ITAM and OTAM need a shared data model but different collection and operating rules. CISA structures OTAM as a maintained asset inventory plus a taxonomy for function, criticality, communication paths, and dependencies. For critical infrastructure operators, the BSI catalogue adds expectations for completeness, accuracy, currency, consistency, accountability, and traceable change. (Markdown: https://www.secnostic.com/en/resources/it-vs-ot-asset-management.md) ## Sources - [EU Cyber Resilience Act](https://eur-lex.europa.eu/eli/reg/2024/2847): Official EUR-Lex text of Regulation (EU) 2024/2847 covering manufacturer obligations, essential cybersecurity requirements, technical documentation, conformity assessment, SBOMs, and CE marking. - [BSI Cyber Resilience Act guidance](https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Cyber_Resilience_Act/cyber_resilience_act_node.html): BSI guidance for manufacturers on the CRA timeline, risk assessment, conformity evidence, vulnerability handling, support periods, and SBOMs. - [BSI TR-03183 cyber resilience](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr03183/tr-03183.html): Official BSI collection of cyber resilience requirements for manufacturers and products, with separate parts for general requirements, SBOMs, and vulnerability reports. - [CISA OT asset inventory guidance](https://www.cisa.gov/resources-tools/resources/foundations-ot-cybersecurity-asset-inventory-guidance-owners-and-operators): Joint agency guidance published in August 2025 on building an OT asset inventory with taxonomy, data management, and lifecycle maintenance. - [EU Machinery Regulation 2023/1230](https://eur-lex.europa.eu/eli/reg/2023/1230): Official EUR-Lex text of the EU Machinery Regulation covering conformity, CE marking, protection of compliance-relevant software and data, and the safety of control systems. - [BSI critical infrastructure requirements catalogue](https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/KRITIS/Konkretisierung_Anforderungen_Massnahmen_KRITIS.pdf?__blob=publicationFile&v=3): BSI catalogue published on 10 September 2024 specifying criteria under Section 8a(1) and (1a) BSIG, including asset inventory, classification, network topology, and change management. ## Getting started One line, one site, one audit, or one open vulnerability: you name the case, we show which data becomes visible first and what the next sensible step is. - [Contact](https://www.secnostic.com/en/contact)