Technology and SaaS

Give customers evidence that your platform is resilient.

Your customers' operations and data run on your platform, so your incidents become theirs. We help technology and SaaS providers contain incidents before they reach customers, meet NIS2, DORA, and Cyber Resilience Act requirements, and build AI into their products under clear rules.

Get in touch Recommended engagements

Situations we help with

Across SaaS and platform providers; managed and security service providers; cloud and data centre services; and software and connected product vendors.

A financial services customer has asked you to meet DORA contract requirements, including notification, audit, and exit provisions.
Enterprise customers send long security questionnaires, and answering them consumes senior time.
You may fall within NIS2 as a cloud or managed service provider, and nobody has confirmed your position in each Member State.
Your software will fall under the Cyber Resilience Act, and vulnerability handling and reporting have no clear owner.
You are adding AI features to your product, and customers are asking how their data is used and how outputs are controlled.

The challenges

Your incident is your customers' incident

Customers' operations and data run on your platform, so an outage or compromise can spread across your customer base at once.

Privileged access to customers

Support, operations, and managed services can need access into customer environments, which makes providers an attractive route for attackers seeking many targets at once.

Customer and regulatory scrutiny

Customers subject to NIS2 or DORA must manage the security of their ICT suppliers, so providers face contract requirements, questionnaires, and audit rights.

Security across the product life cycle

Software and connected products need secure development, vulnerability handling, and support commitments, which the Cyber Resilience Act turns into legal obligations for products on the EU market.

ENISA's 2025 threat landscape lists digital infrastructure and services among the five most targeted sectors in the EU, and notes that providers remain high-value targets because a compromise can serve as a launchpad for follow-up attacks.

Source: ENISA Threat Landscape 2025, October 2025

AI in technology and SaaS

AI features in your product

The value: New capability customers will pay for.
What needs governing: Customer data used for training or shared with model providers, and outputs customers rely on without controls.

Engineering and code assistance

The value: Faster development and testing.
What needs governing: Generated code shipped without review, and source code sent to services you have not approved.

Support and operations

The value: Faster resolution of customer issues.
What needs governing: Assistants that can see more customer data than a case requires, and actions taken in customer environments without approval.

AI Factory Design sets the rules for data use, approval, and oversight across your product and operations, so you can answer customers' questions about AI with evidence. It is part of our AI Governance and Transformation practice.

Regulation that may apply

NIS2 (EU)

Applies to: Cloud computing, data centre, and managed and managed security service providers are in sectors of high criticality, where they meet the size thresholds in each Member State's law.
What it asks: The management body approves the cybersecurity risk management measures, oversees their implementation, and undergoes training. A significant incident requires an early warning to the CSIRT or competent authority without undue delay and within 24 hours of becoming aware.
Timing: Applies through national law. The transposition deadline was 17 October 2024, and Member States have adopted their laws at different times.

DORA (EU)

Applies to: ICT third-party service providers to EU financial entities.
What it asks: Contract provisions set by financial entity customers, covering service levels, notification, audit, and exit. Providers designated as critical come under direct EU oversight.
Timing: Applies since January 2025. The first list of 19 critical providers was published in November 2025.

Cyber Resilience Act (EU)

Applies to: Manufacturers of software and other products with digital elements made available on the EU market.
What it asks: Security requirements across the product's support period, vulnerability handling, and reporting of actively exploited vulnerabilities and severe incidents.
Timing: Reporting obligations apply from 11 September 2026 and the main requirements from 11 December 2027.

Cyber Security and Resilience Bill (UK)

Applies to: Medium and large managed service providers and data centres in the UK.
What it asks: Would bring them within the NIS regime, with security duties and incident reporting.
Timing: Introduced to Parliament in November 2025.