One OT Security Operations Platform with two operational components: Agent + Cloud Dashboard for connected operations, and the Air-Gapped Offline Terminal for isolated environments.
CyberCore separates connected security operations from sovereign offline operations while preserving one evidence-continuous architecture.
The Windows agent collects endpoint and OT-adjacent telemetry, preserves events during outages and replays them to the Cloud Dashboard / Web Console for multi-tenant monitoring and investigation.
A self-contained security operations workspace for disconnected, sovereign and highly restricted environments, without dependency on continuous cloud access.
Real product interfaces across cloud investigation, governed response, endpoint protection and isolated operations.
Multi-tenant telemetry ingestion, risk visibility, live event streaming and response operations in one console.
Risk scoring, asset health, MITRE ATT&CK context and forensic timelines for analyst-ready evidence.
Recommendation confidence, rollback visibility and auditable analyst justification before controlled action.
State caching, YARA scanning, USB and port guards, firewall enforcement and SCADA memory monitoring.
Imported air-gapped assets appear beside live nodes while preserving cryptographic evidence integrity, event history and governed SOAR context.
Responsive access to health, telemetry and incident context.
Encrypted local operations and controlled evidence transfer for disconnected environments.
Native MQTT, Modbus and OPC UA connectivity feeds industrial telemetry into unified asset and investigation workflows.
Operational notifications with severity, source, process and destination context.
Native industrial connectivity, unified asset intelligence and relationship-aware risk analysis in one operational platform.
MQTT, Modbus and OPC UA connectors bring industrial telemetry into real-time event, investigation and evidence workflows.
Asset inventory, detail views, timelines, relationship graphs and attack-path visibility provide context beyond isolated alerts.
Risk propagation, reverse analysis, blast-radius assessment and Crown Jewel analysis help prioritize operational impact.
Shared capabilities across the connected and air-gapped operational components.
Endpoint state caching and SQLite outage spooling preserve data when connectivity is unavailable.
Offline evidence packages are transferred into investigation through verifiable integrity workflows.
Response workflows combine risk context and human authorization for enterprise governance.
Two operational components preserve security evidence across connected and isolated environments.
CyberCore has progressed beyond the concept stage through operational telemetry, outage resilience, governed response and air-gapped evidence testing.
Agent + Cloud Dashboard and the Air-Gapped Offline Terminal operate as two demonstrable components of the current platform.
128 events queued and replayed with zero observed telemetry loss.
562 imported events validated through SHA256 integrity checks.
Designed for manufacturing visibility and disconnected operational environments.
Cloud SaaS, private cloud, on-prem and air-gapped deployments.
Developed by Nemeris IT OÜ in Tallinn for enterprise and industrial cyber resilience.
A factual comparison focused on architecture rather than unsupported competitor claims.
| Evaluation area | Typical always-connected tooling | Nemeris CyberCore | Operational value |
|---|---|---|---|
| Connectivity loss | Collection may depend on an available gateway | Persistent local SQLite spooling and replay | Maintains telemetry continuity during outages |
| Air-gapped evidence | Often requires separate manual tooling | Purpose-built offline terminal and evidence import | One investigation workflow across live and isolated assets |
| Response governance | Automation varies by deployment | Approval-based SOAR with justification and rollback context | Enterprise control without losing speed |
| Evidence integrity | Conventional log and file handling | SHA256 package verification and chain metadata | Traceable, verifiable evidence handling |
| Deployment model | Cloud or on-prem product dependent | SaaS, private cloud, on-prem and air-gapped | Supports sovereign and regulated environments |
A credible execution path from the current platform to additional protocol validation and European scale.
Transparent about how pilots convert to enterprise deployments without publishing unvalidated fixed pricing.
Validation-focused engagement for endpoint, SIEM, SOAR and air-gap workflows.
Request Pilot ScopePricing based on endpoints, tenants, deployment model and support requirements.
Discuss DeploymentDedicated private-cloud, on-prem or isolated deployment with engineering support.
Book Architecture CallDirect answers to product, scalability, company structure and European market-readiness questions.
CyberCore combines persistent outage spooling, governed SOAR and air-gapped evidence import within one operational platform.
The agent preserves telemetry locally during gateway loss, while the offline terminal creates verifiable evidence packages for controlled import.
The current MVP includes a working agent, dashboard, investigation workspace, approval-based SOAR and offline terminal. Validation includes 128 replayed events with zero observed loss and 562 SHA256-validated imported events.
CyberCore supports multi-tenant SaaS, private cloud, on-prem and air-gapped deployment models, allowing the same core platform to serve different enterprise requirements.
Nemeris IT OÜ is established in Tallinn and is pursuing design-partner and market-entry opportunities across European industrial cybersecurity markets, including the Netherlands.
During the design-partner stage, pricing is scoped to endpoint volume, deployment model and engineering requirements. Enterprise pricing is provided after architecture discovery.
Validate Agent + Cloud Dashboard deployment, OT operations, outage replay, governed response and air-gapped evidence workflows in your environment.