Autonomy for networks that cannot fail.
Defense suppliers and critical-infrastructure operators face state-level attackers, strict accreditation and networks that are often fully offline. Simorin runs air-gapped, reasons locally and acts only within the boundaries your security officers set.
State-level threats, industrial targets.
Ransomware groups and state actors increasingly target industrial and critical-infrastructure networks.
Industrial and office IT is hardened and monitored by one agent, so ransomware finds fewer ways in.
Privileged activity is watched and suspicious sessions are suspended within guardrails, then escalated.
Statistics are from the third-party reports named on each card. They describe the industry, not Simorin results.
What you have to prove.
Key rules that apply in this sector. Which apply to you depends on where and how you operate.
| Regulation | What it asks of you | How Simorin helps |
|---|---|---|
| CMMC 2.0US DoD · DFARS rule effective 10 Nov 2025 | Phase 1 self-assessments since 10 Nov 2025. From 10 Nov 2026, Phase 2 requires third-party Level 2 certification at contract award where specified. | Access, configuration, patch and audit evidence aligned to NIST SP 800-171 controls. |
| Swiss Information Security Act (ISA)Reporting duty in force since 1 Apr 2025 | Operators of critical infrastructure in Switzerland must report cyberattacks to the Federal Office for Cyber Security (BACS) within 24 hours of discovery. | Incident timelines across identity, devices and servers, ready for a report within hours, not days. |
| NIS2Directive (EU) 2022/2555 | Cybersecurity risk-management measures, management accountability, and early warning of significant incidents within 24 hours for energy, transport, digital infrastructure and other critical sectors. | Asset, access, patch and incident evidence for your risk measures, plus correlated timelines for reporting. |
| EU Cyber Resilience ActRegulation (EU) 2024/2847 | Vulnerability and incident reporting for products with digital elements from 11 Sep 2026; main obligations from 11 Dec 2027. | Vulnerability tracking and evidence for the systems you operate and ship. |
Summaries for orientation only, not legal advice. Check obligations with your counsel.
Where Simorin works in critical sectors.
Air-gapped operations
Full functionality offline, with signed updates through your transfer process.
Hardening and baselines
Workstations and servers held to accredited baselines, drift reverted.
Privileged access control
Time-boxed, approved, recorded admin access in classified environments.
Accreditation evidence
Evidence collected inside the enclave for assessors.
Your data stays where your regulator wants it.
Seven connected domains, with autonomous AI agents governed by your policies and approvals.
Questions critical sectors teams ask.
Does Simorin need any connection to work?
No. The air-gapped deployment runs entirely offline, including the agent’s reasoning.
Who controls what the agent may do?
Your security officers. Guardrails, allowed actions and approvers are set by you, and every action is logged.
Which accreditations do you hold?
Contact our team to review the documents and contractual requirements for your organisation.
Discuss an air-gapped deployment.
A confidential scoping session with our engineers.