BlueEye watches the connections between your locations and remote units. That could be water plants, production halls or municipal sites. Measurements, flows and incidents stay on your own server. The only thing that goes out is the licence check, meaning how many agents are running.
The connection to Treatment Plant North is not responding. 100% packet loss for 6 minutes, measured from two agents at once.
Probable common cause: both plants hang off the same upstream hop (10.20.0.1), which became unstable at 03:11.
NIS2 report draft created automaticallyOne example. BlueEye gathers findings from several agents into one probable cause instead of fourteen disconnected alarms.
The challenge
Utilities and other critical infrastructure fall under NIS2. You must be able to document that the network is monitored, and report significant incidents within fixed deadlines.
An example: the night of 12 March
14 alarms from 6 sites in two minutes. The operator on call can see that something is wrong, but not what set it off, or how many sites are actually affected.
An upstream hop (10.20.0.1) starts dropping packets. Nobody has noticed yet.
Treatment Plant North and Pumping Station West both see 100% packet loss for 6 minutes.
BlueEye can see that both sites hang off the same hop, and gathers the two findings into one probable cause, stating how many sites are affected.
Timestamps, affected sites, duration and measured cause are already in the NIS2 draft. The operator reads it through and adds to it.
It is the same incident in both panels. On the left it takes a long time before anyone knows what is wrong. On the right it is in the draft at 03:15.
The solution
BlueEye runs on-premises and single-tenant on your own hardware. Measurements, flows and incidents do not leave the building. The only thing that goes out is the licence check, meaning the number of agents, and it may be offline for 14 days. Maps and fonts can point at your own, if you want to be fully closed off.
On-premises · single-tenant
Anomalies are found with robust statistics on your own server (median and MAD z-score). No ML model, no cloud call, and each finding carries its own explanation and the data behind it. If you want incidents phrased in prose on top, a language model can be switched on (Mistral in the EU by default, other providers selectable). It is off by default and only ever sees masked summaries.
Local analysis · AI optional
When the incident happens, the draft is already written. Timestamps, affected sites, duration and measured cause are pulled in automatically. You read it through and correct it instead of writing the report from scratch. The draft is never submitted on its own.
Draft · never auto-submitted
What you get in practice
BlueEye gathers the agents' measurements into something an on-call operator can act on at night, and that an auditor can check afterwards.
Findings from several sites are gathered into one probable cause with confidence and a count of how many sites are affected. You see the incident instead of the noise.
Hop-by-hop analysis of the route with loss, latency and jitter per hop. So you can see whether the fault is with you, with the operator, or in between.
Multi-step transaction tests (http, tcp, dns, icmp) with timing per step. Measures the actual user journey, not just whether the host answers a ping.
Evidence snapshots at incidents and an Ed25519-signed, timestamped evidence manifest on every report. It can be checked offline.
Examples of use
Water utilities are the running example on this page, but BlueEye fits any organisation with scattered networks and NIS2 requirements. Some typical examples:
Water plants, treatment plants and pumping stations spread across a supply area.
Heating plants, transformer and metering stations with uptime requirements.
Factory halls and machine networks where downtime costs immediately.
Town halls, institutions and decentralised units across the municipality.
Hospitals and clinics with critical connections and stricter requirements.
Any organisation with multiple locations and NIS2 obligations.
Built for scattered infrastructure
Few organisations sit in one place. Remote units are spread across a large area, for instance water plants and pumping stations, production sites or branch offices. BlueEye gathers the monitoring of them all, no matter how many there are.
An honest boundary
BlueEye monitors the IT layer and the network connections between your sites. That is what we see, and what we stand behind.
What we cover
What we do not cover
We would rather say so up front than promise something we cannot measure.
Pricing
One agent equals one monitored unit. All prices are in Danish kroner excl. VAT. No lock-in, and you can scale up and down as you go.
Try it out
Steady operations
NIS2 + access control
Work out your own price
12 agents on Professional costs DKK 2,628 per month excl. VAT. No device licences on top, and the price only changes when the number of agents does.
Professional covers up to 25 agents.
Prices are per agent per month in Danish kroner excl. VAT.
Questions
If your question is not below, write to us in the form. We answer it ourselves.
On your own server. Measurements, flows and incidents stay with you and are not passed on to us or to anyone else.
Only the licence check, meaning how many agents are running. It may be offline for 14 days without anything stopping.
No. The server can run on a virtual machine you already have. An agent runs on a small machine per location, and devices without an agent can be polled over SNMP.
The analysis itself is robust statistics running locally (median and MAD z-score). A language model can be switched on if you want incidents written in prose. It is off by default and only ever sees masked summaries.
No. BlueEye writes a draft with timestamps, affected sites and measured cause. You read it through, correct it and submit it yourself.
The PLC and SCADA layer. We monitor the network between the sites, not the control of pumps and processes itself.
Nothing. 60 days with up to 5 agents. If it is not a fit, we stop again.
A day on most networks. The server is set up, the agents are installed per location, and then the measurements start coming in.
BlueEye is built by people with 35 years of experience in Danish network infrastructure, backbone and hosting. We have run networks that must not go down, and we build BlueEye from that experience.
We do not sell over the phone. Call or write, and we will talk through your setup.
Tell us briefly about your setup and what you would like answered. We get back to you within a couple of business days.
No procurement process, no lock-in. We set up a pilot on your infrastructure, and you see for yourself what it catches. If it is not a fit, we stop again.
Book a pilot