NIS2 Compliance in the AI Age: Why Traditional Cybersecurity Isn’t Enough

The introduction of the Network and Information Security Directive 2 (NIS2) Directive represents one of the biggest changes to European cybersecurity legislation in recent years. Organizations can no longer view cybersecurity as solely the IT department’s responsibility. 

Executive teams are now directly accountable for ensuring that appropriate security controls are in place, with significant incidents requiring notification within just 24 hours.

At the same time, AI has fundamentally changed how cyberattacks unfold.

Threats that once took attackers days or weeks to develop can now be launched in minutes. Automated reconnaissance, AI-assisted phishing, and increasingly sophisticated ransomware campaigns have dramatically reduced the time that organizations have to detect and contain an attack.

For businesses subject to NIS2, this creates a difficult question:

How do you demonstrate that your organization can contain a breach before it becomes a major incident?

Many organizations initially approach NIS2 as another compliance exercise.

However, the directive is designed to improve operational resilience rather than simply introduce more documentation.

The focus is no longer just on preventing attacks. The management bodies of organizations that provide critical services must be able to demonstrate — not just claim — that they can:

• Minimize the impact of a cyber incident

• Protect critical services

• Manage supply chain risk

• Maintain business continuity

• Rapidly understand what has been affected when an incident occurs

And, under NIS2, management bodies can be held accountable for noncompliance. In an environment where cyberthreats increasingly move at machine speed, these requirements place significant pressure on traditional security models. 

Akamai Guardicore Segmentation is built for exactly this scenario. It gives security and executive teams provable visibility into how contained an incident really is.

Organizations need evidence that security controls can actively contain an incident before it spreads across critical systems (Articles 21(1) and 21(2)(f)).

NIS2 extends responsibility beyond an organization’s own infrastructure (Article 21(2)(d)). Third-party suppliers and partners must also be managed as part of the overall security posture — including ensuring that a compromised vendor credential alone isn’t enough to reach critical systems. Capabilities like multi-factor authentication, which enforces authentication at the connection level rather than just at the network perimeter, are designed for exactly this scenario.

Security controls must strengthen resilience without introducing unnecessary operational disruption or complexity (Article 21(2)(c)).

Personal accountability combined with a strict reporting window (Article 23) — a 24-hour early warning, a 72-hour incident notification, and a full report within 1 month — means organizations need immediate visibility into an incident’s scope and business impact.

These challenges require more than traditional perimeter security or periodic compliance exercises.

They require continuous visibility and rapid containment.

Akamai Guardicore Segmentation is a software-defined, asset-centric platform purpose-built for the AI age:

• Exposure Analysis and Response (ExAR) continuously maps attack paths before attackers exploit them. 

• Insight querying capabilities lets teams use natural language search to instantly scope a breach’s blast radius. 

• The Generative Policy Engine reduces lateral movement by automating policy generation to sharply limit how far a compromised credential or workload can reach. 

It helps organizations understand what is connected, limits how far attackers can move, and quickly demonstrates the impact of an incident.