Digital workers for cybersecurity
Deutsche Cyberkom and MR.KNOW automate tasks around NIS-2, DORA and critical infrastructure: from daily routine to active defence that responds to security incidents immediately according to your rules. AI agents can be integrated in a controlled way. Upload a job description to find out which tasks can be automated and whether a digital worker is the right alternative to a new hire.
In short: an automated process that takes over the tasks of a role, from routine work to immediate response to security incidents, with AI if desired. This is the profile of a digital worker for cybersecurity.
A digital worker is neither a person nor a chatbot. It is an automated process that takes over the tasks of a role: checking data, monitoring deadlines, preparing reports, controlling systems. It does not just work through routines, it also acts proactively: when an XDR alert comes in, it can immediately lock a compromised account, for example. What it does is modelled in advance as a BPMN 2.0 process, so every step is traceable and verifiable.
AI agents can be integrated as building blocks: they assess alerts, read unstructured data such as supplier responses and draft reports. The process defines what an agent may do and where a person approves. In this way the digital worker also supports the EU AI Act requirements for human oversight and documentation.
For your team this means: routine work and response run around the clock, and your experts take care of the cases that need experience and judgement. The digital worker submits decisions with far-reaching consequences to those responsible for approval.
In 5 steps to your digital colleague.
Upload a job ad or paste a URL.
AI checks tasks, workflows and automation potential – including a BPMN preview.
Digital worker as Assistant, Agent or Worker.
Seamless integration into XDR, SIEM, ISMS and directory services – cloud or on-premise.
Monitoring, governance and ongoing optimisation.
NIS-2, DORA and critical infrastructure rules make cybersecurity a duty of top management: risk management, reporting deadlines starting at 24 hours, complete evidence and control of the supply chain. At the same time, skilled staff are scarce, and attackers use AI for convincing phishing emails and cloned voices. Digital workers take over the routine, respond to incidents immediately and integrate AI in a controlled way, so that your team can focus on the real risks.
Since 6 December 2025, Germany's NIS-2 Implementation Act has applied to around 30,000 companies. Significant security incidents go to the BSI in stages: early warning within 24 hours, notification within 72 hours, final report within one month.
The digital worker detects reportable incidents, starts the deadlines, collects the details, drafts the reports and submits them to those responsible for approval. Every report is fully documented.
Policies, risk assessments and controls under ISO/IEC 27001 or BSI IT-Grundschutz depend on regular upkeep. In day-to-day business, that is exactly what gets left behind.
The digital worker distributes policies and collects acknowledgements, schedules reviews and internal controls, tracks measures with deadlines and compiles audit-proof evidence for the next audit. Management can thus prove that it oversees its duties.
Since 17 January 2025, DORA has required banks, insurers, investment firms and payment institutions to have ICT risk management, report major ICT incidents, run resilience tests and control their ICT service providers.
The digital worker classifies incidents according to the DORA criteria, maintains the register of information on providers, plans tests and exercises and prepares reports to the supervisor on time.
More than half of all data breaches can be traced back to suppliers and partners. Questionnaires sent once a year and spreadsheets are not enough, and NIS-2 explicitly requires supply chain security.
The digital worker embeds supplier assessment in procurement, sends questionnaires, follows up automatically, evaluates continuous risk scans and raises an alert as soon as a supplier deteriorates. Management receives measurable results instead of gut feeling.
Operators of critical infrastructure in energy, water, health or transport must prove their resilience, and under the German KRITIS umbrella act also for physical protection. In an emergency, everyone has to know what to do.
The digital worker raises the alarm according to the emergency plan, informs the crisis team, staff and service providers via secure channels, logs every decision and organises regular emergency exercises including evaluation.
Phishing, social engineering and AI-faked calls from managers target people, not firewalls. At the same time, access rights keep growing when nobody reviews them regularly.
The digital worker assigns awareness training, sends reminders and documents participation, including the training duty of management under NIS-2. When people join, move or leave, it triggers the rights adjustment and organises the recertification of access rights.
More about the matching digital workers: Security Assistant and Risk Assistant.
XDR solutions such as SentinelOne detect attacks reliably. But who responds at three in the morning or at the weekend? With the Security Assistant, every detection becomes a governed process: the XDR event triggers a BPM rule, and a workflow responds immediately, traceably and exactly as you specify. Your existing security systems stay in place and are extended.
SentinelOne or another XDR or SIEM system reports a threat.
An AI agent adds context: affected device, account, criticality.
The modelled rule decides by severity what happens and who approves.
Lock the account, disconnect the network adapter, shut down the switch port.
Notification, ticket, reporting deadline and a complete log.
If you wish, critical steps require human approval. Which response applies at which severity is defined in the process model.
AI agents assess alerts, summarise incidents and draft reports. In a digital worker they are one building block, not the whole: the BPMN 2.0 process defines which agent works with which data and when, where a human approves and when to escalate.
Deutsche Cyberkom GmbH protects companies against cyber attacks and AI threats, with cybersecurity and communication holistically from a single source. Formed from the brands TKUC and TheUnified, the ISO 27001-certified team serves more than 250 companies from Haibach, Cologne, Frankfurt am Main, Stuttgart and Bergisch Gladbach.
The portfolio ranges from IT security audits with vulnerability analysis through NIS-2 and DORA consulting to network and cloud security, security awareness training and secure emergency communication. For NIS-2, Cyberkom first clarifies whether a company is affected and then assesses its status in a gap analysis with more than 150 checkpoints. In the event of an attack, the emergency support team helps quickly.
Together with MR.KNOW, security concepts become everyday practice: digital workers implement reporting channels, controls and responses permanently and verifiably.
The essentials on digital workers in IT security and the potential analysis.
A digital worker is neither a chatbot nor a single script, but a modelled process: it recognises a situation, decides based on rules, executes, produces documents and escalates to a human where needed. MR.KNOW distinguishes three levels: Digital Assistant (rule-based on BPMN 2.0), Digital Agent (AI-powered, also handles unstructured data) and Digital Worker (autonomous AI orchestration across system boundaries).
You upload a job description or job ad as a PDF, provide a link to an existing job ad, or enter the text directly. Tasks, workflows and the achievable degree of automation are analysed; you receive the assessment by email, usually within a few minutes. The analysis is free and without obligation.
A phased approach has proven itself: a compact discovery workshop, from it a working pilot for one concrete use case, then the rollout to further sites or tenants. The first productive use case takes weeks rather than months, because it builds on a platform that already exists.
The benefit is twofold: manual effort drops, and so do error rates and lead times. What decides the business case is reuse: most of the effort goes once into the base of data connectivity, extraction and the rule and document engine. Every further digital worker is largely configuration and therefore costs a fraction of the first one.
Processes are documented and versioned, prompts are managed in a vault, and the AI models are interchangeable, so there is no vendor lock-in. Operation is GDPR-compliant and multi-tenant, either as a highly secure SaaS cloud or on-premise in your own data centre. Decisions therefore remain verifiable, which is an advantage in audited environments.
No. The BPMN 2.0 orchestration sits above your existing systems and integrates ERP, CRM, HR systems, specialist applications and security solutions such as XDR, SIEM or directory services via open standards, APIs and connectors instead of competing with them. That protects existing investments, regardless of how individual vendors evolve.
No. Digital workers take on the recurring routine share that ties up experienced staff, around the clock and without fluctuations in quality. They close gaps caused by the skills shortage rather than cutting jobs.
A digital worker for cybersecurity is a process modelled in BPMN 2.0 that takes over information security tasks, from routine work to active defence: detecting and reporting security incidents, responding immediately to XDR alerts, keeping track of policies, risks and suppliers and producing evidence for NIS-2, DORA and ISO 27001. It works around the clock, integrates the existing security systems and, if desired, AI agents and submits decisions with far-reaching consequences to those responsible for approval. Deutsche Cyberkom and MR.KNOW implement it together.
The recurring work from NIS-2, DORA, critical infrastructure rules and ISO 27001: detecting reportable incidents and preparing the reports to the BSI on time (early warning within 24 hours, notification within 72 hours, final report within one month), maintaining policies and risk assessments, preparing internal controls and audits, assessing suppliers and following up, triggering emergency plans and tracking awareness training and access reviews. With Active Protection it also responds proactively to XDR alerts, supported by AI agents if desired. Decisions and approvals remain with those responsible.
Active Protection connects an existing XDR solution such as SentinelOne with the MR.KNOW Security Assistant. An XDR event triggers a BPM rule, and a workflow responds automatically: for example, it deactivates a compromised account, shuts down the network adapter of an infected device or a switch port and sends notifications. Critical steps can require approval, and every action is logged.
Individual AI agents handle sub-tasks, such as summarising an alert. But if an agent may lock accounts or take systems offline, it must be defined and provable which data it sees, who checks and approves its results and what is logged. The EU AI Act (Regulation (EU) 2024/1689) has applied in stages since February 2025 and, depending on the use case, requires AI literacy, transparency, human oversight and documentation; the GDPR applies in any case. In a digital worker, AI agents are therefore embedded in a documented BPMN 2.0 process: orchestrated, with approvals by those responsible, versioned and traceable.
Deutsche Cyberkom GmbH from Haibach, Germany, is ISO 27001-certified and serves more than 250 companies from five locations in IT security, NIS-2 and DORA compliance, security awareness and communication. It contributes the security expertise, the audits and the implementation at the customer, MR.KNOW the no-code BPM platform, the digital workers and their operation. Technology and security know-how thus become a finished solution rather than another toolbox.
