See your cyber risk. Reduce it. Prove it.
Dottor Box® is the platform a company uses to find out what it has exposed, keep it under control with Dottor Marc's SOC, and document how it is managed to a regulator, an auditor or a customer.
- Network tests
- More than 130,000 NVTs
- Supported frameworks
- 13 standards
- Monitoring
- In-house SOC, up to 24/7
A complete cycle, not a list of tools
Most platforms stop at the scan. Dottor Box takes a company from the first finding all the way to the document it hands to the auditor.
You know what is exposed, every day
Internal and external networks, web applications, network shares, endpoints, Microsoft and Google identities, credentials that have ended up on the dark web.
Assessment services 02 · GovernYou turn findings into a system
Self-assessment against 13 standards, risk analysis, procedures, audits, non-conformities, supplier assessment and staff training.
Compliance and management 03 · ProveYou have the proof when you need it
Reports in Italian and English, editable presentations, Statement of Applicability, registers and exports for auditors, with the history of every check.
Documents and reportsNot raw scanner output: a report a person has reviewed
Dottor Box scans are automated and semi-automated, and non-invasive. Then Dottor Marc's qualified staff step in and complement them with manual checks to remove the false positives and false negatives that automated tools leave behind.
And the layers are connected: a vulnerability found on the network becomes a risk in the analysis, the risk becomes a control to implement, the control becomes evidence, and the evidence ends up in the report you show to the auditor or to the customer who asks for it.
- Vulnerability
- Risk
- Control
- Evidence
- Report
From sign-up to your first report
Every company has its own Dottor Box: a dedicated environment, with its own data, its own users and only the services it needs.
Sign-up
You create an account on the portal and enter your company details. It is the first step towards receiving a proposal.
Your Dottor Box
Your dedicated environment is created, separated at database level from every other customer's.
Cyber Screening
A first snapshot of what can be seen of your company from the internet, with a risk score.
Service activation
You choose what to monitor and which standards to follow. Services are activated one by one, when you need them.
Good to know: signing up does not start a subscription. The service begins only after you have accepted the proposal, with clear written terms. Read how activation works.
Three levels, from monitoring to an always-on SOC
The levels are cumulative: each one includes everything in the previous one. You choose how much to hand over to our team.
Security Monitor
The platform and continuous monitoring.
- Who acts on findings
- Your company, with our reports and alerts
- Discovery of devices, ports and services on LAN and WAN
- Vulnerability assessment of internal network, external network and web applications
- Dark web monitoring of your company domain
- SIEM agent, antivirus and access logs
- Threat hunting and predictive analysis by our SOC
MDR + SOC
Detection and response managed by our team.
- Support
- 8/5 tickets during business hours
- Everything in Security Monitor
- Dottor Marc's SOC acts on alerts
- Proactive vulnerability and patch management
- During an incident, Dottor Marc takes on the role of Incident Response Team Lead
MDR + SOC 24/7
The same cover, round the clock.
- Support
- Dedicated phone line 24 hours a day, 7 days a week
- Everything in MDR + SOC
- Continuous monitoring and incident response
- Dedicated emergency number
- Procedures agreed and tested with your company
How the price is calculated: a one-off initial fee to define and validate the attack surface, then a monthly fee per monitored asset, based on the average of the last 30 days. The more assets you monitor, the lower the unit cost. The number of employees does not count.
Each service is activated on its own, when you need it
A company that has to comply with NIS2 activates one set of modules; one that only wants a vulnerability assessment activates another. The offer is built around your company.
Cyber Screening
What anyone looking at your company from the internet can see, with a risk score to start from.
Learn more SeeVulnerability Assessment
Six checks from inside and outside, with CVSS severity, history and alerts on what is new.
Learn more SeeDark Web Monitoring
Compromised company credentials and mentions of your brand on leak and ransomware sites.
Learn more SeeMicrosoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn more GovernCompliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn moreNIS2, GDPR, ISO 27001 and 10 more standards, with the evidence ready
The self-assessment measures how far you are from each framework in terms of coverage and maturity, and the simulation answers the question that matters: if I activate these services, where do I get to?
Then the Compliance module generates policies and procedures, manages audits and non-conformities and fills in the Statement of Applicability. A control implemented once counts for every standard that requires it.
A probe on site. No firewall ports to open.
To look at the network from the inside, all you need is a virtual machine or a mini PC: the Cyber Drill. The probe calls the platform, never the other way round, so there is no need to open inbound ports.
- Installs on VMware, Proxmox, Hyper-V or as a physical mini PC
- Modest requirements: 4 vCPUs, 8 GB of RAM, 80 GB of disk
- Updates itself and sends encrypted results
- Simulates what malware already inside the network would do
Built by people who do audits, not by people who sell licences
Made in Italy
Software developed in Italy, with interface and reports in Italian and English, built around European standards and the rules that apply to Italian companies, down to the Italian Data Protection Authority's order on system administrators.
Your data stays yours
Every customer has a dedicated database schema. The platform runs on Google cloud infrastructure and Dottor Marc's own data centres.
A certified provider
Dottor Marc is certified to ISO/IEC 27001 and ISO 9001: we are subject to the same checks we ask of our customers.
People, not just software
An in-house SOC that reviews the results, carries out threat hunting and, at MDR levels, leads incident response by your side.
Find out how exposed your company is, before someone else does
Tell us how your infrastructure is built and which standards you need to meet. We show you Dottor Box on your real systems and prepare a proposal based on the assets you actually want to monitor.
- Phone+39 045 511 8550
- OfficeViale Colonnello Galliano 57, 37138 Verona, Italy
- CompanyDottor Marc S.r.l. · VAT no. IT04569090238
- Client areamy.dottorbox.it