Unified engineering and security incident response.
One process engine, engineering and security on one timeline, in the chat tools you already use.
Early access
Open Resolvo
Incident response software from BlueDefense
Run incidents the same way every time.
From the first alert to the signed-off postmortem, Resolvo runs the process your team defined, in the chat tools you already use.
Until the demo link is ready, the walkthrough button opens an email to contact@bluedefense.de.
Why now
The clock starts when you become aware, not when you finish investigating.
German and EU rules expect a documented, repeatable response with deadlines attached. These are the deadlines that apply, each with the source next to it.
- Germany's NIS2 implementation has applied since December 2025, with no transition period.
- Reed Smith: Germany implements NIS2 with immediate effect
- A significant incident needs an early warning within 24 hours, a notification within 72 hours and a final report within one month.
- NIS2 Directive (EU) 2022/2555, Article 23
- A major ICT-related incident under DORA is reported within four hours of classification, and no later than 24 hours from becoming aware.
- openstatus: DORA incident reporting requirements
The problem
Most incidents still run on habit.
- 01
Every incident gets a different process.
The same kind of outage is handled differently depending on who is on call. The steps, the roles and the order change with the person.
- 02
Context is spread across tools.
The alert is in one tool, the discussion in chat, the decision in a document and the evidence in a ticket. Nobody has the whole picture.
- 03
The follow-up never closes.
Postmortems start late, action items lose their owner and the same cause returns months later.
How it works
Four steps, the same four every time.
- Step 1
Alert
Monitoring alerts are routed, de-duplicated and filtered. An alert can open an incident or page on-call.
- Step 2
Declare
Declare in Slack, Teams or the web. The room opens, the right people are added and the summary card starts.
- Step 3
Process runs
Stages, gates, checklists and roles run the way your team defined them. Updates go out on a cadence set by severity.
- Step 4
Review and learn
The postmortem is pre-filled from the timeline, reviewed and signed off. Action items keep their owners.
The process engine
The process is code your team can read.
Each step is a rule someone wrote. Nothing happens by hidden default, and a change is tested on a real incident before it goes live.
- Stages with gates. Closing an incident needs a recorded reason and a completed checklist.
- Rules written as sentences, with waits, repeats and approvals as steps in the rule.
- A dry run on a real incident before a rule goes live, and the full run history after it.
- Starter processes (Standard, Security, Customer-facing) that your team edits freely.
Products
Two products, both shipped from Berlin.
Unblock
An off-grid messenger for when the network is down.
Messages over a Bluetooth mesh, with optional local Wi-Fi, LoRa and a relay bridge. Limits stated plainly.
Submitted to Google Play, awaiting release
Open UnblockServices
Help setting up your process, if you want it.
A readiness assessment, process design and rollout in Resolvo, and an incident-response retainer with scope and response times agreed in the contract.
Questions
What people ask first.
Does Resolvo replace Slack or Microsoft Teams?
No. Resolvo works inside them. Each incident gets a room in the chat tool your team already uses, and the incident record stays in Resolvo so the timeline and the postmortem do not depend on chat history.
Can we change the process?
Yes. Each team defines its own stages, gates, rules and intake questions, starting from a ready-made process and dry-running a change before it goes live.
Where does our data live?
In the deployment you choose. Cloud deployments are hosted by BlueDefense at [PLACEHOLDER: hosting location and provider]. Self-hosted deployments run in your own infrastructure.
What does Resolvo cost?
Pricing is being settled with the first design partners and is not published yet. The pricing section of the Resolvo page explains the model and what is included.
Can you set the process up with us?
Yes. A readiness assessment maps the gap, process design and rollout put the process into Resolvo with you, and a retainer can cover the response itself.
Do you work with companies below the NIS2 thresholds?
Yes. The thresholds decide who the law applies to, not who needs a repeatable incident process. Smaller teams usually start with the assessment.
Next step
Bring one incident and see what it looks like in Resolvo.
A walkthrough takes about half an hour. Early access is opened in small groups so each team is set up on the process it actually runs.