Pentest Subsidies in Belgium: What Changes for the kmo-portefeuille in 2027
From 1 January 2027 companies can no longer apply for new kmo-portefeuille support. What that means for a pentest and what you can still do in 2026.
Change to the kmo-portefeuille from 2027
From 1 January 2027 companies can no longer apply for new kmo-portefeuille support for training and cybersecurity advice. In 2026 applications remain possible as long as the available annual budget is not used up. Ongoing support applications can be completed up to and including 31 December 2027. Read more in the VLAIO news item (in Dutch).
Do you want to plan a pentest or a cybersecurity training? Get in touch to discuss the options and the application conditions.
TL;DR
- From 1 January 2027 the kmo-portefeuille stops for training and cybersecurity advice. In 2026 you can still apply, as long as the annual budget lasts. Until then, a pentest with proper reporting and recommendations counts as cybersecurity advice.
- Small companies receive 45% support, medium-sized companies 35%, with a ceiling of EUR 7,500 per calendar year. The percentages apply to the amount excluding VAT.
- For larger security projects, VLAIO cybersecurity improvement tracks cover 50% of external guidance between EUR 7,100 and EUR 39,000 excluding VAT (35% for non-SMEs that fall under NIS2).
- You apply online, select the theme cybersecurity, and the increased support percentage is applied automatically. The provider must be registered for the kmo-portefeuille; Sectricity is.
For many Belgian SMEs the main objection to a penetration test is not the value, it is the price tag. What few companies realise is that Flanders actively subsidises exactly this kind of security work. Since the reform of February 2026, cybersecurity is even the only advisory topic the kmo-portefeuille still supports. As long as the kmo-portefeuille is open, part of your pentest budget can come back as support. For new applications that ends on 1 January 2027.
What is the kmo-portefeuille?
The kmo-portefeuille is a low-threshold support instrument from the Flemish government (VLAIO) for SMEs that buy training or advice from registered service providers. In 2025 almost 55,000 companies submitted more than 125,000 applications, so this is not an obscure niche programme. You request the support online, VLAIO adds its share to your digital wallet, and you pay the provider partly with that wallet. From 1 January 2027 the kmo-portefeuille stops for training and cybersecurity advice.
Since February 2026: advisory support is cybersecurity only
On 23 January 2026 the Flemish Government decided to narrow the advisory service of the kmo-portefeuille as part of a broader savings round. Since 1 February 2026, advice on any topic other than cybersecurity no longer qualifies. Marketing advice, HR advice, general digitalisation advice: all out. Cybersecurity advice: still in, and still at the increased support percentage.
How much support do you get?
For cybersecurity advice and training the increased percentages apply: a small company receives 45% support, a medium-sized company 35%. For comparison: other training themes sit at 30% and 20%. The ceiling is EUR 7,500 of support per calendar year, and the percentages are calculated on the amount excluding VAT.
Whether you count as small or medium-sized follows the European SME definition: small means fewer than 50 full-time equivalents and a turnover or balance sheet total of at most EUR 10 million; medium-sized means fewer than 250 full-time equivalents and a turnover of at most EUR 50 million or a balance sheet total of at most EUR 43 million. VLAIO determines your size automatically at your first application of the year, based on National Bank data, and group structures count.
Does a pentest qualify?
Yes, provided two conditions are met. First, the engagement must genuinely be advice: an analysis of your security posture that ends in a written report with findings and concrete recommendations. A penetration test is a textbook example, because the deliverable is exactly that: an expert assessment of where you are vulnerable and what to fix first. Pure implementation hours, such as configuring firewalls for you, are not advice.
Second, the provider must be registered for the kmo-portefeuille. Sectricity is a registered service provider.
Larger projects: VLAIO cybersecurity improvement tracks
Is your security project bigger than a single assessment? Then look at the VLAIO cybersecurity improvement tracks (cybersecurity verbetertrajecten). In these tracks a recognised service provider analyses your security, draws up an action plan and guides the implementation. VLAIO subsidises 50% of the cost for SMEs and sheltered workshops, on projects between EUR 7,100 and EUR 39,000 excluding VAT. Companies that are too large to be an SME but fall under the NIS2 directive still receive 35%.
Note that these tracks run through a select group of service providers recognised by VLAIO specifically for this programme. If an improvement track fits your situation better than a standalone assessment, we are happy to point you to the right entry point; the analysis work we do, such as pentests and cloud configuration audits, often feeds directly into such a track.
How the application works
- Agree the scope and quote with your provider first, so you know the exact project amount excluding VAT.
- Only for applications in 2026: log in to the Flemish e-desk for entrepreneurs and open a new kmo-portefeuille application. Select the service type advice and the theme cybersecurity; the increased percentage is applied automatically.
- Enter the registration number of your provider and the project amount, then deposit your own share into the digital wallet. VLAIO adds the subsidy.
- Pay the provider invoice from the wallet (excluding VAT; the VAT goes directly to the provider as usual).
A worked example
Take an external penetration test of EUR 4,600 excluding VAT. A small company selects the theme cybersecurity and receives 45% support: EUR 2,070. The net cost of the pentest drops to EUR 2,530. A medium-sized company receives 35%, or EUR 1,610, and pays EUR 2,990 net. Both stay comfortably below the yearly ceiling of EUR 7,500, which leaves room for a follow-up assessment or awareness training in the same year.
Frequently Asked Questions
Can a penetration test be funded through the kmo-portefeuille?
Yes, for applications in 2026. A penetration test that ends in a proper report with findings and recommendations qualifies as cybersecurity advice, which is exactly the category the kmo-portefeuille still supports since February 2026. The test must be purchased from a service provider that is registered for the kmo-portefeuille.
How much subsidy does a small company get for a pentest in Flanders?
A small company receives 45% support on the amount excluding VAT, a medium-sized company 35%. The support ceiling is EUR 7,500 per calendar year. On a pentest of EUR 4,600 excluding VAT, a small company therefore receives EUR 2,070 in support and pays EUR 2,530 net.
What changed in the kmo-portefeuille on 1 February 2026?
Since 1 February 2026 the advisory service of the kmo-portefeuille is limited to one topic: cybersecurity. Advice on any other subject no longer qualifies for support. Training remains supported for all eight future-oriented themes, and the support percentages and the EUR 7,500 yearly ceiling stayed the same.
What is a VLAIO cybersecurity improvement track?
A cybersecurity improvement track is a separate VLAIO programme for larger security projects. VLAIO covers 50% of the cost of external guidance for SMEs and sheltered workshops on projects between EUR 7,100 and EUR 39,000 excluding VAT. Companies that are too large to qualify as an SME but fall under the NIS2 directive receive 35%. These tracks run through a select group of service providers recognised by VLAIO.
How do I apply for kmo-portefeuille support for a pentest?
You apply online through the kmo-portefeuille in the Flemish e-desk for entrepreneurs. In the application you select the theme cybersecurity, after which the increased support percentage is applied automatically. Your provider gives you the registration number and the project details you need for the application. This is still possible in 2026, as long as the available annual budget is not used up.
What changes for the kmo-portefeuille from 2027?
From 1 January 2027 companies can no longer apply for new kmo-portefeuille support for training and cybersecurity advice. In 2026 applications remain possible as long as the available annual budget is not used up. Ongoing support applications can be completed up to and including 31 December 2027. The VLAIO cybersecurity improvement tracks are a separate programme.
Related services and resources
Curious what a subsidised assessment would look like for your organisation? Our penetration testing services cover external, internal, web application and API testing, and our cloud pentest and configuration audit maps identity and configuration risks in Microsoft 365, Entra ID and Azure. If you first want a feel for realistic budgets, read our breakdown of what a pentest costs in Belgium, the Netherlands and the EU. Do you still want to use the kmo-portefeuille for a pentest or training? Get in touch and we will go through the options and the application conditions.