NIS2 demands evidence, not a plan.

    NIS2 Article 21 asks you to show that your security measures work. A pentest report with documented findings and verified remediation is strong evidence, in a format your auditor can use directly.

    Request your NIS2 pentest

    Key NIS2 facts

    15 Aug 2026
    Dutch Cybersecurity Act in force: registration with the NCSC is mandatory
    18 sectors
    Sectors covered by NIS2 in Belgium and the Netherlands
    72 hours
    Maximum time to report a significant security incident under NIS2

    Not every pentest report convinces your auditor

    The difference between what gets rejected and what actually works

    What your auditor won't accept

    An automated vulnerability scan with no human validation of findings

    What actually works for NIS2

    External pentest by certified ethical hackers using OWASP/PTES methodology

    What your auditor won't accept

    A policy document or compliance checklist presented as evidence of security testing

    What actually works for NIS2

    Internal test of network, Active Directory, cloud environments, and applications

    What your auditor won't accept

    A report with no remediation trail or tracked follow-up

    What actually works for NIS2

    Remediation tracking via the RedSOC dashboard, demonstrable evidence for your auditor

    What your auditor won't accept

    No proof that vulnerabilities were fixed before your audit date

    What actually works for NIS2

    Retest per vulnerability after remediation, included as standard, no separate invoice

    What your auditor won't accept

    An outdated report or one scoped for the wrong systems

    What actually works for NIS2

    A current, correctly scoped report in the format Belgian and Dutch regulators expect

    Built for your NIS2 audit

    Every deliverable is built to stand up as evidence in front of your regulator, not just your IT team.

    NIS2 Article 21 mapped

    Every finding is explicitly linked to the NIS2 Article 21 measure it evidences. Your auditor gets usable evidence, not a generic report.

    Human-validated results

    Every finding is manually confirmed by a certified ethical hacker before it enters your report. No scanner noise that wastes your time.

    Remediation tracker included

    We deliver a structured remediation tracker alongside the report. Show progress to your auditor at any stage of the process.

    Planned around your audit

    We structure our work around your audit deadline and agree the planning with you before work begins.

    Retest included

    Once you have remediated findings, we retest to confirm fixes before your audit. Included as standard, not as a separate invoice.

    Broad technical scope

    Web applications, networks, APIs, cloud environments and social engineering vectors. All in one coordinated scope, one report.

    Ready to take the next step?

    Tell us your situation and we point you to the right next step. We usually respond within one business day.

    Request your NIS2 pentestContact Us

    Who benefits most from this?

    Compliance officers

    You need documented penetration testing evidence for your NIS2 file. We deliver exactly that, in the format regulators expect, and leave the policy work to you.

    IT managers

    You know you need a pentest but are unsure what to include in scope. We define it with you and deliver clear, actionable technical findings.

    CISOs

    You need a credible, human-led test your board and auditor will accept. Not a scanner report repackaged as a penetration test.

    CEOs and board members

    NIS2 makes management personally liable for non-compliance. A documented pentest protects both your organisation and you personally.

    Frequently asked questions

    NIS2 Article 21 requires organisations to implement risk management measures and assess the effectiveness of their cybersecurity controls. National regulators in Belgium and the Netherlands increasingly expect documented, human-led security testing as evidence of Article 21 compliance. A penetration test with tracked remediation is the most widely accepted form of that evidence.

    The duration depends on the agreed scope. We agree the planning with you before work begins, so you can plan your audit schedule around it, and we can prioritise when your audit deadline requires it.

    Yes. Both essential and important entities are required to implement Article 21 security measures, including evidence of security testing. The depth and frequency of testing may vary based on your entity classification, but the requirement to document your security posture applies to both categories.

    A vulnerability scan identifies known weaknesses using automated tools. A penetration test actively attempts to exploit those weaknesses using human intelligence and real attack techniques. NIS2 auditors expect evidence of active testing, not just a list of CVEs. A scan alone will not satisfy an Article 21 compliance requirement in most cases.

    Each finding in our report is tagged to the specific NIS2 Article 21 security measure it relates to, such as access control, incident handling or cryptography. This lets your auditor see which measures are technically evidenced and which still need remediation. The compliance judgement itself stays with your auditor.

    No. We are not a compliance consultancy and we do not run full NIS2 programmes. We deliver the technical half: penetration testing, red teaming, social engineering and security awareness, plus the reporting you use as evidence. The policy and governance track stays with your own compliance lead or advisory partner. That keeps our scope sharp and our evidence usable. A pentest is the technical evidence within your NIS2 file, not a legal compliance certificate.

    Book your NIS2 pentest with audit-ready report and retest included

    External pentest, internal network test, remediation tracking and retest. The technical evidence for your NIS2 file.

    Request your NIS2 pentestView Audit-Ready Pentest