Vulnerability scanning with evidence for your NIS2 file, built on OpenKAT
What your business exposes on the internet, in black and white.
Measured with OpenKAT, sealed with a timestamp. Demonstrable to your customer, auditor and board.
Exposentry runs a continuous vulnerability scan of what your domains expose to the internet, including the subdomains and systems you had lost sight of. With a subscription you receive a sealed report every month. From €249 per month excl. VAT, or start with a one-time baseline scan for €495.
That is your external attack surface, in the trade: external attack surface management. Built on OpenKAT, the open-source scanner developed within the Dutch government.
Free scan: passive, public sources only, report by e-mail, usually within an hour. No newsletter; we only call if you ask us to.
- Built on OpenKAT, developed within the Dutch government
- Founder Edward Hasekamp is a collaborator on the OpenKAT project
- Hosted in the EU by Hasecon, a Dutch company
What a report looks like
Customer reports are confidential. The sample report therefore covers dvwa.cloud, a practice environment run by Hasecon and deliberately configured to be vulnerable. It contains 36 findings from a real scan at level 3 of 4 and is digitally sealed with a timestamp. You receive the download link at your business email address.
Has your customer sent you a NIS2 questionnaire?
A questionnaire records what you declare. A measurement records what is actually there. So attach a dated report of your external attack surface, produced by a third party: one concrete building block of your file. That is what the Ketenpartner plan is for: €249 per month, with the first report usually the same day after domain verification. If you fall under NIS2 yourself, the NIS2 + Supply Chain plan also keeps an eye on the public attack surface of your suppliers, passively and without touching their systems.
Why Exposentry
Recorded, sealed, verifiable
OpenKAT records which vulnerabilities exist, and how and when they were found. Every baseline scan and every subscription report is digitally sealed with an independent timestamp (RFC 3161), so your customer and auditor can verify afterwards that the report has not been changed since.
Dutch and sovereign
A Dutch product, built on OpenKAT (LibreKAT Foundation) and hosted in European datacenters. Your data stays in the EU, beyond the reach of the US CLOUD Act.
NIS2 supply chain support
Demonstrably support your vulnerability management and supply chain duty of care. A necessary building block for your obligations: not a full compliance guarantee, but defensible evidence.
From freelancer to enterprise chain
Transparent packages from €249/month for your own domains, plus supplier monitoring for organizations responsible for their chain.
Want to see what is exposed?
Request the free security scan; the report is usually in your inbox within an hour. If you want the full measurement right away, start a baseline scan for €495. Move to a yearly subscription within 60 days and we credit it in full.
Prefer to run OpenKAT yourself or need custom work? Hasecon provides implementation, management and custom development →
Frequently asked questions
What exactly is Exposentry?
Exposentry is continuous vulnerability monitoring of your external attack surface: every domain, system and service your organisation exposes to the internet. Built on OpenKAT, the open-source scanner that originated in the Dutch government. You receive a periodic, forensically substantiated report in plain language, without installing any hardware or software.
Is a tool like Exposentry or OpenKAT mandatory under NIS2?
No. NIS2 and the Dutch Cybersecurity Act do not mandate any tool by name, including OpenKAT. Anyone telling you otherwise is selling urgency instead of facts. The law requires appropriate measures you can demonstrate; continuous monitoring is a demonstrable building block for that, not a compliance guarantee.
How is this different from a penetration test?
A penetration test is deep manual research at a single point in time, within an agreed scope. Exposentry continuously monitors your entire external attack surface, for the price of one pentest per year. The two complement each other: monitoring keeps the basics demonstrably in order and shows where deep testing is worthwhile.
Why pay when free scans exist?
Free checks such as internet.nl are valuable, but they test standards on the one address you enter yourself. Exposentry first maps your entire attack surface, including forgotten subdomains and shadow IT, scans for actual vulnerabilities and delivers dated, verifiable evidence you can use towards customers and auditors.
How quickly am I up and running?
The same day. You sign up online, verify your domain via a DNS record and the first scan starts automatically. No installation, hardware or software agent is needed; the report arrives by email.
What does Exposentry cost?
Transparent and available online, with no mandatory sales call: a one-time baseline scan for €495 or continuous monitoring from €249 per month. If you upgrade to a yearly subscription within 60 days of the baseline scan, the full amount is credited.
Does this help with my large customer's supplier questionnaire?
Yes, that is exactly what the Ketenpartner plan exists for. Instead of vague answers, you attach a dated, independent report of your external attack surface as evidence. If you are covered by NIS2 yourself, you can also have your own suppliers monitored the other way round.
Where is my data stored and who sees my reports?
Everything runs on European infrastructure, under the GDPR and beyond the reach of the US CLOUD Act. Reports go directly to you and are not shared with third parties; Exposentry does not do remediation itself and therefore has no commercial stake in the outcome. Every report is digitally sealed, so you can always prove its authenticity.
Want to know more? Dive deeper in the knowledge base: