Knowledge base
Practical articles on the NIS2 supply chain obligation, your digital attack surface and evidence-first vulnerability monitoring.
NIS2 & Cybersecurity Act
The Dutch Cybersecurity Act has applied since 15 August 2026, without a general transition period. What NIS2 and the supply-chain duty of care really require of you, and why you have to demonstrate it, not just declare it.
Published on August 16, 2026
Is a vulnerability scan mandatory under NIS2?
NIS2 does not mandate any tool by name, including vulnerability scans. What the law does require: appropriate measures you can demonstrate.
Read article →Published on July 11, 2026
Do I fall under NIS2? How to determine whether your organisation is an essential or important entity
Sector plus size determine whether your organisation falls under NIS2 and the Dutch Cybersecurity Act. Walk through the self-check: which sectors, which thresholds, the exceptions, and what to arrange now.
Read article →Published on July 7, 2026
Dutch Cybersecurity Act final: NIS2 applies in the Netherlands from 15 August 2026
The Dutch Senate has adopted the Cybersecurity Act and the Critical Entities Resilience Act. Both entered into force on 15 August 2026. What does this mean for your organisation and your suppliers?
Read article →Published on June 16, 2026
What is actually required under the NIS2 supply-chain duty of care (and what is not)?
NIS2 does not mandate any specific tool. Learn what the supply-chain duty of care really asks of you, when the Dutch Cybersecurity Act took effect, and how to substantiate it with evidence.
Read article →Published on June 12, 2026
How do you answer a NIS2 supplier questionnaire? A practical guide for SMEs
A NIS2 supplier questionnaire from your large customer on your desk? How to answer the four themes that follow directly from the NIS2 requirements (patch management, MFA, incident response and your own suppliers), with evidence the assessor takes seriously.
Read article →Published on June 12, 2026
The NIS2 roadmap for public-sector boards: from duty of care to demonstrable compliance
A practical NIS2 roadmap for public-sector boards: from duty of care to demonstrable compliance in five steps. With concrete actions for scope, training, monitoring, incident response and the audit trail.
Read article →Published on June 5, 2026
NIS2 and joint and several liability: what public-sector directors should and should not fear
NIS2 makes cybersecurity a board-level responsibility. Read what this means for public-sector directors, liability, duty of care, training obligations and demonstrable risk management.
Read article →Published on May 26, 2026
Scanning is not NIS2 compliance. But it is a necessary building block
An honest take: scanning for vulnerabilities does not make you NIS2 compliant. But it does provide defensible evidence for vulnerability management and the supply-chain duty of care.
Read article →Published on May 12, 2026
NIS2 and suppliers: what your large customer asks of you and how you prove it
Supplying a NIS2-regulated customer? The supply-chain duty of care (Art. 21) also reaches suppliers. What your customer may ask and how you demonstrate it.
Read article →
Attack surface & vulnerabilities
What your organisation exposes to the outside world, and how to find and prioritise vulnerabilities before an attacker does.
Published on July 11, 2026
Not every vulnerability is equally urgent: EPSS and KEV explained for decision-makers
A scan report with dozens of findings: what comes first? EPSS predicts the likelihood of exploitation, the KEV catalogue shows confirmed exploitation. This is how you prioritise by actual risk instead of severity scores alone.
Read article →Published on July 11, 2026
Penetration test or vulnerability scan: the difference, and what your organisation needs under NIS2
What a penetration test and a vulnerability scan each measure, what they cost, what NIS2 expects and in which order to use them. A guide for decision-makers.
Read article →Published on July 11, 2026
What is vulnerability monitoring, and why a one-off scan is not enough
Vulnerability monitoring is the continuous surveillance of your systems for vulnerabilities. Why does a one-off scan or pentest age so quickly, what does NIS2 expect, and what should you demand from good monitoring?
Read article →Published on July 3, 2026
internet.nl is free. So when do you need Exposentry?
internet.nl is an excellent free starting point for modern internet standards. But a snapshot and an evidence file are two different things. When a free check is enough, and when it is not.
Read article →Published on June 16, 2026
EASM for SMEs and the supply chain: know and manage your external attack surface
Your external attack surface changes constantly. What External Attack Surface Management (EASM) is, why SMEs and the supplier chain need it, and how to manage it with evidence.
Read article →Published on June 16, 2026
What is OpenKAT, and what it is not
OpenKAT is a free, open-source vulnerability analysis tool, originally built by the Dutch Ministry of Health and now maintained by the community. Not a mandatory SaaS, not a certification.
Read article →Published on June 12, 2026
Shadow IT and NIS2: how do you manage and secure unknown digital assets?
Shadow IT is the biggest blind spot under NIS2. Learn how to manage your external attack surface: prevent subdomain takeover, find exposed admin panels and track down expired certificates with continuous monitoring.
Read article →Published on May 19, 2026
What does an attacker see of your domain?
Your attack surface in plain English: DNS, open ports, TLS, subdomains, exposed panels and CVEs. What an attacker sees and why monitoring matters.
Read article →
Evidence & reporting
From a list of vulnerabilities to traceable, independent evidence that auditors, insurers and boards can trust.
Published on July 3, 2026
Independent reporting: why your IT provider should not judge its own work
A security report that reaches you through your IT provider is judging that provider's own work. Why that weakens your evidence and what independent reporting means.
Read article →Published on June 16, 2026
Forensically substantiated evidence: what auditors and insurers really want to see
A list of vulnerabilities is not evidence. Auditors, cyber insurers and large customers want traceable, dated evidence. What that is and how to build it.
Read article →Published on June 12, 2026
From CVE list to board report: how do you filter cyber noise for the board?
You don't build a cybersecurity board report by summarising a CVE list. How to filter noise using exploitability and exposure, and build a NIS2 dashboard the board can actually steer on.
Read article →Published on June 5, 2026
For CISOs: from vulnerability list to board-level evidence
CISOs need more than a list of vulnerabilities. Discover how evidence-first vulnerability monitoring helps make attack surface, risks and remediation demonstrably governable.
Read article →
Guides & settings
Practical steps: verify your domain, set up mail records (SPF, DKIM, DMARC) and check a security report.
Published on October 28, 2026
Recognising Exposentry scan traffic
The IP addresses Exposentry scans from, the User-Agent it uses, when it scans and what happens at each scan level. This lets your IT manager, hosting provider or SOC recognise the traffic.
Read article →Published on July 17, 2026
SPF, DKIM and DMARC explained: why domains that never send email need these records too
SPF, DKIM and DMARC explained with example records. Plus the blind spot: domains that never send mail, null MX, and what MTA-STS, DANE, BIMI and CAA add.
Read article →Published on June 26, 2026
Verifying an Exposentry report: digital seal and timestamp
By default we digitally seal and timestamp every Exposentry report. Here is how to confirm a report is genuinely ours and has not been altered, using our public certificate and its fingerprint.
Read article →Published on May 29, 2026
Verifying your domain: step-by-step guide
Prove ownership of your domain in three ways: a DNS TXT record, a file on your web server, or an HTML meta tag. One method is enough for most plans; the NIS2 plans require two. Includes provider examples and fixes for common problems.
Read article →
Published on October 28, 2026
What does a vulnerability scan cost, and what does a pentest cost?
Prices of pentests and vulnerability scans in the Netherlands, by type of service, as providers published them on 28 October 2026. What drives the price and how to compare quotes.
Read article →Published on September 8, 2026
Vulnerability management and NIS2: is it mandatory?
NIS2 and the Dutch Cybersecurity Act never name vulnerability management. Yet the duty of care makes a continuous, demonstrable process for handling vulnerabilities hard to avoid in practice. Here is how that works.
Read article →Published on August 25, 2026
Outsourcing vulnerability management: when it is smart, what to demand and what stays with you
Outsourcing vulnerability management takes work off a small IT team, but not every task can be handed over. When is outsourcing sensible, what should you look for in a provider, and which responsibility always stays with you?
Read article →Published on August 23, 2026
External attack surface monitoring: evidence for your auditor
External attack surface monitoring explained: what a scan from the outside finds, how to set it up and how reports provide evidence that holds up in an audit.
Read article →Published on August 22, 2026
NIS2 compliance checklist: demonstrable compliance in 2026
NIS2 compliance checklist for the Dutch Cybersecurity Act: determining scope, the ten areas of measures, the reporting obligation, fines and the evidence file with which you demonstrate compliance.
Read article →Published on August 18, 2026
Technical vulnerability management under NEN 7510: what control 8.8 asks of healthcare organisations
Since the 2024 revision, NEN 7510 follows the structure and numbering of ISO 27001:2022. Management of technical vulnerabilities sits in it as control 8.8. What does the standard expect of a healthcare organisation, and how do you demonstrate it at an audit?
Read article →Published on July 28, 2026
Vulnerability management: the process, the standard, and how to prove it works
Vulnerability management is the continuous cycle of discovering, prioritising, remediating and verifying vulnerabilities. What does that process look like, what do ISO 27001, NEN 7510 and the Dutch Cybersecurity Act expect, and how do you demonstrate it works?
Read article →