Back to knowledge base

Outsourcing vulnerability management: when it is smart, what to demand and what stays with you

Published on August 25, 2026 · Updated on October 29, 2026

At many mid-sized organisations it looks like this: more than a hundred new vulnerabilities are published every day, the environment changes weekly, and there is one person who does this "on the side". At such a moment the question arises whether outsourcing vulnerability management is wiser than continuing to muddle through yourself. The answer is more nuanced than a salesperson tells you, because part of this process can be handed over and another part principally stays with you.

This article explains what you can and cannot outsource, when it is a good choice, what to look for in a provider, and which responsibility stays with you under NIS2 and the Dutch Cybersecurity Act regardless.

What outsourcing vulnerability management actually involves

Vulnerability management is the ongoing process by which you discover vulnerabilities, prioritise them by risk, remediate them and verify the remediation, and keep repeating that. The Dutch NCSC writes this as "kwetsbaarhedenbeheer"; in the market it is often called vulnerability management. Outsourcing means you place one or more steps of that cycle with an external party rather than running them entirely yourself. The full process is described in our article on vulnerability management; this piece is about the question of which part you can hand over.

Important to be clear on up front: vulnerability management is broader than the external attack surface alone. It also covers authenticated scans inside your network, CVE management on workstations and servers, and the configuration of your cloud environment. What is easiest to outsource in practice is the external measurement side: everything visible from the internet, periodically mapped from the attacker's perspective. That is also known as external attack surface or EASM. That external measurement is an important part of vulnerability management, and it does not replace the internal scope. Anyone who outsources the external measurement has therefore not covered their entire vulnerability management.

That external measurement side is also what continuous vulnerability monitoring delivers. The cycle also has steps only you can take, and the distinction between those two is the core of a sensible outsourcing decision. Anyone who ignores that distinction buys a service expecting the problem to be gone, and discovers at the first finding that the real work only starts there.

What you can outsource

The external measurement side lends itself well to outsourcing, for a practical reason: it is repetitive, specialised and benefits from continuity. An external service takes over four tasks.

1. Discovery and detection. A provider periodically maps what of yours is exposed to the internet, including forgotten systems, and examines it for known vulnerabilities and configuration errors. This happens automatically and on a fixed cadence.
2. Technical prioritisation. Ask whether the service weighs whether a vulnerability is actually being exploited in the wild, so that urgency lands on the right findings. That technical weighing (with exploitability and exposure alongside the severity score) can be outsourced; how it works is explained in EPSS and KEV explained. The final weighing towards business risk requires your own context and stays with you.
3. Remediation verification. After your team has closed a gap, an external rescan can independently confirm that the vulnerability really is gone. That confirmation from the outside carries more evidential value than the internal team ticking off its own remediation.
4. Reporting. Dated, traceable reports in language understood outside the IT department too, usable towards the board, customers and auditors.

The gain is not only in time. An external party sees more environments and keeps the technology current, whereas an internal specialist doing this alongside other work falls behind sooner on the pace at which new vulnerabilities appear. In 2025, more than 48,000 CVEs were published, over a hundred per day. Keeping up with that pace is a job in itself.

What always stays with you

This is the distinction a provider should name up front. Three responsibilities are principally not transferable.

The first is ownership of remediation. A provider can measure that a system is vulnerable, but only your own IT team or hosting party can patch, reconfigure or switch it off. Detection can be outsourced, closing the gap remains an action in your own environment. Remediation itself requires access to your systems, and you keep that in your own hands.

The second is knowledge of your own environment. An external party sees what is exposed to the internet, without knowing which system runs your invoicing and which subdomain is an old campaign page that can go tomorrow. That context determines how serious a finding really is, and that context sits with you. The provider delivers the measurement, you deliver the meaning.

The third is the duty of care itself. Under NIS2 and the Dutch Cybersecurity Act the board remains ultimately responsible for managing the risks, even when the execution sits with a supplier. You can outsource the work, the liability you cannot. That makes outsourcing a way to demonstrably meet the obligation, as long as you keep control yourself.

Outsourcing, NIS2 and the Dutch Cybersecurity Act

The Dutch Cybersecurity Act has been in force since 15 August 2026 with no general transition period, and the underlying NIS2 directive frames the duty of care as ongoing: managing risks is a continuing obligation the board oversees. Nowhere in that legislation does it say you must outsource vulnerability management, and no tool or service whatsoever is mandatory by name.

Outsourcing does often make demonstrating it easier, and that is where the difference that matters in practice sits. A completed supplier questionnaire is a claim on paper. A series of dated, monthly reports from an external measurement is evidence that the control really and repeatedly takes place. That distinction between paper and measurement is the reason organisations hand the measurement side to an independent party: a measurement that stands apart from whoever manages the systems weighs more heavily as evidence than a self-declaration. Scanning delivers the measurement; you build the compliance around it yourself, with that measurement as a building block in your own story.

Watch one pitfall. Outsourcing to a supplier makes that supplier part of your supply chain. The question "how does my provider demonstrate that its own house is in order" is then fair, and a serious party holds itself to the same yardstick: its own measurement, its own evidence, rather than a reassurance. That keeps the independence you buy verifiable on the provider's side too.

What to look for in a provider

Start with the measurement quality. Four questions help you recognise a full-fledged service:

1. Does the provider discover your full attack surface, or only what you submit? A service that starts from your own list misses, by definition, the forgotten systems, and that is often exactly where the risk sits. Discovery should be part of the service.
2. Is the cadence continuous and fixed? A one-off or annual scan is a snapshot that ages quickly. Ask for weekly or monthly repetition, so the picture moves along with new vulnerabilities and with changes in your environment.
3. Is the reporting usable as evidence? Dated, traceable and readable outside the IT department. Without that, the measurement is rudderless and weak as an exhibit.
4. Is the underlying technology verifiable? With transparent, verifiable technology you can check how measurement is done; with a closed system you take the provider at its word.

Alongside measurement quality there are the commercial terms, and these in particular are often skipped when comparing. An external party processes data about your infrastructure on your behalf and thereby becomes a processor within the meaning of the GDPR, so a data processing agreement and clarity about the data location belong in the arrangements. Also record response times, and an exit in which you take your historical measurement data with you, so that you are not locked in to one provider to keep the evidence trail you have built up.

On the point of verifiable technology we colour our own choice. Exposentry is built on OpenKAT, the open-source scanning platform originally developed on behalf of the Dutch government. Edward Hasekamp of Hasecon contributes to the upstream OpenKAT repository as a collaborator. That the engine is open and inspectable means the way measurement is done can be traced.

In-house or outsourced: the trade-off

Doing it yourself is defensible when you have a security team with capacity and current knowledge, and when vulnerability management belongs among the core tasks. At organisations without their own security team, where management rests on one overloaded IT person, the question shifts: it then becomes less about whether it could be done better internally, and more about whether it structurally happens internally at all.

Weigh it against each other. In-house means buying and managing tooling, freeing someone up to weigh findings weekly, and maintaining the reporting yourself. Outsourcing moves that into a fixed monthly cost, with continuity that keeps running when the colleague concerned is on holiday or leaves. As an indication, at providers of continuous monitoring: it costs hundreds of euros per month, a one-off baseline scan a few hundred euros. If you have no team with capacity, that calculation often comes out in favour of handing over the external measurement side, while remediation and control stay in-house. What an external service costs, you can see under plans and pricing.

The switch in practice

Outsourcing usually starts with a baseline scan: the provider inventories what of yours is visible on the internet, including systems you no longer had in view. You supply your domain names for that and confirm you are the owner, so that only what is yours gets measured. That first measurement gives a starting picture; after that the service settles into a fixed cadence. The build-up can deliberately be kept small: start with the baseline scan, and expand only when the starting picture gives reason to.

Common mistakes when outsourcing

Outsourcing goes wrong on a few recognisable points:

• Thinking the duty of care moves along. The execution transfers, the board's ultimate responsibility stays. Anyone who confuses that is empty-handed at an incident.
• Not assigning a remediation loop. A provider delivers findings; if no one internally owns the remediation, the reports pile up without anything actually being closed.
• Buying a one-off scan as "monitoring". Without a fixed cadence it is a snapshot, not a continuous picture.
• Skipping the data processing agreement. Then an external party processes your data without the arrangements the GDPR requires.

Conclusion

Outsourcing vulnerability management works when you keep clear what you hand over and what you do not. The external measurement, the detection, the technical prioritisation, the remediation verification and the reporting can be placed well with a specialised party that brings continuity and current technology to it. Remediation, the knowledge of your environment and the duty of care stay with you. Anyone who draws that line sharply buys a working building block underpinning demonstrable risk management rather than a false sense of security.

Exposentry delivers that external measurement side as a service: continuous scans of your external attack surface based on OpenKAT, with monthly, forensically substantiated reports you include as an exhibit in your own file. You can start small: begin with a baseline scan that inventories what of yours is exposed to the internet, and let it settle into a fixed monthly cadence. See the plans and pricing or start with a baseline scan to see where you stand.

Sources

• NCSC, "Kwetsbaarhedenbeheer" (vulnerability management), ncsc.nl
• CVE Program / NIST NVD, annual overview of published CVEs 2025 (48,174, over 48,000), see the 2025 CVE year in review at jerrygamblin.com and cve.org
• Government of the Netherlands, "Cybersecurity Act and Critical Entities Resilience Act in force from 15 August 2026", rijksoverheid.nl
• NIS2 Directive (EU) 2022/2555, Article 20 (governance, responsibility of management bodies) and Article 21 (cybersecurity risk-management measures), eur-lex.europa.eu
• OpenKAT, open-source scanning platform, originally developed on behalf of the Dutch government, openkat.nl

Written by Edward Hasekamp, founder of Exposentry and collaborator on the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides EU-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.