For suppliers of organisations that fall under NIS2
Your customer sends a NIS2 questionnaire. This is what you attach.
Your customer's questionnaire records what you declare. An Exposentry report records what your business actually exposes to the internet: measured by a third party, dated and sealed. The kind of evidence a reviewer asks for next to the question about vulnerability management.
Why a completed questionnaire alone is not enough
Your customer falls under NIS2 and has to assess the risks of its suppliers. That is in Article 21 of the directive and, since 15 August 2026, in the Dutch Cybersecurity Act. The question that lands on your desk as a result is usually: how are your patch management and vulnerability management organised, and can you demonstrate that?
The Dutch NCSC writes that such a paper exercise alone is not enough: the buyer should question the supplier on its answers and do its own research. A sentence like 'we install updates regularly' is then hard to substantiate. A dated report of an independent measurement is not: the reviewer sees which of your systems are exposed to the internet, which known vulnerabilities come with them and when that was established. And in the next month's report, whether that number goes down. That is how you show, month after month, what changes on the outside.
How it works, in three steps
1. Sign up
You choose Ketenpartner, enter your Chamber of Commerce number and your domain, and pay by iDEAL or credit card. The measurement is done from the outside, over the internet; nothing changes on your systems.
2. Your administrator adds one record
To prove the domain is yours, your IT administrator or web developer adds one DNS record, or a small text file on your website. You receive the instruction by e-mail and can forward it. Exposentry checks every ten minutes whether the record is there; then OpenKAT starts measuring. If it does not appear, we remind you after three days.
3. Attach the report
The first report is usually in your inbox the same day, then every month. The report is digitally sealed with an independent timestamp (RFC 3161): if anything changes in the file afterwards, the seal no longer matches. You attach it to your answer on the questionnaire.
What the report contains
- Which domains, subdomains and services of your business are visible from the internet, including subdomains that are often overlooked.
- How your certificates and e-mail security (SPF, DKIM, DMARC) are doing.
- Which known vulnerabilities come with them, with severity, explanation and remediation step, and how the number develops compared with the previous measurement.
The sample report on dvwa.cloud, a deliberately vulnerable practice environment run by Hasecon, shows what the report you can hand to your customer looks like (PDF of 21 pages, sealed and free to share, in Dutch, on request via your business email address). Each type of finding lists where it comes from. The sample was made at scan level 3; Ketenpartner and the Nulmeting scan at level 2 by default, without the active vulnerability scans.
Every report carries the date and timestamp of the measurement, so the reviewer sees the evidence is current. How your customer checks the seal is explained in Verifying an Exposentry report.
Who is behind the report
Exposentry is a service of Hasecon, a Dutch company. The measurement comes from OpenKAT, the open-source scanner developed within the Dutch government. Founder Edward Hasekamp contributes to that scanner himself; read who is behind Exposentry.
- Built on OpenKAT, developed within the Dutch government
- Founder Edward Hasekamp is a collaborator on the OpenKAT project
- Hosted in the EU by Hasecon, a Dutch company
What it costs
Ketenpartner
€249 per month, excl. VAT
Up to ten domains measured continuously, a sealed report every month, dashboard access and support by e-mail. Cancel at any time; the subscription then runs until the end of the paid period.
Start KetenpartnerBaseline scan
€495 one-time, excl. VAT
For answering a single questionnaire: one domain, one sealed report and a half-hour debrief with Edward Hasekamp. Move to a yearly subscription within 60 days and we credit the baseline scan in full.
Order baseline scanWhat the report answers, and what you provide yourself
The report is your attachment for the questions about vulnerability management and about what you expose to the internet. It measures the outside of your business: public sources plus light checks on your certificates, ports and web pages. Internal systems stay out of scope and it is not a penetration test. If you want that deeper measurement, the NIS2 plans are there for it.
Questions about your MFA policy, your incident procedure and your own suppliers you answer with your own documentation. How to approach those questions is in our guide to answering a NIS2 supplier questionnaire.
Frequently asked questions
Will my customer accept this as evidence?
That is your customer's call. What you deliver is a dated measurement by a third party, sealed with a timestamp, of the outside that a reviewer can also check themselves. The Dutch NCSC advises buyers to verify supplier answers; with this report you make that possible for your customer.
Do I need to install anything or involve my administrator?
The measurement is done from the outside, over the internet; you install nothing. Your administrator is needed once, for the DNS record or the text file that proves the domain is yours. That is one record or one file, with the instruction in one e-mail.
What if the report shows vulnerabilities?
Then you know yourself, with a date attached. Every finding comes with an explanation and a remediation step, so your administrator knows what to do. In the next month's report you see whether the number goes down. An improvement point with a date is easy to account for in a questionnaire.
How soon do I have the first report?
Usually the same day after your domain is verified. If OpenKAT is still busy at that moment, it is an interim result and the rest follows in the next report. OpenKAT measures continuously after that; the monthly report bundles the state at that moment.
Next questionnaire: one attachment
Start Ketenpartner and attach the same piece of evidence to every questionnaire from now on. Still unsure? Request the free scan first or book a 30-minute call.