Transparent pricing
Three subscriptions and a one-time baseline scan, built on OpenKAT.
A pentest typically costs €3,000 to €15,000. And it is a snapshot.
Exposentry is not a pentest, but continuous vulnerability monitoring of your external attack surface: twelve months of continuous visibility, with forensic evidence per finding, for the price of one pentest. The two complement each other: monitoring shows where and when in-depth testing is worthwhile.
Prices as of July 2026, excluding VAT. The rates shown apply for the current subscription period; any changes are announced in advance, at the latest one month before renewal.
Baseline scan
For those who want a one-time sharp picture of their external attack surface, as a sealed report to present to a customer, auditor or board.
one-time
1 domain in view
22 scan modules
Order baseline scanUpgrade to a yearly subscription within 60 days and we credit the baseline scan in full.
- ✓1 domain, full external scan
- ✓Also finds subdomains and shadow IT
- ✓Forensic evidence per finding
- ✓Prioritized findings
- ✓Board- and auditor-ready PDF report
- ✓Findings indicatively mapped to standards such as ISO 27001
- ✓30-minute debrief with a security expert
Ketenpartner
For suppliers whose customer sent them a NIS2 questionnaire. A questionnaire records what you declare; the monthly sealed report records what is actually exposed, so you can place it alongside.
per month
Up to 10 domains in monitoring
22 scan modules
Start Ketenpartner- ✓Continuous monitoring of up to 10 domains
- ✓Continuous scans and CVE checks, monthly report
- ✓Email alerts on new findings
- ✓Monthly report with forensic evidence
- ✓Exportable towards your client
- ✓Findings indicatively mapped to standards such as ISO 27001
- ✓Dashboard access
- ✓Per domain, with your permission: active tests for known vulnerabilities too (level 3)
- ✓Email support
NIS2 Monitoring
StandardFor organizations that fall under NIS2 or the Dutch Cybersecurity Act themselves and must demonstrate their vulnerability management to board and regulator on an ongoing basis.
per month
Up to 10 domains in monitoring
27 scan modules, with active vulnerability scanning
Start NIS2 Monitoring- ✓Everything in Ketenpartner
- ✓Up to 10 domains
- ✓Active tests for known vulnerabilities, including Nuclei and Nikto, after DNS and file verification
- ✓Prioritized findings
- ✓Real-time alerts: Slack, Teams, PagerDuty and webhooks
- ✓Annual strategic review (1 hour)
- ✓Personal expert interpretation every quarter
- ✓Direct escalation on critical findings, no ticket portal
NIS2 + Supply Chain
For organizations that must keep an eye on their suppliers alongside their own domains, with a security expert on hand.
per month
10 domains and 10 suppliers in monitoring
27 scan modules, with active vulnerability scanning
Book an intro callWe discuss scope and onboarding in a short call before we start.
- ✓Everything in NIS2 Monitoring
- ✓Supply-chain: 10 suppliers included
- ✓SIEM integration and full API access
- ✓Live quarterly review with a security expert
- ✓4 consultancy hours per quarter
- ✓Assistance with audit questions
Nulmeting and Ketenpartner scan at level 2: we map what your organisation exposes to the internet, such as open ports, certificates and web servers, and recognise vulnerable software versions. With Ketenpartner you can choose level 3 per domain: we then also actively test for known vulnerabilities, after you have given permission and verified the domain in two ways. The NIS2 packages scan at the highest level, with the same double verification. With Ketenpartner level 3 is included at no extra cost; with the NIS2 packages it is part of the package's standard scope.
Subscriptions can be cancelled at any time via the dashboard; they then run until the end of the paid period. The baseline scan is one-time and runs for two months; afterwards you choose whether to continue with a subscription.
What you are paying for
The report is a piece of evidence
Paid reports are digitally sealed with an independent timestamp (RFC 3161). If the file changes afterwards, the seal no longer matches. That is how a report is demonstrably unchanged since the measurement date.
Built on the government's scanner
Exposentry runs on OpenKAT, developed within the Dutch government and, since 2026, maintained and developed further by the LibreKAT Foundation. In the NIS2 packages OpenKAT, at its highest scan level, actively probes your systems for known weaknesses. We only switch that on after verifying your domain in two ways: DNS record and file on your site.
Human interpretation is included
With the baseline scan you discuss the result for half an hour with a security expert. NIS2 Monitoring gets personal interpretation every quarter, NIS2 + Supply Chain adds four consultancy hours per quarter and help with audit questions. Ketenpartner works with email support.
Hosted and stored in the EU
Exposentry runs on infrastructure in the European Union and your scan data and reports are stored there. For an organization under NIS2 or the Dutch Cybersecurity Act, the processing location is an explicit consideration.
The sample report on dvwa.cloud, a deliberately vulnerable practice environment run by Hasecon, shows how a report is structured (PDF of 21 pages, sealed, in Dutch, on request via your business email address). It was made at scan level 3; the level each package scans at is shown above.
How pricing works: credits
Every subscription comes with credits you use to put assets into monitoring. Need more capacity? You buy extra credits at €1 per credit per month.
You're only billed for what you declare yourself. Whatever the scan finds behind it, such as subdomains and linked IPs, doesn't count. A predictable bill, no surprises.
Supply-chain: your suppliers in view
Supplier monitoring is part of the NIS2 + Keten plan. Alongside your own domains, you keep ten suppliers in view externally: a passive scan on public sources per supplier, alerts on new exposure and exportable reporting for your supplier file. Demonstrable evidence next to your questionnaires.
You add suppliers beyond the ten included for €5 per supplier per month. Forty suppliers is then €795 plus 30 × €5 = €945 per month. If a supplier wants a deeper scan, you give them a voucher code; they receive their own sealed report they can share with you.
Book an intro callNIS2 supply chain duty? Deliver defensible evidence.
By the Dutch government's estimate, more than 8,000 organisations fall directly under the Dutch Cybersecurity Act; through the supply chain duty, many of their suppliers are affected too. Every package delivers defensible evidence for your vulnerability management: a demonstrable building block for your duty of care, not a full compliance guarantee.
All subscriptions include 2 months free with yearly billing. Questions? Book an intro call
Hesitant because internet.nl is free? That is a fine starting point. When you need continuous monitoring with evidential value, read internet.nl is free, so when do you need Exposentry?
What do scans and pentests cost elsewhere? Published prices per type of service are in what a vulnerability scan and a pentest cost (in Dutch)
Need your own OpenKAT environment or specific requirements? Hasecon provides implementation and custom development →
Get in touch
Questions about our plans, the NIS2 supplier duty, or a tailored quote? Book an intro call or leave a message.
Book an intro call
30 minutes, no obligation. We'll discuss your situation and scope.