For organisations that want to know what is actually exposed
Vulnerability scan: continuous and from the outside
A certificate tells you what is arranged on paper. A vulnerability scan measures what is actually exposed to the internet today: open ports, expired certificates, known vulnerabilities and forgotten subdomains.
What is a vulnerability scan?
A vulnerability scan is an automated examination that compares systems against databases of known vulnerabilities (CVEs) and misconfigurations. Vulnerability scans come in internal and external variants; Exposentry measures externally, from the internet, because that is where an attacker starts: domains and subdomains, open ports, certificates, email records and version information of internet-facing software.
Exposentry runs that scan continuously on OpenKAT, the open-source security scanner developed within the Dutch government; founder Edward Hasekamp contributes to that project. Findings are compiled into a report, written in Dutch, with an explanation and concrete remediation steps for each finding: every month on a subscription, and for a baseline scan at the start of the term and on request in between. The report is digitally sealed and independently verifiable.
How the Exposentry vulnerability scan works
1. Sign up and verify your domain
You sign up online and prove domain ownership via a DNS record or a file on your website. Nothing is installed and nobody gets access to your systems.
2. Mapping the attack surface
The scanner first maps what your organisation exposes to the internet, including subdomains and services that were long forgotten internally.
3. Continuous scanning
Everything found is continuously checked against known vulnerabilities and misconfigurations. New systems and new vulnerabilities are picked up automatically.
4. Monthly sealed report
On a subscription you receive a monthly report with an explanation and remediation steps per finding, digitally sealed with a timestamp, so you can verify the report has not changed since it was created.
What the report contains
For each type of finding you see what was found, which systems it affects, how serious it is and how to fix it. If a known vulnerability is on CISA's KEV list, the report says so; where available, the EPSS probability of exploitation and how the vulnerability was detected are included. Where the evidence trail can be traced, it names the OpenKAT scan module that made the observation and when. Service-provider infrastructure that only comes into view through your DNS records, such as your provider's name servers or CDN, does not count towards the findings; the report lists it separately. Where possible, a finding is indicatively mapped to controls from ISO 27001 and, if your sector is known, from a framework that fits it: a starting point for your own assessment.
Exposentry digitally seals paid reports, and an independent timestamping service records when that happened. How you, your customer or your auditor can check that a report has not changed since is explained in verifying an Exposentry report.
The sample report on dvwa.cloud, a deliberately vulnerable practice environment run by Hasecon, shows what such a report looks like (PDF of 21 pages, sealed, in Dutch, on request via your business email address). It was made at scan level 3; the Nulmeting and Ketenpartner scan at level 2 by default.
Where the scan ends and a penetration test begins
A penetration test is in-depth manual testing at a single point in time, within an agreed scope. A vulnerability scan is broader, automated and continuous. The two complement each other: the scan shows whether the externally visible basics are in order and where deep testing adds value.
| Vulnerability scan | Penetration test | |
|---|---|---|
| Execution | Automated | Manual, by a specialist |
| Coverage | The external attack surface of your verified domains, including discovered subdomains | Agreed scope |
| Depth | Known vulnerabilities and configuration | Attack paths, business logic, creativity |
| Frequency | Continuous | Usually once a year or after major changes |
| Market price | From free to a few hundred euros per month | From around €1,000; for one web application usually €3,000 to €15,000 |
| Result | Current, repeatable picture; on a subscription with the month-by-month trend | Deep snapshot with proven impact |
| Detection confidence | At Exposentry, stated for each known vulnerability: derived from version information or established with a targeted request | Confirmed manually |
| What it demonstrates | What was visible from the outside at a given moment; at Exposentry dated and, for paid reports, sealed | Whether an attacker within the scope could actually get further |
Penetration test or vulnerability scan: the difference explains when each fits and in which order to use them. Exposentry's prices are on the pricing page.
What an external scan does not see
An external scan looks from the outside, where an attacker starts. Anything behind a login, systems on domains you have not added, your internal network, workstations, application logic and staff behaviour fall outside it; for those you need an internal scan, a penetration test or a phishing test. A known vulnerability derived from a version number can be a false alarm in software where a security patch was applied without the version number changing (a backport). That is why the report states for known vulnerabilities how they were detected. If you want to know the impact of a finding, that is often the moment for a targeted penetration test.
Independent measurement, delivered directly to you
Exposentry does not sell remediation services for its findings and therefore has no stake in the outcome of the scan. Reports go directly to you and are not shared with third parties.
Frequently asked questions
What does a vulnerability scan cost?
As an indication, according to the cost overview in the Exposentry knowledge base (in Dutch): an external scan you run yourself costs from free to a few hundred euros per month, a one-off scan with a report around €300 to €2,000, and continuous scanning with interpretation by specialists €295 to €750 per month. At Exposentry a one-off baseline scan costs €495 and continuous monitoring starts at €249 per month, available online without a sales call. Switch to an annual plan within 60 days of the baseline and the full amount is credited.
See the pricing →How is this different from a penetration test?
A penetration test is manual, in-depth and tied to a moment; a vulnerability scan is automated, broad and continuous. When each fits and in which order to use them is covered in the knowledge base.
Penetration test or vulnerability scan: the difference →How often should you run a vulnerability scan?
More often than most organisations do. Tens of thousands of new vulnerabilities appear every year and your own environment keeps changing. The Dutch NCSC therefore describes vulnerability management as a continuous process; an annual scan leaves blind spots for months on end.
Is a vulnerability scan mandatory under NIS2?
No. NIS2 and the Dutch Cyberbeveiligingswet, in force since 15 August 2026, do not mandate any tool or scan by name. The law requires appropriate measures you can demonstrate; a continuous scan is a demonstrable building block. The knowledge base covers exactly how this works.
Is there a free vulnerability scan?
Yes, as a first impression. The free Exposentry security scan measures what your domain publicly exposes based on public sources, and emails you the result. A paid plan scans your systems directly, continuously for as long as the plan runs: open ports, your website and certificates, and the software versions running on them, checked against known vulnerabilities (CVEs). Active tests, which check whether a known vulnerability is actually present, are part of the NIS2 plans, and with Ketenpartner available per domain with your consent. In both cases you verify the domain by DNS and file.
Try the free security scan →Want to know what is exposed today?
Start with a one-off baseline scan for €495, or choose continuous monitoring from €249 per month. Once you have paid and verified your domain, the measurement starts; the first report usually follows the same day.
Start a scanPrefer to run OpenKAT yourself, or need custom work? Hasecon provides implementation, management and custom development →