NIS2 Penetration Testing

Article 21(2) sets out the minimum: policies on risk analysis, incident handling, business continuity, supply-chain security, security in acquisition and development, policies to assess the effectiveness of measures, basic cyber hygiene, cryptography, access control and asset management, and the use of multi-factor authentication. Point (f) matters most here, because assessing the effectiveness of your risk-management measures is precisely what a penetration test does. We test whether the controls behind those bullet points actually stop an attacker.

NIS2 sets tight reporting deadlines: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report within a month. A pentest that reaches a critical system is a useful rehearsal for whether your detection would even give you the clock to start. Where you want it, we run the test loud enough at the end to check your monitoring fires.

Article 20 puts responsibility on the management body and exposes it to liability. Independent testing gives your board defensible evidence that it exercised oversight, which is the record you want if a supervisor or an insurer ever asks.

We identify the assets that support your essential or important service, map the external attack surface with tooling like nmap and passive reconnaissance, and agree the rules of engagement. Nothing intrusive runs before this is signed.

The bulk of the work is manual. We use Burp Suite for web and API testing, custom tooling for network and service exploitation, and hands-on business-logic testing that no scanner performs. When we find a weakness, we prove it by exploiting it safely, then chain findings to show the realistic path an attacker would take from the internet to your crown jewels.

Authenticated and unauthenticated views

We test both from the outside with no credentials and from inside a low-privilege account, because the two tell you different things. An unauthenticated view shows what a stranger reaches. An authenticated view shows how far a phished employee or a malicious insider gets once past the front door, which for NIS2 estates is usually the more dangerous story.

You get an executive summary and a technical report, each finding carrying a CVSS score, reproduction steps and a prioritized fix. After your team remediates, we retest at no extra cost and confirm the holes are closed.

The directive calls for MFA, yet we routinely find remote access, admin panels and legacy VPNs where a single stolen password is enough. We test whether phishing one credential actually gets an attacker in.

When a compromised workstation can reach a control system or a patient database directly, one foothold becomes a full breach. We test how far lateral movement gets before something stops it.

Forgotten internet-facing services carrying known CVEs are still the fastest way in. We verify exploitability rather than just flagging a version number.

NIS2 makes supplier security an explicit obligation. We look at the access your vendors and managed service providers hold and what an attacker could reach through it.

A short summary for the management body, then a full technical report with every finding, its impact, CVSS score, evidence and a concrete remediation step. Findings are cross-referenced to the relevant Article 21 measures so a supervisor sees the connection immediately.

An attestation letter you can show clients, insurers and your competent authority, plus a free retest confirming the fixes hold. That retest letter is often what closes the loop for audit.

These include operators in energy, transport, banking and financial market infrastructure, health, drinking and waste water, digital infrastructure such as data centers and DNS providers, ICT service management, public administration, and space. Larger firms in these sectors generally land here and face the fuller supervisory regime.

This category adds sectors like postal services, waste management, chemicals, food, manufacturing of certain products, digital providers such as online marketplaces and search engines, and research. Medium-sized firms in the essential sectors often sit here too. The measures are the same; the supervision is lighter-touch until something goes wrong.

The size and sector test

National transpositions differ in the detail, so the safe move is to check your specific situation against your country’s law. In practice, if you provide one of the listed services and you are medium-sized or larger, you should assume you are in scope and plan your testing accordingly.

Get the technical evidence in place ahead of any interaction with your competent authority, so you are presenting a remediated estate and a clean retest letter rather than a fresh list of open holes.

A new customer-facing platform, a cloud migration, a merged business unit or a new critical supplier all change your attack surface. Retesting after material change is part of keeping Article 21 measures effective rather than stale.

An annual test, with a lighter check after major releases, keeps your assurance current and gives the management body a steady record of oversight rather than a one-off snapshot.