Article 21 NIS2 defines specific technical and organisational measures. A penetration test provides measurable evidence for the most important ones.
NIS2 requires systematic identification and assessment of risks. Our pentest delivers a realistic risk picture based on actual attack vectors.
To be able to report incidents, you need to know where vulnerabilities are. The pentest uncovers potential entry points before a real incident occurs.
We test whether critical systems and backups are protected against real attacks – including ransomware scenarios and network segmentation.
NIS2 requires risk assessment of service providers and suppliers. Social engineering and OSINT show how attackers can enter your organisation via third parties.
Segmentation, firewall rules, privileged access: we test whether your network is a real attack barrier or only secure on paper.
Weak authentication and missing encryption are the most common entry points. We systematically test all exposed access points for vulnerabilities.
NIS2 covers essential and important entities with 50+ employees or €10m+ turnover in critical sectors – significantly broader than the old NIS1.
From scoping to NIS2-compliant final report – structured, documented, and designed for demonstrability.
We jointly define the test scope and map it to the relevant NIS2 requirement articles. This ensures the report delivers the right compliance evidence from the start.
Information gathering via publicly available sources (OSINT), network scans and attack planning according to the state of the art.
Manual exploitation within the agreed scope – physical, digital or both. We communicate critical findings immediately so you can act.
Every finding is rated by severity, exploitability and business impact – with direct reference to the NIS2 requirements catalogue.
Complete documentation of all findings with recommendations, management summary and NIS2 compliance mapping. Suitable for BSI audits and internal evidence.
NIS2 does not prescribe a specific testing method – but the following modules cover the most relevant requirements and provide the strongest evidence.
Simulated break-in attempt at your company premises. Covers Art. 21(2)(a) risk analysis and physical security measures – often the underestimated attack vector.
Learn moreNetwork segmentation, firewall rules, privileged access, AD hardening. Directly relevant for Art. 21(2)(e) network security and (h) cryptography & access control.
Learn morePhishing, vishing, pretexting. Shows how vulnerable your organisation is to the human factor – NIS2 Art. 21(2)(b) supply chain security and staff awareness.
Learn more
Think like an Attacker, Act as a Partner