NIS2 Offensive Security Testing
EU co-funded penetration testing for NIS2 entities
Securitum is one of the winners of CYSSDE Open Call 3, an EU Digital Europe programme supported by the European Cybersecurity Competence Centre, to deliver a project that strengthens Europe’s cybersecurity and resilience.
Essential and important entities under the NIS2 Directive, including SMEs operating in relevant sectors, can now commission full-scope, manual penetration tests from Securitum, with part of the cost covered by EU funding.
About
Securitum won this competitive EU call with the “NIS2 Offensive Security Testing” project. By December 2027, we will deliver at least 80 penetration tests over 750 man-days at a reduced price for NIS2-regulated entities, helping them find and fix vulnerabilities in their systems. Anonymised, aggregated results will be published in the open-access NIS2 Offensive Security Threat Landscape report, which aims to show the real state of NIS2 security based on hands-on testing and to help strengthen European cyber resilience.
Who can apply
NIS2 essential and important entities, including SMEs operating in NIS2 sectors, established in the EU. Places are limited. Tests run until December 2027.
What we test
Web applications
OWASP ASVS 5.0 and the OWASP Testing Guide. Covers authentication, authorisation, injection and business logic flaws.
APIs
OWASP API Security Top 10. Covers BOLA/IDOR, mass assignment, token handling and rate limiting.
Mobile applications
OWASP MASVS/MASTG. Covers local storage, reverse engineering, certificate pinning and backend controls
Cloud
IAM, network segmentation, storage permissions, logging and Kubernetes isolation.
Network infrastructure and Active Directory
External and internal threats, privilege escalation, lateral movement and hardening, mapped to MITRE ATT&CK.
How the engagement works
Phase 1: Scoping
We confirm eligibility, agree the scope, testing windows and rules of engagement.
Phase 2: Testing
Manual testing supported by automated tools, black-, grey- or white-box depending on your risk profile. Critical and high findings are reported to you immediately.
Phase 3: Reporting
A full report with an executive summary, CVSS-scored findings, PoCs and remediation guidance.
Phase 4: Retest
Free verification of your fixes within 6 months of the report.
Your data
Your report and findings remain confidential under an NDA. The public Threat Landscape, released after the project concludes, will include only anonymised, aggregated statistics—such as vulnerability categories and CVSS score distributions by sector. It will never include company names or other identifying information.
What you receive
- EU co-funding covering large percentage of the engagement cost
- A full penetration test report: executive summary, CVSS-scored findings, PoCs and remediation guidance
- Immediate notification of critical and high-severity findings during testing
- A free retest within 6 months of report delivery
- Access to the open-access NIS2 Offensive Security Threat Landscape report
FAQ
Q:
Who is eligible for the co-funded test?
Essential and important entities under NIS2, including SMEs in NIS2 sectors, established in the EU.
Q:
How much does it cost?
Around 30-40% less per MD, because EU funding covers the rest. The final price depends on the agreed scope.
Q:
Is the test different from a standard Securitum pentest?
No. It is the same team, methodology and report quality as in our fully commercial engagements.
Q:
What happens with our data?
Your report is delivered only to you and is protected by an NDA. Only anonymized, aggregated statistics are used in the public report, never names or identifying details.
Q:
Until when can we join?
Tests are performed until December 2027. Places are limited, so early qualification is recommended.
Q:
Can we retest after fixing the findings?
Yes. The retest is free of charge within 6 months of the report.
This project has been funded by the European Union’s Digital Europe programme under Grant Agreement 101158471, and is supported by the European Cybersecurity Competence Centre.
