When conducting penetration tests, CCV focuses primarily on ensuring the quality of the execution and the expertise of the penetration tester. MIAUW places additional emphasis on transparency, supporting evidence, and the reproducibility of the testing.

No. Although MIAUW was developed for the government, the standard is also being used more and more frequently outside the public sector. Organizations that work with sensitive data or are subject to strict compliance requirements are increasingly opting for MIAUW penetration tests. Examples include organizations in finance, healthcare, manufacturing, and other regulated sectors where demonstrability and auditability are important.

MIAUW stands for Methodology for Information Security Research with Audit Value. It is a standard for penetration testing specifically developed for the government. MIAUW focuses on transparency, reproducibility, and demonstrable quality in security research. This makes it clear not only which vulnerabilities were found, but also how the penetration test was conducted and on what evidence it was based.

A penetration test:

The NIS2 Directive does not specify a fixed frequency. The standard is: regular and risk-based. This means:

NIS2 does not impose an explicit obligation to conduct penetration tests. However, the directive does require organizations to take appropriate technical and organizational measures to manage cyber risks. A penetration test is a proven method for detecting and addressing vulnerabilities in systems. By conducting one, you demonstrate that you are actively working to mitigate risks. This is, in fact, a core requirement of NIS2.

Our ethical hackers are OSCP, OSWE, OSEP, eWPT, CRTO, eJPT, CRTP, and OSCE
certified. In addition, our organization holds official CCV certification.

This is how we ensure that our penetration tests are conducted at the highest possible level of quality.

Penetration testing can be viewed as ethical hacking, sometimes also referred to as white-hat hacking. The goal is to methodically test the security of your IT infrastructure. A penetration test is conducted by a specialized firm within a predefined scope (what is the purpose of the pen test, what is the scope of the project) at a specific time. The penetration test involves an active and passive analysis of IT infrastructures and applications. Occasionally, human factors are also put to the test through social engineering. Penetration tests are now a fundamental part of any risk management strategy. The primary goal of penetration testing is to identify weaknesses regarding the availability, integrity, and confidentiality of data. This is followed by recommendations for remediation.

That depends on your industry, risks, and obligations. In many cases, annual testing is recommended. It’s also a good idea to conduct a new test following major changes, such as the implementation of a new application, infrastructure, or a merger.

A CCV penetration test complies with the Dutch cybersecurity certification scheme. OneXillium is certified, so you can be sure that your test will be conducted professionally and reliably.

Black Box: Without Prior Knowledge—Just Like a Real Attacker Would.

Greybox: with limited information—such as a login or user role.

Whitebox: full visibility—ideal for in-depth audits and compliance checks.

In industries such as financial services (DORA) and government (BIO), a penetration test is required by law. But even in other industries, it is a proven measure for effective risk management and ISO certification.

A penetration test takes an average of 3 to 10 business days, depending on the scope. Our ethical hackers work discreetly and coordinate everything with your IT team. This ensures that the impact on your day-to-day operations is minimal, and you can be confident that the test will be conducted securely.

A penetration test (pentest) identifies vulnerabilities in your IT environment before malicious actors discover them. This helps you prevent data breaches, downtime, or damage to your reputation.