We will contact you within one business day to schedule a no-obligation scoping meeting. Together, we will determine which DigiD integrations, applications, and systems fall within the scope of the project and agree on a suitable schedule.

Yes. A penetration test is a mandatory part of the DigiD assessment. The results are used by the auditor as part of the assessment and are included in the documentation submitted to Logius.

A DigiD penetration test:

• Identifies vulnerabilities before they can be exploited.
• Supports the DigiD assessment with independent research findings.
• Provides insight into the risks associated with DigiD integrations and underlying systems.
• Provides verifiable evidence for auditors and Logius.

This is how a penetration test helps make your DigiD environment demonstrably more secure and audit-ready.

The frequency depends on your DigiD environment, changes to that environment, and the applicable assessment requirements. A new penetration test is often required when significant changes are made to applications, infrastructure, or DigiD integrations.

The results of our penetration test will help you determine when additional or repeat tests are necessary.

Yes. The pentest report is an important part of the DigiD assessment. The findings provide insight into existing vulnerabilities, measures taken, and remaining risks for auditors and Logius.

Upon completion, you will receive an executive summary, a technical report detailing findings and risk assessments, an overview of recommended improvements, and a consultation with one of our ethical hackers. This will provide you with the necessary insights to support your DigiD assessment.

The turnaround time depends on the size of the DigiD environment and the selected scope. A DigiD penetration test typically takes several days, including preparation, execution, reporting, and explanation of the results.

The exact scope varies by organization, but generally includes the DigiD integration, web applications, authentication processes, authorizations, back-end systems, and relevant infrastructure. During the scope meeting, we determine which components will be included in the assessment.

Yes. Our DigiD penetration tests are conducted with the requirements and key considerations from the DigiD assessment process in mind. The report assists auditors in their evaluation and can be used as part of the documentation submitted to Logius.

We will contact you within one business day to schedule a no-obligation scoping meeting. Together, we will determine which systems, networks, locations, and environments need to be assessed and agree on a suitable schedule.

That depends on the risk you want to investigate.

An external network penetration test reveals whether attackers can gain access to your environment from the internet.

An internal network penetration test shows what happens after an attacker gains access—for example, through phishing, ransomware, or stolen login credentials.

To gain a comprehensive picture of their cyber resilience, many organizations combine both types of penetration tests. This provides insight into both the likelihood of a successful attack and its potential impact.

Cybercriminals are constantly on the lookout for vulnerabilities in networks and systems. A network penetration test helps identify these weaknesses in a controlled manner before attackers can exploit them.

This helps organizations to:

• Prevent data breaches.
• Reducing ransomware risks.
• Better protection for critical systems.
• Prevent disruptions to business processes.
• To structurally improve cyber resilience.

A network penetration test:

• Identifies vulnerabilities before attackers do.
• Assesses the effectiveness of existing security measures.
• Simulates realistic attack scenarios.
• Provides insight into risks to systems, networks, and data.
• Provides specific recommendations for improvement.

This will give you insight into the actual resilience of your network environment.

Among other things, we test:

• Internal corporate networks
• External Network Perimeters
• Active Directory environments
• Data Center Environments
• Cloud Environments
• VPN Solutions
• Firewalls
• Servers and Workstations
• Production Networks
• Guest and Office Networks

During the scope meeting, we determine which components are included in the study.

A new network penetration test is recommended:

• In the event of major changes to the infrastructure.
• After migrating to a new environment.
• For new locations or network segments.
• Following changes to security measures.
• Periodically, for example, annually.

The results of the penetration test will help you determine when additional or repeat tests are advisable.

Afterward, you’ll receive an executive summary, a technical report with findings and risk assessments, an overview of recommended improvements, and a consultation with one of our ethical hackers. This will give you immediate insight into the key risks and next steps.

The duration depends on the size of the network environment, the number of systems, and the selected scope. A network penetration test typically takes several days, including preparation, execution, reporting, and explanation of the results.

The exact scope varies by organization, but typically includes:

• Active Directory
• Servers and Workstations
• Network Segmentation
• User Rights
• Authentication and Authorization
• File Servers
• Privilege escalation
• Lateral movement within the network

This allows us to identify what an attacker can do once they have gained access to the internal network.

The exact scope varies by organization, but typically includes:

• Public IP addresses
• Firewalls
• VPN Services
• External Network Services
• Remote Access Solutions
• Internet-based systems
• Email Environments
• External Access Portals

With this, we are investigating what attack vectors are available to attackers from the Internet.

Yes. A network penetration test provides valuable input for information security, risk management, and compliance initiatives. The results help organizations demonstrably identify, assess, and manage cyber risks.

Among other things, the report can contribute to:

• The cybersecurity and risk management requirements set forth in the Cybersecurity Act (NIS2).
• Information security standards such as ISO 27001.
• Government frameworks such as the BIO.
• Internal and external security audits.
• Risk assessments for the board and executive management.