Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
European Union
Manual penetration testing and risk-management support scoped to what NIS2, DORA, and GDPR actually require, not a generic international template applied to an EU-specific regulatory question.
Ransomware is the EU's #1 threat, five years running.
Ransomware incidents against European organizations rose 23% year-over-year, per ENISA's own threat landscape data.
ENISA, NIS360 2026NIS2 and DORA get referenced together often enough that it's worth being precise: they're separate directives with separate testing obligations, and neither one names a fixed penetration testing cadence the way some vendors imply. NIS2 applies broadly across 18 essential and important sectors, with Article 21 naming penetration testing among the risk-management measures expected on a "proportionate" basis. DORA applies specifically to EU financial entities, and creates two distinct obligations, a general ICT testing requirement almost every entity needs, and a much narrower threat-led penetration testing (TLPT) program under Articles 26–27 reserved for entities a national competent authority specifically designates.
Getting this distinction wrong in either direction is a real cost, over-scoping TLPT-grade testing when the general obligation is all that's required wastes budget; under-scoping when TLPT genuinely applies leaves a compliance gap. We scope every EU engagement against the specific obligation that actually applies, not a generic assumption.
This runs on the same manual, adversary-emulated methodology behind our core Penetration Testing service, applied with EU-specific frameworks and reporting expectations in mind.
The EU-specific regulations and baseline guidance our engagements are most often scoped around.
The EU's expanded cybersecurity directive covering essential and important entities across 18 sectors. Article 21 names penetration testing among the risk-management measures expected, without mandating a specific cadence.
European Commission, NIS2The Digital Operational Resilience Act, applying to EU financial entities. Creates a general ICT testing obligation for everyone in scope, and a separate, narrower threat-led penetration testing (TLPT) regime under Articles 26–27 for regulator-designated entities only.
EIOPA, DORA overviewArticle 32's requirement for 'appropriate technical and organisational measures' to protect personal data, a penetration test is one of the concrete, evidenced ways to demonstrate this in practice.
GDPR.euThe EU Agency for Cybersecurity publishes baseline security guidance that underpins much of NIS2's technical expectations, including risk-management and incident-handling practices.
ENISAArticle 21, evidenced
A supply-chain risk gap, an untested critical function, and a broken incident-reporting clock , the concrete evidence Article 21 and DORA both expect.
Checking against Article 21(2)'s ten risk-management measures
21(2)(d), Supply chain security: 0 third-party ICT vendors risk-assessed
A named requirement, not optional guidance, essential/important entities must cover this.
An illustrative walkthrough of how an engagement actually runs, not footage from a real client environment.
Yes, we regularly scope penetration testing and broader risk-management assessments against NIS2 Article 21's ten measures for essential and important entities across the EU.
Not by default. DORA creates two separate testing obligations, general ICT testing, which most financial entities need and which we regularly deliver, and threat-led penetration testing (TLPT) under Articles 26–27, a narrower program reserved for entities your national competent authority specifically designates. We can help clarify which applies to you.
We work with clients across the EU and wider EMEA region, engagements are remote-capable, with on-site work scoped where genuinely needed, regardless of specific member state.
Yes, a penetration test is one of the concrete ways to demonstrate GDPR's Article 32 requirement for 'appropriate technical and organisational measures,' though we recommend pairing with your own DPO or legal counsel for full compliance sign-off.
Talk to us about scoping an engagement against the specific obligation that applies to your organization.
