Scope qualification
Sector, NAF code, employee count, and revenue compared against the directive's annexes. Written response: concerned or not, and under what category.
NIS2 Directive — Essential and Important Entities
NIS2: are you concerned?
The directive massively expands the number of companies subject to cybersecurity obligations. Many are still unaware.
- Verification of your scope: NAF code, employee count, revenue
- Gap between your current practices and the required measures
- Costed compliance plan, prioritized by risk
- Support through implementation, not just a report
Check my NIS2 scope
Enter your sector and employee count. We'll tell you if you're concerned, under what category, and by when.
150+
audited companies
SINCE 2016
72 h
first response
INCIDENT RESPONSE
1 247
vulnerabilities reported
ALL AUDITS
Included
re-test after correction
ALL OFFERS
Why now
NIS2 no longer concerns only critical operators
The first directive targeted a few hundred entities. The second targets thousands.
- The scope is determined by your business sector and size — not by individual designation. Many companies are concerned without knowing it.
- Two categories: essential entities and important entities. Obligations and oversight differ.
- Obligations cover risk management, incident notification, and supply chain security.
- Management is held responsible: they are accountable for non-compliance.
We are not a legal firm: our work focuses on technical and organizational measures, not on legal interpretation.
Process
From scope to action plan
We start with the only question that matters: are you in scope, and under what category.
Current State Assessment
Gap between your current practices and expected measures: governance, risk management, continuity, supply chain, notification.
Prioritized Plan
What to do, in what order, at what cost. Measures that reduce risk the most, first.
Implementation
Technical support on measures within our expertise: penetration testing, hardening, logging, awareness training.
Deliverable Preview
What a professional audit looks like
Anonymized example: executive summary, consolidated score, and priorities for your IT department or integrator.
- Executive summary and risk score on one page
- Prioritized findings with concrete remediation paths
- Internally shareable document (IT Dept, CISO, Management)
What our clients say
We don't rate ourselves.
Reviews published on our Google listing by companies that have actually been audited. Verifiable, one by one.
GOOGLE
We hired White-Hat to conduct a cybersecurity audit of all our servers, and we are very satisfied with the quality of their work. Philippe demonstrated professionalism, responsiveness, and excellent communication skills throughout the entire process. The recommendations provided were clear, relevant, and immediately actionable to strengthen our security. We highly recommend their services.
GOOGLE
Excellent experience with White-Hat for a comprehensive security audit of our SaaS platform. The quality of service was truly outstanding: Philippe took the time to understand our application's architecture before starting the tests, which made all the difference to the relevance of the results. The report was detailed, with vulnerabilities categorized by criticality, concrete evidence of exploitability, and recommendations directly applicable by our technical team. The post-delivery follow-up to verify the patches was a real bonus. Professional, rigorous, and attentive: exactly what you need to secure a SaaS product.
GOOGLE
We hired White-Hat for a comprehensive audit/advanced penetration test on our website, and it's clearly the direct contact with Philippe that makes all the difference. No salesperson between us, no unnecessary jargon: we communicate directly with someone who understands our challenges and can clearly explain the vulnerabilities found. The report was precise, with concrete evidence and recommendations that we were able to implement quickly. A truly trustworthy relationship; I highly recommend them.
GOOGLE
Professional work. Thank you.
GOOGLE
We urgently contacted White Hat following a suspected compromise of several servers. The team was extremely responsive and addressed our request within minutes, with clear communication at every stage. Their vulnerability analysis was conducted very rigorously, resulting in a detailed report and concrete, easy-to-implement recommendations to strengthen our security. The investigation of the compromised servers allowed them to quickly identify the source of the attack and contain the incident without any major disruption to our services. Professional, knowledgeable, and readily available, I highly recommend this provider for any cybersecurity intervention, especially in emergency situations.
The Human Behind the Tool
About your contact
I am a cybersecurity consultant: I assist IT teams and management with audits, penetration testing, and hardening. My background is field-oriented (SMEs, mid-sized companies, e-commerce, industry) with a simple requirement: actionable findings, not jargon.
Why this profession: making real risks visible to help make quick decisions — securing also means clarifying what matters for the business.
Expertise built since 2020 in various contexts; recognized certifications (OSCP, CISSP, OSEP) and continuous threat monitoring.
Pedagogy: translating technical details into business decisions (prioritization, budget, planning).
Frequently Asked Questions
Answers to your questions before you ask
How do I know if I'm concerned?
It depends on your industry and size. Provide us with your NAF code and employee count: the answer will be given in one exchange, and we'll send it to you in writing.
What's the difference between an essential entity and an important entity?
Both have comparable security obligations. What mainly changes is the oversight regime: ex-ante supervision for the former, ex-post control for the latter.
Is a penetration test mandatory?
The directive requires risk management and appropriate measures, without dictating a list of tools. A penetration test is the most direct way to demonstrate that you are genuinely assessing your exposure.
Are you PASSI qualified?
No. For essential entities subject to a qualified provider requirement, we will tell you frankly and will not intervene. For important entities and SMEs within the scope, the obligation is one of means.
Ready to know where you stand?
NIS2 Compliance for your business
Enter your sector and employee count. We'll tell you if you're concerned, under what category, and by when.