We test like an attacker attacks and report like a RE auditor reads. This way, every vulnerability becomes evidence for your DigiD assessment. We are only satisfied when your web application is demonstrably DigiD-compliant.
DigiD penetration test
Experienced ethical hackers test the resilience of your DigiD web application. We link all findings to the standards from the DigiD Assessment Framework 3.0, ensuring your RE-auditor can directly use the report for the assessment.
Schedule a no-obligation consultationDownload Buyer’s Guide
Retest standard included·Reporting within 5 working days·According to the CCV certification mark
SOME OF OUR CLIENTS
| Characteristic | Warpnet | Other parties |
|---|---|---|
| Approach |  Customization combined with advanced AI tools |  Automatic scans, exploit attempts |
| Retest | Included, with heart report for your RE auditor | Not included or available at an additional cost |
| Methodology | NCSC guidelines, OSSTMM, PTES, and OWASP | An often superficial checklist |
| Reporting | Audit-ready and linked to the DigiD Standard Framework | Technical report without context |
| Presentation of Evidence | Screenshots, CLI output, and attack scenarios | Output from automatic scanners |
| Support | Guidance during recovery and with questions from your auditor | The process ends with the PDF report |
Certifications & methodologies
CCVOSCPOSSTMMPTESOWASPMeow
Developers of cable and asset management solutions
Right in the middle of the process toward ISO 27001 certification, Patchmanager wanted to structurally strengthen the digital resilience of both the organization's internal network and the product — with regular, in-depth pentests as the foundation.
The collaboration began with three black-box penetration tests and, as trust grew, expanded to include gray-box and white-box testing. During the white-box test, Warpnet was granted full access to the architecture, source code, and accounts to identify risks.
Each test delivered a clear, risk-based report that allowed Patchmanager to get to work immediately. The collaboration evolved into 24/7 SOC services featuring continuous monitoring, response, and the complete remediation of risks and incidents.
“We are very happy with the collaboration with Warpnet. The team has in-depth expertise and truly looks at how they can help us. They communicate well, are flexible, and always do more than they are supposed to do.”
Jerry SeagerCertifications & Accreditations
Frequently Asked Questions
Yes. After your team has implemented the recommendations, we can perform a retest upon request to confirm that the vulnerabilities have indeed been resolved. With the retest report, you can show your RE auditor that the findings were resolved within the testing period.
The DigiD Standard Framework 3.0 consists of 21 standards from the NCSC ICT security guidelines for web applications. A pentest primarily provides evidence for the technical standards: input and output validation and cryptography in the web application (U/WA.03 through U/WA.05), configuration and hardening of the web server and platform (U/PW.02, U/PW.03, U/PW.05, and U/PW.07), network zoning and hardening (U/NW.03, U/NW.05, and U/NW.06), and patch management (C.09). In addition, the pentest itself demonstrates that you comply with standard C.04.
After a no-obligation intake you will receive a quote, and that is the price you pay. The price depends on the number of DigiD connections and the size of the web application and infrastructure. Reporting, explanation and retesting are included as standard. Below you will find general price indications for a one-off pentest and Pentesting as a Service (continuous pentesting).
One-time pentest: v.a. €3,200
Pentesting as a Service: approx. €1,250 per month
You must submit the assessment report for the previous year to Logius between January 1st and May 1st. Therefore, the pentest must have been performed, and the most important findings resolved, before your RE auditor gives their opinion. For a new connection, a term of two months after activation applies. Spring is a busy period for auditors and pentesters. Therefore, it is preferable to schedule the pentest in the autumn, so that time remains for remediation and retesting.
The DigiD ICT security assessment is an audit by a Registered EDP Auditor (RE) on all 21 standards: in design, in existence, and for five standards in operation. The DigiD pentest is part of this. Our ethical hackers test the technical standards in practice and provide the evidence upon which the auditor bases their judgment. Warpnet performs the pentest, while the audit itself is conducted by your RE auditor. We collaborate with the auditor of your choice in the process.
As a service organization, you provide your customers with a service organization assessment report (SOAR, formerly TPM) regarding the measures for which you are responsible. The pentest on your application and infrastructure serves as the technical evidence for this. If you provide a standardized SaaS solution to multiple connected parties, a multi-client assessment may suffice. We align the scope with your situation so that your customers can submit their reporting to Logius on time.
