The verdict in three sentences
A client extranet exposes your commercial data, contracts and often personal data: a penetration test before opening it is now standard for cyber insurers, large buyers and NIS2 risk management. In Brussels, budget roughly 6,000 to 20,000 EUR for 5 to 12 audit days, as Belgian rates run slightly above French ones. The real budget also covers remediation (2 to 4 weeks) and a retest, both often left out of the initial line item.
NIS2 in Belgium: why the extranet matters
Belgium transposed NIS2 through the law of 26 April 2024, in force since 18 October 2024, with the Centre for Cybersecurity Belgium (CCB) as supervisor. Essential and important entities must manage risks to their network and information systems, and the CCB's CyberFundamentals framework is the recommended route to show compliance. Fines can reach 10 million EUR or 2% of worldwide turnover for essential entities, and 7 million EUR or 1.4% for important ones. A tested extranet, with a documented report and fixes, is concrete evidence for an audit.
Which scope to test, and at what price
| Scope | Typical content | Audit days | Indicative 2026 price (market estimate) |
|---|---|---|---|
| Simple extranet | Document viewing, 2 roles | 5 days | 6,000 to 8,000 EUR |
| Standard extranet | Orders, file upload, 3 to 4 roles | 7 to 8 days | 8,000 to 11,500 EUR |
| Extranet + exposed API | Mobile app or connected partners | 9 to 10 days | 11,500 to 15,000 EUR |
| Extranet + infrastructure | Servers, VPN, directory | 10 to 12 days | 14,000 to 20,000 EUR |
| CyberFundamentals-aligned report | Mapping of findings to CyFun controls | +1 day | 1,000 to 1,500 EUR |
| Retest | Verification of fixes | 1 to 2 days | 1,200 to 2,500 EUR |
Two approaches coexist. Black box starts with no account, like an outside attacker: realistic but weak on an extranet, where most of the surface sits behind login. Grey box provides one account per role and tests privilege escalation: this is the mode to choose for a client portal.
The methodology to require in the quote
The baseline remains the OWASP Top 10 (2021 edition, with the 2025 update being adopted) plus OWASP ASVS for detailed controls.
| OWASP category | What the auditor looks for on an extranet | Observed frequency (estimate) |
|---|---|---|
| Broken access control | Client A reading client B's invoices by changing an ID | Very frequent |
| Cryptographic failures | Poorly hashed passwords, weak TLS | Frequent |
| Injection | SQL, commands, search fields | Medium |
| Security misconfiguration | Missing security headers, verbose error pages | Very frequent |
| Vulnerable components | Outdated JavaScript libraries or framework | Frequent |
| Weak authentication | No rate limiting, no MFA | Frequent |
| Insufficient logging | No trace of suspicious logins | Frequent |
Require in the report: an executive summary, a CVSS score per flaw, reproducible proof of exploitation and prioritised remediation advice.
A realistic timeline before go-live
| Step | Duration | Owner |
|---|---|---|
| Scoping, audit agreement, test accounts | 1 to 2 weeks | IT + provider |
| Audit | 5 to 12 working days | Provider |
| Debrief and report | 3 to 5 days | Provider |
| Fixing critical and high flaws | 2 to 4 weeks | Development team |
| Retest | 1 to 2 days | Provider |
| Total | 6 to 10 weeks |
If you no longer have a team on the application, Kolonell's Standard maintenance (75,000 FCFA, about 110 EUR per month) or Premium (120,000 FCFA, about 180 EUR per month) covers dependency updates; fixing structural flaws is quoted separately.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Liesbeth, CIO of a 300-employee freight forwarder in Brussels classed as an important entity under NIS2, must open a shipment-tracking extranet to 150 clients. She picks an extranet + API scope of 9 days at 1,400 EUR per day, 12,600 EUR, plus a CyFun-aligned report at 1,200 EUR and a retest at 1,800 EUR. The audit finds 2 critical access-control flaws and 6 medium ones, fixed in 12 development days at 650 EUR, 7,800 EUR. Total budget: 23,400 EUR. Against a maximum NIS2 fine of 7 million EUR and an insurer demanding audit evidence to keep her deductible at 25,000 EUR, the test is a defensible line in her annual risk plan.
FAQ
Is an automated vulnerability scan enough for NIS2?
No. A scanner at 100 to 300 EUR per month finds outdated components and misconfigurations, but almost always misses cross-client access-control flaws, the number one OWASP category and the most critical one on an extranet.
Does Belgium require a certified pentest provider?
There is no Belgian equivalent of the French PASSI label that is mandatory for all entities. Check that the provider has OSCP or CREST-certified testers and experience with CyberFundamentals, which usually adds 1 day of reporting.
How often should the test be repeated?
Once a year, and after every major change such as a new API or role. A targeted yearly retest of 3 to 4 days costs about 4,500 to 6,000 EUR in Brussels.
Can testing be done in production?
Yes, with a precise audit agreement and agreed time windows, but an identical staging environment is safer. Allow 1 to 2 days to prepare it if it does not exist.
Do we need to report the flaws found to the CCB?
No, a vulnerability found during a test is not an incident. You must notify significant incidents within 24 hours, which is precisely what fixing flaws before go-live helps avoid.
Let's scope your project. Tell us about your extranet (roles, APIs, data) and your launch date: we price the audit scope, the fixes and the full timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
