Has your customer's security questionnaire already arrived? By 31 October 2026 the answer must also be in the software

Application penetration testing of the system you use and the system you sell, fixes made in the code, checks that stay in CI. For SMEs in the NIS2 perimeter and for their suppliers.

Do you recognise at least two of these?

A large customer sent you a security questionnaire with questions about software, and you answered "in progress".
Your NIS2 consultant did the register, the contact person and the procedures, but wrote "check with the vendor" next to the management system.
The system you use (or sell) was written years ago, and nobody knows whether one user can see another user's data.
PHP or Laravel are on a version that no longer receives security updates.
Nobody has ever tried to attack the software before a customer, or an unhappy employee, does.

If you said yes at least twice you are in the most common situation: the organisational side of NIS2 is covered, the side inside the software is not. And the audit looks at both.

What finding out later costs

The EU NIS2 directive (2022/2555), transposed in Italy by Legislative Decree 138/2024, requires companies in essential and important sectors (energy, transport, health, water, waste, manufacturing of devices and machinery, digital services) to adopt minimum security measures by 31 October 2026 (ACN determination 379907/2025). Many SMEs fall in as suppliers: if a customer sends you a questionnaire, it has already started.

A broken access control vulnerability (one user seeing or changing others' data) is the most common in management systems and the most serious: customer and employee data exposed, regulator notification, customer lost.
A supplier questionnaire with vague answers weighs on the next order, even if nobody tells you.
If you sell the software, from 2027 the Cyber Resilience Act adds security-by-design and update obligations.

What if you filled in the next questionnaire with a report in hand?

Imagine answering with one page: what was verified in the system, when, with which method, with what outcome, and what was fixed. It is what your NIS2 consultant wants to attach, and what your large customer wants to read.

An OWASP application penetration test looks exactly where management-system problems live:

Authorisation: can a user see or change other users' data?
Input: SQL injection, XSS, file upload, manipulated parameters.
Sessions and authentication: passwords, tokens, reset, sessions that never expire.
Dependencies: libraries with known vulnerabilities, unsupported PHP and Laravel versions.
Configuration: debug on in production, secrets in the repository, exposed backups.

What will your client ask about the software, and what proof answers it?

A client subject to NIS2 has to show it has checked its suppliers, so the questions land on whoever writes the software. There are usually seven, and each needs a piece of proof that does not take long to prepare:

What is the software made of? The list of dependencies with versions and a dated composer audit and npm audit result.
Who can see what? The role-permission matrix and an automated test for every row that attempts the forbidden action and expects a refusal.
Can you rebuild who did what? A log of actions on sensitive data (who, what, when, from where), kept outside the application server.
How and how fast do updates arrive? A one-page written procedure, with the date of the last security update actually shipped.
Is the code checked before production? The continuous integration pipeline: tests, static analysis at a stated level, review by a second person.
Has anyone tried to break in? The report of the last penetration test, with scope, roles tested, vulnerabilities found and the date of each fix.
What if the supplier disappears? A contract stating who owns the code, data exportable from the panel in an open format, a copy of the source code the client can reach.

I explained them in full in an article on Red Hot Cyber, in Italian: NIS2, il cliente ti farà 7 domande sul software. The penetration test is the sixth; I prepare the other six with you, on your code.

The difference from a pentester who does not code

A test alone leaves you with a list. Here the list is closed in the code, because the person testing has built Laravel software for fourteen years and in recent years found and fixed broken access control in management systems of organisations with thousands of users, with zero regressions thanks to tests added before every change. What you receive:

Report with every vulnerability, severity, how to reproduce it and how to fix it.
Fixes in the code with automated tests that prevent regression.
Static analysis (PHPStan) and dependency checks added to your CI, so the control stays after the engagement.
One page for your NIS2 consultant: what was verified, when, with what outcome, ready for the audit.

Time, cost and the first step

An application penetration test on a web management system takes 3 to 8 days depending on its functions, at €700 to €900 per day, report included; fixes are quoted after the report, in writing. Between the request and 31 October 2026 there is less time than it seems: tests are scheduled one at a time.

The first step is free and commits you to nothing: describe your situation and I tell you in writing whether you are in the NIS2 perimeter, which software is exposed and where to start. You leave with a written list, even if someone else then runs the test.

NIS2 and software security questions

Is my SME subject to NIS2?

If you operate in an essential or important sector, or supply a company that does, yes or almost. The formal check is a consultant's job; the software side (the system you use and the one you sell) is what usually stays uncovered.

When does the NIS2 obligation start?

Basic security measures must be in place by 31 October 2026 under the Italian transposition (Legislative Decree 138/2024, in force since 16 October 2024). Other EU countries have their own transposition dates in 2025-2026.

How long does an application penetration test take?

3 to 8 days for a web management system, depending on functions and users. The report arrives at the end of the test; fixes are quoted afterwards.

How much does an application penetration test cost for an SME?

€700 to €900 per day, report included, for 3-8 days. The first written analysis is free and tells you whether you are in the perimeter and where to start.

What is the difference between an application pentest and an antivirus or firewall?

The antivirus looks at PCs, the firewall at the network. The application pentest looks at your software's code: whether a user can see others' data, whether a module accepts dangerous input, whether libraries are up to date. That is where management-system problems live.

My company is small: do I really need application security?

If you have a management system with customer and employee data, yes. The broken access control vulnerabilities found in recent years were in software of companies with 10 to 50 people, not multinationals.

Who fixes the vulnerabilities found?

The same person who ran the test, in your code, with automated tests that stop them coming back. That is the difference from a pentester who does not code: you get a fixed system, not a list.

Does the Cyber Resilience Act apply to my management software?

If you sell a product with digital components in the EU market, from 2027 security-by-design and update obligations arrive. For a management system the path is the same as NIS2: tested code, updated dependencies, managed vulnerabilities.

What does a client subject to NIS2 ask its software supplier?

Usually seven things, each with proof: what the software is made of (dependencies and audits), who can see what (role-permission matrix with tests), who did what (action logs), how updates arrive, how code is checked before production, the last penetration test, and what happens if the supplier disappears.