Since August 15, the Cybersecurity Act and the Critical Entities Resilience Act (Wwke) have been in effect. Nieuwsuur reported this week that security companies performing red team operations are seeing a significant increase in requests. Among the organizations cited by the program: Cocoon Risk Management.
Together, the two laws mandate approximately 8,000 Dutch organizations to seriously assess their digital and physical resilience. The 500 most essential among them, such as drinking water companies, energy companies, and digital infrastructure, are considered critical entities and must meet the highest requirements.
The Front Desk Remains the Weakest Link
What stands out in the report is not the technology. It’s how often the simplest route works. Cocoon director Tim Gerding tells Nieuwsuur that his team has all sorts of tools, from drones to copied access cards. But the most frequently used entry point is a front desk where someone is simply let in.
This aligns with what Cocoon has observed in practice for some time: technical measures say little about what happens when someone actually encounters them. A watertight access policy on paper is no proof that it will hold up during an unannounced visit.
Gerding also points out the broader context in the report. The Netherlands underestimates the threat, he states, while the geopolitical situation has become less predictable than a few years ago. This assessment is precisely why the legislator is now codifying what was previously optional.
Why This Is More Than a Compliance Obligation
The Cybersecurity Act implements the European NIS2 Directive, and the Wwke implements the CER Directive. Both focus on resilience, not only for digital systems but also for the physical side: buildings, access, people. Organizations falling under these laws have a duty of care and a reporting obligation. For essential institutions, fines for non-compliance can amount to 10 million euros or 2 percent of global annual revenue.
The law does not stipulate that every organization is obliged to hire a red team. However, organizations must identify their own risks and take appropriate measures, including risks arising through suppliers and supply chain partners. Precisely this supply chain aspect is mentioned in the Nieuwsuur report as being underexposed: an organization may have its own security in order and still be vulnerable through a caterer or supplier with a smaller security budget.
For executives, this means a shift. Where resilience was previously a matter of good practice, it is now a demonstrable responsibility. And demonstrable is the key word: not what is on paper, but what proves true when someone actually tests it.
What This Means in Practice
A compliance checklist does not answer whether an access policy will hold up during an unannounced visit. This is precisely where physical validation plays a role, alongside the more familiar digital aspects of NIS2 and Wwke:
- A physical penetration test assesses access security, procedures, and employee behavior in practice.
- A red teaming engagement simulates a realistic attack across multiple vectors simultaneously, both physical and digital.
- A social engineering assessment reveals how employees react to a convincing story at the front desk.
Source: NOS/Nieuwsuur, “Breaking In for a Fee Popular Due to New Security Laws”, August 15, 2026. Additional context: Dutch Government, news item on the entry into force.