Daniel Bermejo · Co-founder & Technology Lead, Trusty · Serial founder, ex PwC, IBM and Roche · Former Managing Director, Startup Invest
Cybersecurity is no longer just an IT concern. With the NIS2 Requirements of Directive (EU) 2022/2555, it has become a matter of governance, risk management, and regulatory compliance.
While the directive primarily targets medium and large organisations in critical sectors, its impact is broader. Many SMEs are affected indirectly through supply chains, service relationships, or contractual obligations. Others may fall directly in scope depending on their size and sector
In 2026, the question for growing companies is not whether NIS2 matters. It is how to approach it in a way that is proportionate and workable.
NIS2 requirements in practice
At a high level, NIS2 requires organisations to implement measures that allow them to:
- manage cybersecurity risks
- detect and respond to incidents
- report significant events
- assess risks within their supply chain
In practice, this shifts cybersecurity from a reactive function to a structured and auditable process.
One aspect that is often overlooked is how organisations receive early signals of risk. Not all incidents begin as system failures or attacks. Many start as identified vulnerabilities reported by someone outside the organisation.
What is vulnerability reporting
Vulnerability reporting is the process of allowing individuals to report potential security weaknesses in a structured and secure way.
These reports may come from:
- independent security researchers
- technology partners or vendors
- employees or internal stakeholders
In many cases, these individuals identify issues before they are exploited. A clear reporting channel allows organisations to address problems early, reducing both operational and regulatory risk.
From a compliance perspective, vulnerability reporting supports:
- early detection of security issues
- faster incident response
- documented evidence of risk management processes
The practical gap for growing companies
Most SMEs do not lack awareness of cybersecurity risks. The challenge is implementation.
In many cases, vulnerability reports are handled through:
- general email inboxes
- website contact forms
- informal communication channels
This creates several issues:
- reports can be missed or delayed
- communication is not structured
- there is no clear workflow for handling the issue
- no audit trail exists to demonstrate what was done
According to NIS2 requirements, organisations are expected to demonstrate that they can identify, assess, and respond to risks in a structured way. Informal processes make this difficult.
A simple and structured approach
For growing companies, the objective is not to build complex systems. It is to create a process that is clear, consistent, and easy to manage.
A practical approach includes four elements.
First, provide a clear reporting channel. There should be a defined entry point where vulnerabilities can be reported. This reduces ambiguity and ensures that reports reach the right place.
Second, ensure secure and confidential communication. Individuals reporting vulnerabilities need to trust that their information will be handled appropriately.
Third, establish a basic workflow. This does not need to be complex, but it should cover receiving the report, assessing its relevance, responding where necessary, and documenting the outcome.
Finally, maintain a record. Being able to show when a report was received, how it was handled, and what actions were taken is increasingly important from both a governance and compliance perspective.
Using whistleblowing systems for NIS2 reporting
There is a strong overlap between vulnerability reporting and whistleblowing.
Both require:
- confidential communication
- structured intake processes
- traceable workflows
- clear documentation
Because of this, many organisations are extending existing whistleblowing systems to handle cybersecurity-related reports as well.
This approach avoids fragmentation and allows SMEs to manage different types of risk reporting within a single, consistent framework.
A practical implementation approach
Platforms such as Trusty enable organisations to implement vulnerability reporting without building new infrastructure from scratch.
By integrating a dedicated channel for cybersecurity vulnerabilities into an existing whistleblowing system, organisations can:
- receive reports from external researchers, partners, or employees
- manage communication in a secure and confidential environment
- track each case through a structured workflow
- maintain a clear, timestamped record of actions taken
This turns vulnerability reporting from an informal activity into a documented and auditable process, aligned with the expectations introduced by NIS2.
For growing companies, the key advantage is simplicity. Instead of adding another tool or process, vulnerability reporting becomes part of an existing compliance setup.
Vulnerability reporting is one of the simplest ways to strengthen that process, yet it is often overlooked.
Conclusion
The NIS2 requirements introduce a shift in how cybersecurity is managed. It is no longer enough to react to incidents. Organisations need to show that they have systems in place to identify and handle risks proactively.
For growing companies, this can be achieved without unnecessary complexity.
A clear reporting channel, a simple workflow, and consistent documentation are often sufficient to meet expectations and improve resilience at the same time.
Related reading: which third parties you need to monitor under DORA and NIS2, sanctions compliance, and Trusty whistleblowing software, which carries NIS2 vulnerability reporting on the Advanced plan.
Frequently asked questions about the NIS2 Directive
The NIS2 Directive is an EU law that requires organisations in critical sectors to implement cybersecurity risk management measures and report significant incidents.
NIS2 primarily targets medium and large organisations, but SMEs may be directly or indirectly affected depending on their sector, size, and role in supply chains.
Vulnerability reporting is a structured process that allows individuals to report security weaknesses so organisations can address them before they are exploited.
While not always explicitly mandated, having a structured reporting channel supports NIS2 requirements for risk detection, incident response, and governance.
Yes. Whistleblowing systems already provide secure, confidential, and traceable communication, making them suitable for handling vulnerability reports.
SMEs can use existing compliance tools, such as integrated whistleblowing systems, to create a simple reporting process without additional complexity or cost.
THIRD-PARTY RISK SCREENING
QuickScreen360: screen suppliers and partners for compliance risks. Send due diligence requests, assign training and monitor results in one platform.