An audit report from the Flemish government shows that local authorities still have some work to do on cybersecurity. Six in ten, for example, have no continuity plan.
Audit Vlaanderen, the audit agency within the Flemish government, tested the cybersecurity of some seventy Flemish municipalities between 2023 and 2025. In that period, 77 local authorities and twelve intermunicipal associations had an ICT security audit carried out with co-financing. The basic audit consisted of internal and external penetration tests, a check for weak passwords and a review of the business continuity plan.
Not a single municipality gets a perfect score in this report. The internal tests on 15,725 systems uncovered 1,583 vulnerabilities, 332 of them high-risk. That averages out at 4.7 high-risk vulnerabilities per local authority.
Vulnerabilities and weak passwords
The external tests on 154 internet-facing systems turned up 316 vulnerabilities, 21 of them high-risk. None of the twelve intermunicipal associations came out clean either. Authorities that had a retest carried out after making changes saw their vulnerabilities fall significantly.
In the check for weak passwords, once again no authority was completely flawless. On average, 30 percent of passwords were weak, with a peak of 81 percent. For admin accounts, the average was eighteen percent (up to 64 percent), and in 29 of the 83 audits no weak admin passwords were found. The report names multifactor authentication, limiting login attempts and monitoring suspicious login behaviour as measures that reduce the risk of account abuse.
A successful phishing attack as an entry point is one of the risks the report describes. Recent examples are not hard to find. In September, the municipality of Machelen, which did not take part in the study, was hit by a cyberattack that reportedly started with phishing. In the attack, hackers made off with personal data.
No continuity plan
Cybersecurity starts with prevention, but a plan must also be in place for when things go wrong anyway. This is another weak spot for many local authorities. 59 percent of local authorities and 67 percent of intermunicipal associations have no full ICT business continuity plan that also covers restarting the network and applications.
In addition, useful management measures are not used enough: keeping IT systems up to date, restricting access to administrator interfaces and network security, for example through network segmentation.
According to the report, without such a plan an authority cannot keep guaranteeing continuity after an incident, and recovery of data is not assured. After the cyberattack at the end of 2022, the city of Antwerp calculated that it could cost up to 70 million euros. Local authorities can learn a good deal from that cyberattack, mostly about how not to do it.
Cautious progress
Although work remains, the Flemish government does see a cautious improvement. In a reaction to De Tijd, the Association of Flemish Cities and Municipalities (VVSG) says that local authorities are catching up. The report also illustrates that municipalities that had themselves audited generally made progress during the process.
Whether that catch-up keeps pace with attackers who continue to refine their methods is another matter. The public sector remains a popular target for cybercriminals. The NIS2 legislation is meant to help turn the tide. Whether the legislation has led to effective improvement after 2 years was a topic of discussion at a recent roundtable hosted by ITdaily with experts from the Belgian security industry.