Eduard Meelhuysen shares practical commentary on NIS2 cybersecurity compliance, focusing on whether organizations are in scope, how to choose risk-based security measures, and how to manage supplier risks.
Most useful for concise NIS2 compliance commentary on scope, risk-based security measures, and supplier risk.
Best for
A NIS2 compliance consultancy wanting a named expert voice for outreach and co-marketing.
Not for
A security product vendor wanting a paid, performance-measured launch for technical practitioners.
Key takeaways
Assuming you are out of scope is the risk, not non-compliance.
Waiting repeats the GDPR mistake; the goal is provable readiness.
Vendors are the least structured part of NIS2 readiness.
Check first: Confirm terms, deliverables, link routing, and recent post results before contacting them.
Main ideas
Assuming you are out of scope is the risk, not non-compliance · Waiting repeats the GDPR mistake; the goal is provable readiness · Adequate security means defensible, risk-based decisions
Eduard Meelhuysen shares practical LinkedIn commentary on NIS2 cybersecurity compliance.
Four posts focus on checking whether the rules apply, preparing before enforcement, choosing security measures for an organisation’s risks, and managing supplier exposure.
They offer a clear reason to follow their work if you want concise explanations of those questions.
Meelhuysen turns compliance questions into concrete checks rather than treating NIS2 as a list of generic rules.
One post challenges companies that assume they are out of scope; another argues that security measures should reflect a company’s threats, systems and potential impact, with choices documented.
Their supplier-risk post makes the issue tangible with three questions: who can access company systems, which providers are critical, and what security standards they follow.
Across these examples, they connect regulation to decisions an organisation can examine and explain.
The posts also use direct questions and point readers to a free self-assessment, prompting a next step as well as explaining an issue.
Eduard Meelhuysen writes about NIS2 with a consistent priority: organisations should check whether the rules apply to them and be able to defend their security choices, rather than assume they are out of scope or copy what everyone else does.
Read more
The four posts move from a company's own status to enforcement risk, adequate security and the suppliers it depends on. Each opens with a belief the reader probably holds, corrects it with a short list of specifics, then ends with an audience question and a link to a free NIS2 self-assessment that Meelhuysen says was launched alongside the writing.
Assuming you are out of scope is the risk, not non-compliance
Meelhuysen's most repeated argument is that companies rarely have a compliance problem; they have an awareness problem.
Read more
The biggest exposure, in this view, is never checking whether an obligation applies. The posts explain why scope is wider than many assume, contrast it with NIS1, and urge readers to replace intuition with an actual check.
One post opens with the objection, "We're probably not affected by NIS2," which Meelhuysen calls one of the most dangerous sentences of 2026.
It lists four points: essential and important entities across sectors such as energy, healthcare, logistics, manufacturing and digital infrastructure; companies with 50 or more employees or above €10M turnover or balance sheet total; critical suppliers and service providers in the value chain; and a significantly broader reach than NIS1.
It closes by asking whether readers have checked their status or are still going on gut feeling.
Waiting repeats the GDPR mistake; the goal is provable readiness
Meelhuysen argues that the dismissals now heard about NIS2 echo those heard about GDPR—and did not hold then.
Read more
The point, they say, is not the fine but being operationally ready when something happens and able to prove that readiness. The instinct to deal with it when it becomes relevant, they warn, arrives too late.
The post sets a prediction of €10 million fines against the GDPR experience and lists what it says is new under NIS2: fines up to €10 million or 2% of global annual turnover, broader sector coverage than NIS1, coverage of companies with 50+ employees or €10M+ turnover, and indirect exposure for suppliers and service providers.
It asks whether readers are preparing or observing.
The post uses the penalty ceiling as a wake-up call while arguing that the fine is not the real issue.
Ask for a named enforcement decision to support the €10 million figure.
Adequate security means defensible, risk-based decisions
Meelhuysen argues that NIS2 does not ask companies to follow generic standards.
Read more
It asks for measures appropriate to a specific risk exposure, which means two companies in the same industry can face different requirements. The practical demand pressed hardest is documentation: an organisation must be able to justify why its chosen measures are sufficient, and "we follow industry standards" is characterised as a shortcut rather than a strategy.
The post starts with the sentence "We've implemented security measures in line with industry standards" and argues that it fails the directive.
It replaces the phrase with three criteria readers can apply: their threat landscape, their systems and their potential impact.
It asks readers how they define adequate security in their own organisation.
Vendors are the least structured part of NIS2 readiness
Meelhuysen extends the scope argument to vendors, which may represent a company's largest NIS2 exposure because responsibility does not stop at its own infrastructure.
Read more
The obligations described cover supply chain and supplier security risks, including direct service providers and critical partners; an incident at a third party can become the buyer's own reportable incident. The post frames the uncomfortable issue as questions most organisations cannot answer.
The post makes four points: companies must address supply chain and supplier security risks; this covers direct service providers and critical partners; incidents at third parties can become the company's own reportable incidents; and these risks must be assessed and managed, not assumed handled. It then names three unknowns—who has access to their systems, which providers are critical, and what security standards those providers follow—and prompts readers to check their NIS2 exposure.
This extends the scope argument: the first post asks whether the company itself is in scope; this one asks whether its suppliers bring it in indirectly.
Answers the first question most organisations ask about NIS2 — whether it applies to them — and shows the argument style Eduard Meelhuysen returns to across the other posts.
Read more
Start here to see how they handle an objection rather than a topic.
The post opens with the objection — “We're probably not affected by NIS2” — and calls it one of the most dangerous sentences of 2026.
It lists the scope rules in four short points: essential and important entities across sectors such as energy, healthcare, logistics, manufacturing and digital infrastructure; companies with 50 or more employees or above €10M turnover or balance sheet total; critical suppliers and service providers in the value chain; and a broader reach than NIS1.
It then reframes the issue: most companies have an awareness problem, not a compliance problem, and the biggest risk is assuming they are out of scope.
It closes with a direct question and a link to a free self-assessment.
For brands planning a campaign
A compliance consultancy could build a joint outreach hook around this reframe: open a co-branded NIS2 readiness session or checklist with the scope question, using the “in scope or gut feeling?” prompt as the call to action. The post’s free self-assessment offers a natural point of comparison with a consultancy’s own entry offer.
Shows how Eduard Meelhuysen argues about enforcement risk and why acting early matters — the practical follow-up once a reader accepts that NIS2 may apply to them.
Read more
The post sets a prediction about €10 million fines against the GDPR experience: the same dismissals (“we're too small”, “this won't be enforced”) were heard then and did not hold.
It outlines what it says is new under NIS2 — fines up to €10 million or 2% of global annual turnover, broader sector scope than NIS1, coverage of companies with 50+ employees or €10M+ turnover, and indirect exposure for suppliers and service providers.
Its core claim is that the delay instinct — deal with it when it becomes relevant — arrives too late.
The priority, it argues, is operational readiness plus evidence, not the fine itself.
It ends by asking whether the reader is preparing or observing.
For brands planning a campaign
Useful for a consultancy pitching preparation ahead of enforcement rather than fear of penalties. The GDPR-versus-NIS2 structure translates cleanly into a webinar or briefing segment, while the closing question offers a low-pressure way to segment prospects into those already preparing and those still watching.
Tackles the question that follows scope and enforcement: how an organisation decides whether its security measures are good enough.
Read more
Of the four posts, it offers the most concrete treatment of decision-making rather than obligations.
The post starts with a familiar phrase — implementing measures “in line with industry standards” — and calls it a shortcut rather than a strategy.
It argues that NIS2 asks for measures appropriate to a specific risk exposure, shaped by the organisation's threat landscape, systems and potential impact; two companies in the same industry may face different requirements.
The post focuses on documentation: an organisation must be able to justify why its measures are sufficient.
It closes by asking readers how they define adequate security in their own organisation.
For brands planning a campaign
A strong entry point for a consultancy selling risk assessment or assurance work: the post focuses on the gap between making choices and being able to defend and document them, rather than on the regulation. A joint asset could turn the closing question into a short self-review template or workshop exercise leading into a paid adequacy assessment.
Extends the scope question beyond the organisation to its suppliers — where many readers discover they are in scope indirectly.
Read more
Read it after the scope post.
The post argues that a company's biggest NIS2 risk may sit with its vendors, because responsibility extends beyond its own infrastructure.
It makes four points: companies must address supply chain and supplier security risks; this covers direct service providers and critical partners; incidents at third parties can become the company's own reportable incidents; and these risks must be assessed and managed rather than assumed handled.
It frames the uncomfortable part as three unknowns most companies cannot answer — who has access to their systems, which providers are critical, and what security standards those providers follow.
It ends with a prompt to check NIS2 exposure and a link to a free assessment.
For brands planning a campaign
The three unknowns could anchor a consultancy questionnaire delivered as an audit or supplier-mapping service, or a co-produced self-check guide. The vendor angle also reaches beyond the reader's own compliance team to procurement and third-party risk owners.
A repeatable format: misconception, take, question, self-assessment4
NIS2 scope: challenging “we’re probably not affected”2
Enforcement risk and the GDPR precedent1
Risk-based “adequate security” you can defend1
Supply chain and third-party risk1
NIS2 scope: challenging “we’re probably not affected”
Eduard Meelhuysen’s most repeated argument is that the biggest NIS2 risk is a company assuming it is out of scope.
Read more
They list the categories that typically bring organisations in — essential and important entities across energy, healthcare, logistics, manufacturing and digital infrastructure, a size test of 50+ employees or €10M+ turnover, and the extension to critical suppliers and service providers — and contrast this wider reach with NIS1. They identify the underlying problem as awareness rather than compliance, and ask readers whether they have checked their status or are still going on gut feeling.
Meelhuysen opens with the objection in the reader’s own words, answers it with a short bulleted list of scope criteria, then closes with a direct question and a link to a free scope self-assessment.
For brands planning a campaign
This is a natural top-of-funnel topic for a compliance consultancy: a scope-check webinar, checklist or self-assessment is an obvious asset to build alongside it. The direct question at the end also gives outreach a ready reply hook: brands can answer with a specific offer rather than a generic pitch.
Meelhuysen argues that resistance to NIS2 echoes reactions to GDPR — “we’re too small”, “we’re not relevant”, “this won’t be enforced” — and that the same pattern is appearing again.
Read more
They set out the penalty ceiling of up to €10 million or 2% of global annual turnover, the broader sector coverage than NIS1, and how supplier and service-provider relationships can bring a company indirectly into scope. The conclusion shifts the focus from fines to being operationally ready — and able to prove it — when something happens.
Draws an explicit historical analogy to GDPR and structures the argument as a list of common objections followed by what is new under NIS2.
The €10 million figure is presented as a future development, not tied to a named enforcement decision or date. Source the penalty provisions separately for campaign material.
For brands planning a campaign
Useful for content that moves an audience from “not yet relevant” to preparation, such as a readiness briefing or maturity check. The GDPR comparison is a strong, familiar framing for business audiences with no security background, and supports messaging about evidence and documentation rather than fines alone.
Meelhuysen challenges the common claim, “we’ve implemented security measures in line with industry standards,” arguing that it fails NIS2.
Read more
In their reading, the directive calls not for generic standards but for measures suited to a company’s own threat landscape, systems and potential impact.
Two firms in the same sector can therefore face different requirements.
They stress the need to justify and document why the chosen measures are sufficient; “we follow industry standards” is a shortcut, not a strategy.
Takes a widely used compliance phrase, explains why it is risky, and replaces it with three criteria readers can apply to their own organisations.
For brands planning a campaign
This is the strongest fit for services built on risk assessment, gap analysis or documentation of decisions, and gives a consultancy a way to differentiate itself from checkbox compliance vendors. The closing question — how does your organisation define adequate security — leads naturally into a diagnostic conversation or assessment offer.
Meelhuysen argues that a company’s largest NIS2 exposure may lie with its vendors, not its own infrastructure.
Read more
In their account, obligations cover supply-chain and supplier security risks, including direct service providers and critical partners; an incident at a third party can become reportable for the buyer.
The questions organisations often cannot answer are who has access to their systems, which providers are critical, and what security standards those providers follow.
They call supply-chain risk one of the least structured areas in organisations, despite its clear regulation.
For brands planning a campaign
Targets procurement, vendor-management and security teams rather than a general audience.
Vendor inventory mapping, third-party assessment questionnaires and supply-chain workshops are natural offers.
Because the audience is often the supplier side of the relationship, the topic also suits partner-facing co-marketing where both parties need to demonstrate their security posture to each other.
A repeatable format: misconception, take, question, self-assessment
The posts follow a consistent structure: a quoted misconception, a short bulleted “what matters” section, a personal take in one or two lines, then a question to the audience and a link to a free NIS2 self-assessment that Meelhuysen says they launched.
Read more
They are short, aimed at general business readers rather than technical security specialists, and reuse the same hashtag set and phrasing patterns.
Objection-led explainer: name the belief the reader probably holds, correct it with a compact list, then offer a low-friction next step.
The available examples are short-form LinkedIn posts; ask for samples of long-form articles, videos or transcripts before planning across formats.
For brands planning a campaign
Partners can use a repeatable, low-effort content pattern and co-brand it directly.
The misconception-plus-question structure adapts easily to joint posts, while the self-assessment link serves as a recurring conversion device.
The closing audience question makes replies easy to route into a lead conversation, which matters for co-marketing that needs to show pipeline rather than reach.
Eduard Meelhuysen's LinkedIn posts promote Pently's free NIS2 self-assessment.
Read more
They say 'we just launched' the assessment and call it 'our free assessment'; several posts carry the Pently hashtag.
The posts disclose a partnership without stating its structure.
Ask what commercial arrangement underpins it.
Pently
Disclosed partnership
Meelhuysen promotes Pently's free NIS2 self-assessment in multiple posts.
Read more
They write that 'we just launched' the assessment and call it 'our free assessment'; the posts also carry the Pently hashtag and links to the assessment. Ask what commercial arrangement underpins the promotion.
Eduard Meelhuysen writes about NIS2, the EU cybersecurity directive, mainly through short LinkedIn explainers for business and security leaders rather than technical specialists.
Read more
Recurring subjects include whether an organisation is in scope, enforcement risk, how to define defensible "adequate security", and how supplier and third-party exposure can bring a company into obligations it did not plan for.
The posts build on one another: start with the scope argument, then read about defensible, risk-based measures and vendor exposure, which extend the reasoning from a company's own infrastructure to its suppliers.
The pattern is consistent: name a likely belief, correct it with a short list of specifics, add a personal take, then close with a question for the audience and a link to a free NIS2 self-assessment.
The creators listed below cover adjacent topics — security risk and prioritisation, executive-level security strategy, and device and hybrid-work security — with a different focus from NIS2 scope and obligations.
Writes short LinkedIn posts on cybersecurity and risk management for teams deciding what to prioritise.
Read more
The two posts ask how AI can help security and risk teams make sense of vulnerability, incident, third-party risk and compliance data, and argue that the biggest risk in security projects is misalignment: agreeing on a solution before agreeing on the problem. That question-first framing and focus on risk decisions rather than tooling are close to Meelhuysen's approach.
The centre of gravity is different.
Fatemian's posts cover how security and risk teams adopt AI and work within the ServiceNow ecosystem, as well as project clarity in enterprise security programmes.
Meelhuysen focuses on one regulation: NIS2 scope, size and sector tests, penalty exposure, and supplier obligations.
Readers seeking regulatory scope and evidence of readiness should turn to them; those interested in how security teams use AI and run risk projects should read Fatemian.
Both write for an executive audience about cybersecurity risk and what security leaders should act on.
Read more
The two posts address CISOs directly: one explains why quantum computing and "harvest now, decrypt later" belong on a CISO's agenda, and why boards and executive leadership need to hold the long-term roadmap when CISO tenures are short; the other lists current CISO priorities, including showing business value, adapting to AI, data security and privacy, security culture, and keeping up with regulation. Both connect security topics to business and board decisions in short-form posts.
Roberts writes about emerging technology and executive strategy — quantum readiness, CISO–board continuity, and the CISO's own priority list.
Meelhuysen works through one directive clause by clause: who is in scope and why, what counts as adequate, and where vendor exposure creates reportable incidents.
Roberts' posts link to a longer article rather than a self-assessment, so the practical asks differ.
Both treat security as a business and governance question rather than a purely technical one, and write for business leaders rather than specialists.
Read more
Bisagno's two posts argue that BYOD is a governance initiative balancing productivity, security, compliance and employee experience, and that cybersecurity is now a business resilience issue, with device trust validating both identity and device posture. Both writers close a post by pointing readers to a published article that continues the argument.
The subject matter is distinct.
Bisagno covers device trust, BYOD policy, Zero Trust foundations and hybrid-work risk, while addressing business resilience and compliance in general.
Meelhuysen covers EU regulatory scope, penalty exposure and supply-chain obligations, and offers a scope self-assessment rather than an endpoint-security article.
Follow Bisagno for device and hybrid-work security, and Meelhuysen for NIS2 scope and readiness.
The only measured audience figure available for Eduard Meelhuysen is a LinkedIn following of 4,458 people, recorded on 11 October 2026.
Read more
The four posts reviewed, published 19 March to 14 April 2026, all argue NIS2 compliance points — who is in scope, what counts as adequate security, and how supplier risk becomes the reader's own reportable incident.
The content is written for people making compliance decisions inside companies, not for a general audience.
No country, age, gender, employer, or job-seniority breakdown was provided, so audience composition by industry or role is unknown.
Before treating this following as a campaign audience, ask for recent post-level results on comparable NIS2 topics — reach, comments, and who is commenting (company type and role, where visible) — and, if available, a follower breakdown by country and job function or an audience survey.
Those answers would help you judge whether the audience matches a compliance consultancy's target buyers.
LinkedIn followers
4,458
LinkedIn account profile data for Eduard Meelhuysen · 2026-10-11
The posts here do not contain a documented partnership offer.
Read more
Eduard Meelhuysen's four available LinkedIn posts are NIS2 commentary, and each one closes with a call to action pointing readers to a free NIS2 scope self-assessment rather than to a sponsorship page, media kit, rate card, or contact route for brands.
One recurring branded hashtag, Pently, appears alongside the links, but a hashtag alone does not establish a paid or formal partnership arrangement, and neither the posts nor any page here describes formats, deliverables, pricing, or terms.
The practical consequence for a buyer is that there is no published menu to plan against: any collaboration would have to be scoped directly and confirmed with Meelhuysen before it is presented as available.
One operational detail does affect planning.
The self-assessment link is a repeated, first-party call to action tied to NIS2 scope, so a partner would be sharing attention with an existing prompt rather than inheriting an open or neutral slot, and any co-marketing would need to agree in advance on which link, tool, or landing page the audience is sent to.
No official partnership or inquiry route is published here, so no inquiry link is published in this section.
Whether Meelhuysen accepts sponsored work at all is not established either way by the posts here; the absence of a documented offer does not mean sponsorship is refused.
Good fit. The subject matter aligns closely with what this kind of consultancy sells, and the format supports outreach. One commercial item must be settled first: there is no published partnership offer, so terms, deliverables and link routing must be agreed directly rather than selected from a rate card.
Read more
Brief
A NIS2 compliance consultancy wants a named expert voice for outreach and co-marketing aimed at compliance, risk and procurement decision-makers inside mid-sized European organisations. Deliverables are light: joint social posts, a short readiness briefing, and a lead-in to paid diagnostic conversations.
Reasons
The four LinkedIn posts cover the three questions a compliance consultancy is paid to answer.
The first takes the statement "we're probably not affected by NIS2" and walks through who is in scope — essential and important entities, the 50-employee or €10M test, and critical suppliers and service providers.
The second draws on the GDPR experience to frame enforcement, arguing that the real issue is being ready and able to prove it.
The third challenges "we've implemented security measures in line with industry standards" and replaces it with risk-specific measures an organisation can justify and document.
The fourth shifts the risk outside the company to vendors, listing three questions most organisations cannot answer: who has access to their systems, which providers are critical, and what standards those providers follow.
These are buying triggers, not general commentary.
Each post closes with a direct question — such as whether readers have checked their status or are going on gut feeling — giving outreach a natural reply hook instead of a cold pitch.
The writing also suits business decision-makers without a security background, particularly in its GDPR parallel, matching the consultancy’s target reader.
The LinkedIn following recorded on 11 October 2026 is 4,458, but there is no reach, engagement or follower-composition data.
Ask for those figures before treating this as a volume play.
One operational caution: every post points readers to a free NIS2 scope self-assessment, so a partner would share attention with an existing prompt.
Agree in advance whose link, tool or form the audience will be sent to.
When to choose a specialist
Poor fit based on the information available. The posts do not demonstrate the technical depth or campaign formats this vendor needs.
Read more
Brief
A security product vendor wants a paid, performance-measured launch aimed at technical practitioners — SOC leads and security engineers — with reach and pipeline guarantees and a fixed set of deliverables: a long-form technical explainer, a recorded webinar, and product-specific demo content.
Reasons
None of the four posts is aimed at a technical security reader.
They stay at the level of scope criteria, penalty ceilings and management decisions, with no discussion of controls, architecture, logging, detection or product comparisons.
The closest they come to technical specificity is noting that two companies in the same sector can face different requirements; even there, the framing is for a manager deciding what is defensible, not an engineer building it.
The available material consists of short-form written LinkedIn posts, with no videos, transcripts or long-form articles to demonstrate suitability for the recorded webinar and demo content.
The commercial record is also thin for a paid, performance-measured engagement: the posts mention no media kit, rate card, sponsor policy page or disclosed paid work, and the only repeated call to action is a free self-assessment.
Reach and pipeline guarantees cannot be supported by the available information, and the self-assessment link competes with a vendor's landing page for the same click.
The audience evidence is limited too: 4,458 followers, with no impression, engagement or role-level breakdown to verify practitioner reach.
Ask for those metrics and examples of recorded and long-form work before proceeding.
If the vendor instead needs a credible voice to explain to management why NIS2 exposure exists and who owns it, that is a different need and a much better fit for these posts.
A worked campaign example
Angle
"In scope or gut feeling?" — a joint readiness sequence that moves readers from dismissing NIS2 to booking a diagnostic conversation, using the three arguments already covered in the posts: scope, defensible adequate security, and vendor exposure.
Brief
The consultancy brief above, delivered as a co-branded NIS2 readiness push rather than a set of sponsored posts.
Execution
Open with a joint post quoting the same misconception — "we're probably not affected by NIS2" — and end with the scope question. The consultancy answers in the comments with its own scope view, turning the reply thread into the sales conversation instead of redirecting readers to a landing page. Follow with a 30-minute readiness briefing split into three segments that mirror the posts: the scope test, what defensible adequate security means, and a vendor-inventory walkthrough. Have the audience work live through who has access, which providers are critical and what standards they follow. Provide one practical asset, not a brochure: a six-question self-check covering size and sector tests, supplier and system-access mapping, identification of critical providers, and evidence that current measures were chosen for the organisation's own threat landscape. Close by routing completed self-checks into a booked adequacy diagnostic, the paid step. Meelhuysen carries the argument, closing question and audience relationship; the consultancy carries the diagnostic offer, follow-up and reporting. Agree three things in writing before launch: which link takes priority — the recurring free self-assessment or the consultancy's form — since both cannot own the same call to action; who replies to comments and how leads are shared; and permission to reuse the post framing and self-check in co-branded material. Measure replies to the closing question, self-check completions and booked diagnostics; do not report follower growth as campaign performance.
Choose Sandra Roberts when the campaign should make the board-level case for cybersecurity investment.
Read more
In a post on CISO priorities, Roberts links security spending to business goals and includes regulatory compliance among leaders’ concerns. That framing can make a readiness conversation more relevant to executives.
Sandra Roberts’s examples focus on executive priorities, while Eduard Meelhuysen’s NIS2 posts address scope, supplier exposure, and risk-based security measures. Choose Meelhuysen when the campaign needs to explain those specifics.
Choose Yasamin Fatemian when the campaign is about aligning security work with business priorities, rather than explaining NIS2 rules.
Read more
In a post about project alignment, Fatemian suggests asking what business risk a project addresses, who it affects, and how success will be measured. A separate post about AI and security teams considers how AI might help teams prioritize information and make decisions faster.
These examples offer a useful angle on prioritization and project clarity, but not on NIS2 scope, supplier risk, or compliance measures. For those specifics, choose Eduard Meelhuysen’s NIS2-focused examples.
Choose Anne Bisagno when the campaign should move from regulation to device security for hybrid work.
Read more
In a BYOD post, Bisagno frames personal-device security as a governance issue involving policy, education, identity security, and ongoing oversight. A second post on Device Trust describes checking device posture and taking a phased approach toward Zero Trust.
These examples focus on device access and business resilience, rather than explaining NIS2. For a campaign on regulatory readiness, choose Eduard Meelhuysen’s post on risk-based NIS2 security measures.
Four LinkedIn posts by Eduard Meelhuysen address NIS2 scope, fines and enforcement compared with GDPR, risk-based adequate security, and supply-chain and third-party risk.
The posts carry no publication dates; the LinkedIn account showed 4,458 followers on 11 October 2026.
No long-form articles, videos, transcripts, books, shows or other channels appear alongside these posts, so they cover NIS2 commentary only and do not establish Meelhuysen's wider public profile, earlier work or any signature publication.
For comparison, two posts each from Yasamin Fatemian (July 2026), Sandra Roberts, CSM, CySA (June 2025) and Anne Bisagno (September 2026), along with their linked account pages, are cited; the comparison describes those posts only.
