CISO Direkt, your virtual head of security
A virtual CISO (vCISO) working with your organisation on an ongoing basis, covering strategy, regulatory compliance and hands-on security work. You get a whole security team without hiring a security chief of your own. Swedish operations, Swedish accountability.
Regulation is tightening, we make compliance simple
The Cybersecurity Act (cybersäkerhetslagen), Sweden's implementation of the EU NIS2 Directive, has come into force and covers more organisations than before. For many, a management system such as ISO 27001 is the natural next step. Meanwhile, threats are everyday reality, not headlines. They rarely involve advanced attackers. More often it's an old login or an access right nobody got round to removing.
NIS2
More sectors are covered, with requirements for risk management, incident reporting and clear management accountability.
Responsibility
now lies with management, not just with IT. It can't be delegated away.
8 in 10
Incidents start with an identity, a password or an access right, not a sophisticated breach.
NIST CSF 2.0
NIST CSF 2.0
A proven way of working, adapted to your organisation. We start from NIST CSF 2.0 (identify, protect, detect, respond and recover) but make it practical and relevant to your environment. Here we show where Fiber Direkt comes in, and what we prioritise first to build a secure, preventive foundation.
Download the overviewStart the journey towards safer, more sustainable protection
Govern
Roles and responsibilities. Policy, management review.
Identify
Mapping. EASM, external exposure.
Protect
MFA and Keycloak SSO. Segmentation.
Detect
Monitoring. Domain monitoring.
Respond
Incident management.
Recover
Backup and operations.
A smaller attack surface starts with the right access
We start where the impact is greatest: your identities. Most attacks get in through a login, not through a firewall.
Identity and IAM
Order in who gets access to what. We clean out old accounts and bring sign-in together in one place.
RBAC, roles
Access by role, not by habit. Everyone reaches exactly what their job requires.
Keycloak SSO
One login for everything, on an open platform you own yourselves. Fewer passwords, full control.
MFA with YubiKey
Sign-in that takes more than a password. A physical key (YubiKey) stops phishing almost completely in practice.
Do you know what's visible from outside?
Do you know what's visible from outside?
EASM, External Attack Surface Management, means mapping everything that can be reached from the internet. It shows your domains, systems, services and exposures, both the ones you know about and the ones that may have been forgotten. Once we know what's visible, we can shrink the surface, close unnecessary ways in and fix risks before anyone else finds them. If you want to go deeper, we can run a scoped pentest on request. We then actually get in, under controlled conditions, and show exactly what needs fixing.
Book a walkthroughWhat we map
Why Fiber Direkt?
Services on tap
Mapping
Current state and priorities.
EASM
Monitoring of your attack surface.
MFA and IAM
Identity and strong sign-in.
Keycloak SSO
One login for everything, and you own it.
Vulnerability monitoring
Continuous scanning, alerts on anomalies.
Incident and backup
Respond and restore quickly.
Manual pentest
Scoped, and we test for real.
Virtual CISO
Advice and hands-on help.
We help you set the right priorities
A short conversation is enough to pin down where you stand and what will have the greatest effect first.
Swedish peace of mind through every layer
Systems and data in Swedish data halls. Under Swedish law.
Grow without tying up capital in your own hardware.
Dual paths, backup power and high availability.
27001 and 14001 across the entire infrastructure.
CISO Direkt, packages and prices
vCISO Bas
from SEK 6,151/month
5 hours a month · ongoing advice and support on individual questions.
- SEK 1,230/hour
- Single hour, no subscription: SEK 1,495/hour
vCISO Plus
from SEK 11,914/month
10 hours a month · active work on compliance, risk and security development.
- SEK 1,191/hour
- 8% discount
vCISO Premium
from SEK 23,310/month
20 hours a month · high demands on governance, reporting and NIS2 alignment.
- SEK 1,166/hour
- 10% discount
What's included in vCISO
Add-on services that strengthen your protection
All prices excl. VAT. Travel and any expenses are invoiced separately.
Continuous vulnerability monitoring
Bas: automated scans and reports. Plus: curated and interpreted by your vCISO, SEK 1,500 to 3,000/month.
Manual penetration test
A scoped one-off assignment where we test for real. On request.
Workshop: MFA, YubiKey and LastPass
Training and setup for a group of 5 people, approx. 6 hours.
Migration of your existing IT environment
We plan the migration step by step together with you. The set-up is tailored to how you want to work going forward: fully with us, in a hybrid model or with parts remaining in your own environment.
By quote
NEXT STEP
Start with what gives the most, fastest
Start where it makes the biggest difference. Choose one or more first steps with a quick effect, and we'll help you build on them at the right pace.
Step 1
Activate MFA with YubiKey
- Protect accounts with a physical key and give the team simple, more secure sign-in.
Step 2
A manual pentest
- See in black and white where you stand, and what needs fixing first.
Step 3
Keycloak for SSO
- Secure sign-in, fewer passwords, clearer access rights and better control.
Step 4
Virtualise in Sweden
- Move from on-premises hardware to Swedish virtualisation with better control, redundancy and scalability.
Frequently asked questions
A virtual CISO gives you the same strategic security work as an employed CISO, but part-time and on an ongoing basis, at a significantly lower cost. You also get access to a whole security team instead of a single person. The arrangement suits organisations that need qualified security leadership without hiring a security chief of their own.
The Cybersecurity Act (cybersäkerhetslagen), Sweden's implementation of NIS2, covers more sectors than before and places responsibility with management. If you're unsure whether you're covered, we'll help you work it out, and a gap analysis shows where you stand against the requirements.
Yes. The services are built to scale step by step, with no lock-in and with open standards. Many start with MFA or an attack surface mapping and build on it at their own pace.
In Sweden, under Swedish law, with a Swedish-owned partner. That keeps your data out of reach of international legislation such as the CLOUD Act.
The first steps, such as MFA with YubiKey or a scoped mapping, can be in place quickly. We start where the impact is greatest and plan the rest together with you.
Strategic advice, risk and vulnerability analyses, support for NIS2, GDPR and ISO 27001, reporting to management, incident management and continuity planning, and coordination of EASM, pentests and audits. The scope follows the level you choose.
Unsure about the abbreviations? See our glossary.