[
    {
        "title": "Omegapoint contributes expert competence to national effort against AI-driven cyber threats",
        "url": "/en/articles/omegapoint-contributes-expert-competence-to-national-effort-against-ai-driven-cyber-threats/",
        "content": "As AI fundamentally changes cyber threats, Sweden needs to develop its ability to meet new digital threats. Omegapoint, through AI and security expert Dan Bergh Johnsson, has an active role in a national gathering of forces where authorities, business and research collaborate to strengthen Sweden's cybersecurity. The work has already resulted in concrete initiatives to meet the next generation of cyber threats. Artificial intelligence is rapidly changing the landscape of cybersecurity. Advanced AI models can identify vulnerabilities, analyze complex systems, and automate cyberattacks with a speed and precision that previously required extensive human resources. To meet this development, the National Cyber Security Center (NCSC) and AI Sweden have brought together experts from the public and private sectors in a national effort against AI-driven cyber threats. Omegapoint has contributed expertise in AI, cybersecurity and secure system development through Dan Bergh Johnsson, AI and security expert. Dan has also contributed as an author to the report What does Mythos Preview & Project Glasswing Mean for Sweden?, which highlights how next-generation AI models are changing the threat landscape and what consequences this has for Sweden's digital security. – We are facing a fundamental shift. When AI can be used to find and exploit vulnerabilities at machine speed, we also need to use the same technical power to develop more secure systems and strengthen our defenses. It is about moving from insight to concrete capability, says Dan Bergh Johnsson, AI and security expert at Omegapoint. From analysis to concrete security capabilitiesWithin the framework of the national gathering of forces, experts from authorities, research and business have worked together to analyze the changing threat landscape and identify how AI can be used to strengthen Sweden's digital resilience. The joint work has resulted in several concrete initiatives. Among other things, support is being developed for faster detection and management of cyber threats, AI-based tools for identifying vulnerabilities in software, and methods for security auditing new AI models. An important lesson is that advanced AI needs to be combined with a deep understanding of how digital systems are developed, operate and protected. The ability to quickly translate technological advances into practical security solutions is becoming increasingly important. – AI is not only changing how attacks are carried out, but also how we can work with security. By using AI to identify weaknesses earlier and develop more secure software faster, we can create a completely different pace in security work. It is a capability that is becoming increasingly important for both companies and socially critical operations, says Dan Bergh Johnsson. Cyber-secure AI strengthens innovation and competitivenessFor Omegapoint, the commitment is close to the company's work with secure digital innovation and cyber-secure AI. As AI takes on an increasingly larger role in organizations' operations and systems development, new opportunities are created to streamline work, improve quality, and strengthen security. At the same time, the development places higher demands on technical expertise, architecture, and control over digital systems. Omegapoint works to help organizations put AI's capabilities into practice, with security as an integral part of the development process. – We need to use the full potential of AI, both to create new opportunities and to build more secure digital solutions. Those organizations that manage to combine high development rates with strong security will have a significant advantage. This is as relevant for our customers as it is for Sweden's digital resilience, says Dan Bergh Johnsson. Collaboration strengthens Sweden's digital resilienceThe national gathering of forces shows the importance of gathering expertise from different parts of society to meet increasingly rapid technological development. For Omegapoint, participation means an opportunity to contribute specialist expertise in AI, cybersecurity and secure system development. At the same time, the collaboration provides valuable experience and insights that can be applied in the work of developing more secure digital solutions for companies and organizations. – Sweden's strength lies in our technical expertise and ability to collaborate. When we combine knowledge from authorities, research and business, we create better conditions to meet new threats and seize the opportunities of technology. It is work we are proud to contribute to, says Dan Bergh Johnsson. About the national gathering of forcesThe initiative brings together authorities, research and business to strengthen Sweden's ability to meet AI-driven cyber threats. The work includes, among other things, the development of AI-based methods to detect cyber threats, identify vulnerabilities and strengthen the security of advanced AI models. Read more here: NCSC – Rapid mobilization against AI-driven cyber threats AI Sweden – Sweden joins forces against AI-driven cyber threats",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Omegapoint, through AI and security expert Dan Bergh Johnsson, has an active role in a national effort where authorities, business and research are collaborating to strengthen Sweden's cybersecurity. The work has already resulted in concrete initiatives to address the next generation of cyber threats.",
        "modified_at": "2026-10-20T15:40:04+00:00"
    },
    {
        "title": "The antidote to shadow AI is not a tighter policy",
        "url": "/en/articles/shadow-ai-policy/",
        "content": "That employees, in violation of the IT department's instructions, install or use software on their own initiative, often called shadow it, is an old problem. In an era when AI development is accelerating, this problem has a new and potentially more dangerous successor, shadow AI or shadow AI. When employees themselves use or subscribe to various AI agents, the risks increase manifold. Control over how potentially sensitive information is shared and which capabilities are allowed into their own systems breaks down. To address the problem, we need to think about why an employee violates the company's written policy and starts using their own AI tools. We can start by stating that (except in extreme exceptional cases) it is not based on malice. Nor is it usually an effect of arrogance, nonchalance, or even ignorance. The vast majority of people want to do a good job. The drive to successfully complete their tasks is generally much stronger than laziness. The reward of feeling good at their job is what usually offers the strongest satisfaction with paid work. It is therefore reasonable to assume that in most cases an employee who violates the company's policy on AI use does so to complete their tasks, to be better at their job. So how do we deal with this? As I have already stated, it causes shadow AI serious risks to the organization. We can't just let it happen. It is easy to imagine that a stricter policy or stricter reprimand is the way forward. That may be justified by all means, but I believe that it does not solve what is often the real problem. The policy is often in fact an obstacle, something that obscures the connection between the ambitions of management and the IT department on the one hand and the reality of employees on the other. A policy is not the same purpose, vision and rationality, it is what obscures them. The policy also obscures the management's view of benefit and need. Policies are generally written in what I call ”legalese” – a complex language that aims to enable crystal-clear interpretation when a policy violation turns into an employee case. In this way, the policy can be likened to the dense foliage of a tree. On one side of the tree is the sun consisting of management’s goals, rationalities and vision. On the other side, in the shadow, the shadow AI grows like little mushrooms. To address the problem, we need to find a way for the sunlight to both reach the shadow and be reflected back, like dewdrops glistening in the sunshine. The solution is not, even though my thought process might suggest it, to cut down the tree (or defoliate it for that matter). The policy is needed and fulfills an important function after all. So we need to find another way to, so to speak, make it transparent. Here I want to strike a blow for the line managers. Let them function as a channel for communication and, if you like, for the distribution of light. Group and other line managers are close to employees and know their needs. At the same time, they have a dialogue upwards in the organization and should have a good picture of the purposes and considerations behind different policies. If employees have a need for an AI tool to solve their tasks effectively, the line manager must capture the need and ensure that management is aware of it so that they, together with the IT department, can decide whether there is reason to initiate a pilot to evaluate how the tool can be used safely. If management's answer is no, the reasons for the decision must also be communicated back to employees, with a clear justification. This gives management a chance to clarify the purpose and rational behind the decision. This also requires that management has a clear and well-communicated idea about the basis on which it selects and prioritizes pilot tests of AI models in its own environment. This allows employees to offer clear arguments for why management should consider a pilot, and it makes it easier for employees to understand why other pilots are prioritized higher. To summarize: Formulated policies and tools for monitoring systems are hygiene factors, but the presence of shadow AIultimately reflects a real need among employees. To address what is fundamentally a cultural problem, management needs to be able to capture these needs and clearly justify its decisions about pilots based on rational arguments linked to purposes and visions. Use line managers as a channel to both capture employee needs and to clarify how and why management makes the decisions they do. In short, let the light flow. In both directions.",
        "post_type": "post",
        "meta_description": "Shadow AI poses security risks when employees use their own AI tools. Learn why better communication could be the solution.",
        "excerpt": "Att medarbetare i strid med it-avdelningens instruktioner på eget bevåg installerar eller använder mjukvara, ofta kallat shadow it, är ett gammalt problem. I en tid när AI-utvecklingen går i turbofart har detta problem fått en ny och potentiellt farligare arvtagare, shadow AI eller skugg-AI. När medarbetare själva använder eller tecknar abonnemang på olika AI-agenter ökar nämligen riskerna mångfalt. Kontrollen […]",
        "modified_at": "2026-10-19T12:10:02+00:00"
    },
    {
        "title": "Start date",
        "url": "/en/",
        "content": "Din webbläsare stöder inte videotaggen.through secure digital innovationContact usRead more about our offers530+Active customers900+Dedicated employees25Years in digital security1600+Customer assignmentsYour business is our focusCYBERSECURE AIIncrease efficiency and drive your business with AIAI creates great opportunities, but many businesses struggle to translate them into real value in a secure way. No matter where you are on your AI journey, we help you make AI a business-driving and secure part of your business - from technical idea to measurable business results.​ ​Explore our AI offeringDIGITAL SOVEREIGNTYTake back control of your data and technologyMany businesses have built their digital foundation on global cloud platforms, creating dependencies where the business risks being governed by external actors and foreign legislation. We help you take back control and strengthen your digital sovereignty, for full flexibility and business-critical freedom of action.unrivaled application development and cloud servicesTHE PENTESTERS OF THE FUTURESecure your business against advanced cyber threatsWith the help of new technology, attackers are acting faster, more sophisticated and on a larger scale than before. Traditional methods are not enough to stay one step ahead. We help you proactively test your security structures with advanced, AI-agent-supported pentests. Together we build robust and future-proof systems.Explore offensive and defensive securityOmegapoint helps you develop and secure your digital business. As Nordic leaders in digital security, we create secure business value and development. From advising you on critical decisions to delivering and operating solutions used every day, we take responsibility for making change happen. We make it safe to accelerate. Shall we take the next step together?Contact usInsightsInspiration and newsAll articlesPressOmegapoint contributes expert competence to national effort against AI-driven cyber threatsThrough AI and security expert Dan Bergh Johnsson, Omegapoint has an active role in a national gathering of forces where authorities, business and research collaborate to strengthen Sweden's cybersecurity. The work has already...Read moreBlogThe antidote to shadow AI is not a tighter policyEmployees installing or using software on their own initiative, often called shadow IT, in violation of IT department instructions, is an old problem. In an era when AI development is accelerating,...Read moreBlogWhat happens to security when AI starts acting on its own?AI has in a short time gone from being for many just a tool we ask questions to, to advanced systems that can perform tasks for us. The next step is...Read moreSwedish Security IndexOmegapoint's own annual survey of the threat landscape and maturity of Swedish decision-makers. In the 2026 report, we see that the numbers are high; 7 out of 10 decision-makers (70%) experience the threat landscape as serious.Read the report Our offeringWe help you with secure business development Strategy and security advisoryWe help your business develop strong capabilities in cybersecure digitalization. With senior expertise, we support you in building resilience, establishing effective governance, and making informed decisions around risk and compliance. All to ensure your organization is equipped for threats, crises, and new digital demands. Read moreApplication development and cloud servicesWe help you develop and streamline your business through modern, scalable digital solutions. With security integrated from the start, we build secure applications and platforms that support your business needs over time. With deep expertise in Microsoft and Amazon cloud platforms, we give our customers control, security and power in the cloud. Read moreAI that is cybersecureWherever you are on your AI journey, we help you make AI a secure and business-driving part of your business. Through close business collaboration, we deliver cybersecure AI solutions that quickly take you from idea to measurable results. Our services prepare you technically and strategically for AI solutions that streamline your work and drive your business. With us, you can confidently shift up to Cybersecure AI. Read moreDefensive and offensive security (penetration testing)Cybersecurity is about reducing risk and creating long-term business stability. In our offensive security work, we identify and address vulnerabilities before an attacker can exploit them. Our defensive work strengthens your ability to detect, manage and resist attacks – thereby protecting information systems, mission-critical services and data. Read moreSecure integrations and data flowsModern businesses are often built on complex IT ecosystems where large amounts of data move between systems, platforms and security zones. Meeting high demands on availability, traceability and security requires a well-thought-out integration strategy. We help you create secure, scalable and future-proof integration and data solutions that support your business needs and enable effective digital development. Read moreHandling critical infrastructure and classified information We are market leaders and meet the highest security requirements in PMFS and KSF through our product Craton. It creates a digital workspace for your security-protected operations, with modern collaboration tools and business IT as well as full control over access and authorization. Craton has been in operation in both civilian and military operations for several years. Read moreWe develop safely at the forefront Always safe from the startSafety permeates everything we do; from development, offering and deliveries, to recruitment, working methods and culture. Through the principle Secure by Design We reduce risks, strengthen resilience and create sustainable digital solutions that are secure from the ground up. Read moreProven ability to deliverWe make innovation and business value happen through deep expertise and highly productive teams. By combining deep specialist expertise with a well-proven delivery model, we ensure our clients can turn ideas into measurable results. Read moreSatisfied customers through partnershipWe believe in combining excellence with generosity in close partnership with our customers. That's why they give us top marks every year. With cNPS 69 We have some of the industry's most satisfied customers. Read moreHow can we help you?Contact usJob vacancies",
        "post_type": "page",
        "meta_description": "Omegapoint helps you develop and cyber-secure your digital business. From consulting on the first choices, to delivering and running solutions, we create business value that helps you grow.",
        "excerpt": "",
        "modified_at": "2026-10-16T14:46:50+00:00"
    },
    {
        "title": "New cybersecurity regulations have now come into effect – this is what you need to do now",
        "url": "/en/articles/new-cybersecurity-regulations-have-now-come-into-effect-this-is-what-you-need-to-do-now/",
        "content": "On October 1, the regulations related to the Cybersecurity Act came into effect. In total, the regulations comprise 27 pages of legal text. But don't worry. I've read them so you don't have to. Cybersäkerhetslagen trädde i kraft den 15 januari 2026. Den 1 oktober började dessutom MCFFS 2026:11 gälla - de föreskrifter som konkretiserar kraven på säkerhetsåtgärder och ledningens utbildning. Lagen omfattar många medelstora och stora verksamhetsutövare inom de 18 sectors listed in the NIS2 regulations, as well as certain public activities and in some cases smaller activities of particular importance. Each organization needs to assess whether, and to what extent, it is covered. Lagen i sig är en rejäl skärpning från tidigare lagstiftning. Vid bristande efterlevnad kan tillsynsmyndigheten ingripa med anmärkning, föreläggande - eventuellt förenat med vite - eller sanktionsavgift. För väsentliga privata verksamhetsutövare kan avgiften uppgå till det högsta av 2 procent av global årsomsättning eller motsvarande 10 miljoner euro. The fact that the law places such a large responsibility on management is in line with the fact that cybersecurity is something that needs to be built from the top down. It simply has to permeate the entire business, and then it is not enough to outsource the job to the organization's security manager or IT department. In particularly serious cases, a board member, CEO or other covered executive in a significant private business may be prohibited from holding a management function in the business. The threshold is high: the business must first have failed to comply with an injunction, the violation must be serious and the person must have acted intentionally or with gross negligence. The new regulations have been developed by the Swedish Civil Defence Agency (MCF) and you can find all the documents here. here. In broad terms, it is now required, among other things, to: The management of the business undergoes safety training. The business applies systematic and risk-based work with cybersecurity. The law also requires reporting significant incidents to the National Cyber Security Center (NCSC). The supervisory authorities can carry out random inspections of operations to verify compliance with the law and its regulations. So what do you need to do now (if you haven't already)? Here's a quick checklist: Make an assessment of whether and how the activity is covered. Ensure management training and mandate for cybersecurity work. Conduct a gap analysis or internal audit against the requirements of the law and relevant regulations. Prioritize actions, appoint owners, decide on resources and continuously monitor remaining risks. Security requirements should be managed during purchasing and outsourcing, so that suppliers do not become a blind spot in the resilience of the business. These steps are a good start. However, they are not enough in themselves to demonstrate that the business meets all the requirements or has the resilience that the law aims for. It is important to remember that the Cybersecurity Act requires ongoing monitoring, updates and reporting. So this is not a project with an end date. It is a continuous work, maybe not something you need to do every day, but it is a skill that must be maintained. In short, you can say that you have done your job when the organization has a real ability to handle serious incidents, not when it just passes an inspection by a regulatory authority.",
        "post_type": "post",
        "meta_description": "The regulations related to the Cybersecurity Act came into effect on October 1. In total, the regulations comprise 27 pages of legal text.",
        "excerpt": "Den 1 oktober började föreskrifterna kopplade till cybersäkerhetslagen gälla. Totalt omfattar föreskrifterna 27 sidor av juridisk text. Men oroa dig inte. Jag har läst dem så att du slipper. Cybersäkerhetslagen trädde i kraft den 15 januari 2026. Den 1 oktober började dessutom MCFFS 2026:11 gälla – de föreskrifter som konkretiserar kraven på säkerhetsåtgärder och ledningens […]",
        "modified_at": "2026-10-16T14:45:30+00:00"
    },
    {
        "title": "AI security",
        "url": "/en/ai-matter/",
        "content": "AI securityUnderstand the risks of AI, and how to protect your business, data and AI systems. We'll figure out what AI security actually means, what threats companies face when using AI, and how you can work safely with AI in practice. Contact usWhat is AI security? AI security, or AI Security as it is often called internationally, is about protecting AI systems, models, data and the use of AI against security risks. — as opposed to just using AI as a tool. It includes protection against prompt injection, data leakage, data poisoning and unsafe AI agents, as well as secure development, testing and governance of AI systems. AI security is not the same as AI for cybersecurity The two concepts point in different directions. AI security is about protecting the AI systems themselves — the models, the data, and how they are used. AI for cybersecurity is the opposite direction: using AI as a tool in existing security efforts, for example to detect intrusion attempts or analyze logs more quickly. Many organizations face both issues at the same time, but they require different actions and different skills. When it comes to building, running and scaling AI solutions securely in your business, it's Cybersecure AI which is the right starting point. Why is AI security important for businesses?AI brings new opportunities to business — but also new vulnerabilities. An insecure AI system can leak sensitive information, make the wrong decisions, or be manipulated without anyone noticing until the damage is done. This not only affects IT security, but also customer and market confidence in how the business handles AI.The regulations tighten the requirements at the same timeEU AI ActThe requirements are being phased in gradually and already apply to high-risk uses of AI — more obligations will be added continuously towards 2027. GDPRFully applies even when AI handles personal data — including in the development, training and operation of AI systems. NIS2Tightens the requirements for risk management and security work for many businesses — also relevant to how AI systems are managed and controlled.Common threats to AI systemsThe security risks that are specific to AI systems — not general IT threats. HOW RISKS ARIS IN PRACTICEPrompt injectionMalicious or deliberately misleading instructions are smuggled into what the AI reads or receives as input, and direct the model to do something it shouldn't.Data leakage & model theftSensitive corporate or personal information is exposed through responses, logs, or training data — or elicited through repeated questions to the model.Data poisoning & model manipulationThe model or its data is manipulated, for example via poisoned training data, so that it produces incorrect or harmful results.Insecure third-party models & misconfigurationUnveiled external models, open source models, or AI services with overly generous default settings open up vulnerabilities further down the chain.Unsafe AI agentsAgents that act autonomously, are connected to more systems and tools than necessary, or are given too broad permissions — and thus can cause harm far beyond their intended purpose.What these threats have in common is that they are often only discovered after the damage has already been done. The earlier security is built in, the less time it has to go wrong.How can companies work safely with AI?Basic principles for building and operating AI systems securely. HOW SAFETY IS BUILT IN Secure by DesignSecurity is built into the AI solution from the start — architecture, data flows, and integrations, not an afterthought.Zero Trust & Permission ManagementLeast privilege and clear identity and authorization control around who and what is allowed to talk to AI systems and AI agents.Ongoing testing & monitoringMonitoring AI systems and AI agents over time — not just at launch — so that deviations are detected before they become incidents.Governance & ComplianceRisk assessment that keeps AI use in line with the EU AI Act, GDPR and internal requirements.Exactly how these principles are best applied depends on your business, AI maturity, and risk profile. These are exactly the kinds of questions we help with in Cybersecure AI. Security is built in from the start, not as an afterthought.We help you use AI in a way that's safe from day one — so you can scale up without taking unnecessary risks. Find out how, in Cybersafe AI.Explore Cybersafe AI”Integrating AI tools into systems can lead to huge production gains. If implemented correctly, it can make work easier and more satisfying for employees. There is great potential, although it is far from obvious.”Dan Bergh Johnsson, OmegapointAI Security FAQsWhat is the difference between AI security and Cybersecure AI?AI security is about protecting AI systems: models, data, integrations, and agents. AI for cybersecurity involves using AI to detect threats, analyze logs, and find anomalies. At the same time, attackers are using AI to make attacks faster and more convincing. A holistic approach needs to encompass all three. What are the biggest security risks with AI?The most fundamental is prompt injection: a language model cannot reliably distinguish instructions from data, so an email or document can control the system. The risk grows as AI agents are given tools and permissions. Added to this are information leakage, manipulated data, supply chain vulnerabilities, and overconfidence in incorrect answers. Since not all risks can be filtered out, solutions need to be designed as if the model can be fooled, with the least possible permissions and controls outside the model. How do we protect sensitive corporate data when using AI?The most common leak is an AI assistant with broader access than the user asking. AI solutions must therefore inherit the user's permissions, never have their own general rights. Classify your data, check how prompts are logged and saved, and whether the provider trains on your data. Guidelines are needed, but they must be backed up by technical protections. What does the EU AI Act mean for us in practice?The requirements depend on the system's use, risk level and whether you are developing or using it. Some requirements, such as AI literacy among employees, already apply to everyone who uses AI. For high-risk systems, there are additional requirements for robustness and cybersecurity. Read the regulation together with GDPR, NIS2 and CRA, and start by mapping your AI systems and your role. How do we get started working safely with AI?Choose a first use case where the consequences are limited if something goes wrong. Threat model the solution before it is built: what data it accesses, what it can do, and what happens if it is tampered with. Also offer approved AI tools early, otherwise AI will be used anyway, albeit outside your control. What risks are added when we use AI models or third-party AI services? You have less control over how data is processed and used. Review whether your data is used for training, where it is processed, which sub-processors are involved and what applies to third-country transfers. Plugins and integrations are also part of the supply chain, and a high dependence on a single supplier is a risk in itself. Karin VictorinBusiness Manager, Cybersecure AIkarin.victorin@omegapoint.seContact me Latest news on AI securityBlogNews2026-09-25Where do humans fit into a development process where AI agents write the code?Increasingly, code production can now be performed by AI agents, with humans taking a step back. This raises a legitimate question: where does the human belong when the agents write the code, and how...Blog2026-09-09In the Shadow of the Hugging Face Attack: How to Safely Sandbox AI ModelsHow do you control your AI models if even one of the world's leading AI companies can't do it? It's a question that has received a lot of attention since July 2026...Blog2026-04-17Speaking of Mythos: When AI increases the pace of cyber threatsAnthropic has recently presented a new AI model, Claude Mythos Preview. The unusual thing that happened was that Anthropic chose not to release the model publicly. The justification is that it has received such strong...",
        "post_type": "page",
        "meta_description": "Understand the risks of AI, and how to protect your business, data and AI systems. We explore how you can work safely with AI in practice.",
        "excerpt": "",
        "modified_at": "2026-10-15T12:48:36+00:00"
    },
    {
        "title": "What happens to security when AI starts acting on its own?",
        "url": "/en/articles/ai-agents-security/",
        "content": "AI has in a short time gone from being for many just a tool we ask questions to, to advanced systems that can perform tasks for us. The next step is already on its way into organizations: AI agents that can read information, make decisions, use digital tools and act in other systems. This opens up great efficiency gains, but it also changes the risk picture. In a survey by Dark Reading, 48 percent of respondents believe that agent-based AI will be the top attack vector for cybercriminals and state-sponsored actors by the end of 2026. It’s a concern that reflects a larger shift. The more leeway we give an AI agent, the greater the consequences if something goes wrong. But does that mean organizations should be wary of AI agents? Not necessarily. The more important question is how the systems around them are built. When instruction and information merge Agentic AI differs from traditional automation in an important way. A classic system follows a predefined process. An AI agent can independently interpret its environment and decide what steps need to be taken to achieve a goal. The same flexibility that makes the agent useful makes it less predictable. A particular challenge arises when the agent interacts with information outside the control of its own organization. For a human, an email, document or web page is information to read and assess. For an AI model, the same texts can also contain instructions that affect how the agent acts. For example, through prompt injection, an attacker can try to make the agent interpret malicious content as legitimate instructions. The problem is therefore not only about protecting the AI model, but about designing the system based on the assumption that the agent will sometimes interpret its environment in a different way than the organization intended. This is where the discussion about agentic AI easily goes wrong, says Daniel Deogun, AI expert and CTO at Omegapoint. “We encounter organizations that both see enormous potential in AI agents and other AI systems, but at the same time are unsure of how far they dare to go. The conclusion does not have to be that we should slow down. Rather, we need to shift the focus from whether the agent can be trusted to how we build systems where security does not depend on it always doing the right thing.” An old security problem in a new guise It may sound like a completely new type of security problem. In part, it is. But much of the solution is based on principles that the security industry has been working with for a long time, from identity and access management and data classification, to architecture, governance, and control over external models and services. Rather, the new thing lies in the role the agent takes on in the system. A traditional machine identity usually has a clearly defined behavior, while a human user can interpret information and make their own decisions. The AI agent falls somewhere in between: a machine identity with significantly more freedom to choose how a task should be solved. Questions of authority therefore quickly turn into questions of mandate. What decisions are the agents allowed to make themselves? When should their scope of action be limited? And where is human control actually an effective security measure? The latter is not obvious. ”Human in the loop” has become a common response to the risks of autonomous systems, but continuous human supervision is neither realistic nor necessarily particularly safe. Rather, humans need to be at the right control points, while the system architecture limits the consequences of incorrect decisions. This is also where Omegapoint sees many organizations' AI issues starting to change. ”\"A couple of years ago, many discussions were about which AI tool to choose and what the technology could make more efficient. Now the conversations are increasingly about how AI should actually become part of the business's systems and processes. This brings together questions about AI, architecture, data, identity, risk and governance. They can no longer be treated separately,\" says Daniel Deogun. Safety doesn't have to be the brake It's tempting to see security and innovation as two opposing forces. But with AI agents, the relationship can just as easily be the opposite. Omegapoint addresses the questions of organizations that want to move from experimenting with AI to using the technology in their business systems and processes. With expertise in both AI, cybersecurity and secure system development, the company is working on exactly that transition: how AI can be integrated into the business without security, control and governance becoming an afterthought. ”\"There is a risk that the security discussion around AI becomes so defensive that organizations forgo opportunities they could seize. Our experience is rather that mature security work provides greater room for action, and that is precisely what we help organizations with,\" says Daniel Deogun. For organizations with high security requirements, the issues become particularly clear, but the principles are the same even in less sensitive operations. The closer AI gets to an organization's core processes, the more important it becomes to be able to handle the fact that the technology will sometimes behave in ways that were not predictable. Security work cannot therefore be based on the assumption that the agent will always do the right thing, but on what happens when it doesn't. How far does it reach? What actions can it take? Can a decision be stopped or reversed? And who is responsible when the agent acts? Because paradoxically, it may be precisely clear limitations that make it possible to give AI agents greater freedom. Sources: https://www.darkreading.com/threat-intelligence/2026-agentic-ai-attack-surface-poster-child",
        "post_type": "post",
        "meta_description": "AI agents are creating new security risks. Learn about permissions, control, and how organizations can use AI safely.",
        "excerpt": "AI har på kort tid gått från att för många bara vara ett verktyg vi ställer frågor till, till avancerade system som kan utföra uppgifter åt oss. Nästa steg är redan på väg in i organisationer: AI-agenter som kan läsa information, fatta beslut, använda digitala verktyg och agera i andra system. Det öppnar för stora […]",
        "modified_at": "2026-10-14T14:49:45+00:00"
    },
    {
        "title": "Our offering",
        "url": "/en/every-offer/",
        "content": "Our offeringWe help you meet today's digital challenges and create new opportunities with security as a foundation. Explore our offerings and find the right solution for your business. Skvader Media - Photographer: Rickard OlaussonFind the right solution for your business From strategy and consulting to development and security, discover how we can help you meet your challenges and achieve your goals. AI that is cybersecureIntegrations and data flowsHandling of critical infrastructure and classified informationApplication development and cloud servicesDefensive and offensive securityStrategy and security advisoryHow can we help you?Contact usJob vacancies",
        "post_type": "page",
        "meta_description": "",
        "excerpt": "",
        "modified_at": "2026-10-14T13:40:11+00:00"
    },
    {
        "title": "Commerce",
        "url": "/en/commerce/",
        "content": "Commerce For a safer e-commerceE-commerce becomes secure when strategy, data, technology and experience are interconnected. We help you navigate complexity, so you can evolve at the right pace while staying in control. Contact an expertGorgeous couple riding the shopping cart outside the supermarket or mall with the yellow wall in the backgroundFor you in commerceOur servicesE-commerce is not just about technology, it's about creating a structure that holds up as requirements change. With the right direction, order and foundation, it becomes easier to make decisions, develop the business and build long-term trust. Strategy & consultingWe offer strategic e-commerce consulting that helps you make informed decisions and build a sustainable foundation for long-term development. Platform & architectureWe help you select, design and further develop e-commerce platforms and architecture that support change, scalability and control over time. Customer experienceWe work with design and structure to create customer experiences that are consistent, useful and trust-building across all digital channels. Data, AI & optimizationWe help you collect, structure and use data including AI-based solutions for better decisions, more efficient working methods and sustainable growth. Product dataWe offer support throughout the product data chain and help you create order, quality and control in your product information from source to channel. PCI/DSSWe offer a complete range of services to help you achieve and maintain PCI DSS compliance from baseline analysis to ongoing support. Digital strategyDirection that lasts over timeDigital commerce requires more decisions than ever before, about channels, pace, technology and organization. Without a clear strategy, these decisions easily become reactive and short-sighted. A well-thought-out strategy creates order in complexity. It makes it possible to prioritize correctly, make decisions with less uncertainty, and develop e-commerce step by step even when conditions change. Read morePlatform & architectureThe foundation that enables changeE-commerce is in constant flux. New requirements, new channels and new ways of working place high demands on the technical foundation. Without the right architecture, every change becomes more costly than necessary. A well-thought-out platform and architecture provides flexibility without losing control. It makes it possible to develop e-commerce in step with the business instead of being held back by technical limitations. Read moreCustomer experienceExperiences that work in practiceA strong customer experience is not built by individual features or visual details. It occurs when the entire flow, from first impression to completed transaction, is well thought out and coherent. When structure, technology and design work together, experiences are created that feel simple, consistent and reliable. This builds trust and makes e-commerce easier to use – for both customers and the organization. Read moreData, insights & AIBetter decisions start with the right foundationThere is plenty of data. The challenge is to turn it into insights that are actually used in the day-to-day management, development, and optimization of e-commerce. When data, analytics, and AI work together effectively, they become an integral part of the business rather than a separate initiative. It provides better decision-making, clearer priorities and a stable foundation for sustainable growth. Read moreProduct data, PIM & GS1Consistent product data across the entire value chainProduct data is the hub of e-commerce. When information is incomplete, inconsistent, or difficult to manage, both the customer experience and internal work are affected. Structured product data and common standards create a context where information can be reused, updated, and scaled. This provides control, efficiency, and the ability to grow without losing quality. Read morePCI DSSStrengthen compliance with PCI DSSWe work with clients in banking and finance to ensure PCI DSS compliance from review and implementation to ongoing advice and improvement work. With deep technical expertise and practical experience, we help you protect payment data, meet requirements and minimize risks. We understand the complexity of both regulatory and business requirements, and tailor our efforts to your needs. Together, we create a sustainable and secure foundation for managing card payments, now and over time. Read moreJens OdeBusiness Manager Commercejens.ode@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "E-commerce becomes secure when strategy, data, technology and experience are connected. We help you create order in the complexity.",
        "excerpt": "",
        "modified_at": "2026-10-12T13:50:30+00:00"
    },
    {
        "title": "Life Science",
        "url": "/en/life-science/",
        "content": "Life science We care for your loved onesCybersecurity is a crucial factor in life sciences. That's why we offer secure solutions and protect sensitive patient data, healthcare systems and research. Contact an expertFor those in life sciencesOur servicesWith the increasing threat of information manipulation and theft, and the growing demand for digital healthcare, cybersecurity is becoming a crucial factor in life sciences. We provide services that secure digital solutions and protect sensitive patient data, healthcare systems, and research. Our expertise enables you to meet the challenges of the future and deliver safe digital care without compromising on security. AdvisoryThe pressure from outside the organization is constantly increasing with regulatory requirements as well as requirements from supervisory authorities. Craton™Life science organizations, like other critical operations, handle sensitive and protected information, including information that may be classified Offensive SecurityHealthcare today is made up of a complex set of IT systems, some of which are modern and others older. The increasing threats from the outside world place even greater demands on these systems to be cybersecure and reliable. Cybersecure digitization As your digitalization partner in cybersecurity, we help you both protect your existing systems and cybersecure your new ones. IntegrationWith large amounts of data scattered across different systems to be compiled for analysis, we can help you with an integration strategy without compromising on cybersecurity. What do our customers say about us?Get inspired by our projectsAnicura\"The best tech company I've worked with in my entire 35-year career.\" Gunnar Sundell, Chief Enterprise Architect, AniCura Biobank register\"Omegapoint is responsive, solution-oriented and responds quickly to questions. I also get the feeling that they really enjoy working with us.\" Lina Dahlberg, Coordinator, Uppsala University Download the Life science bookCybersecurity in life sciences is ultimately about protecting human life and health. A cyber incident in pharmaceuticals, medicine or biotechnology has direct consequences for patient safety, clinical studies, drug supply and regulatory compliance. The Life Science Book is a handbook that aims to provide practical and clear guidance on how life science companies can strengthen their cybersecurity and protect their operations from cyberattacks. We explore the most common threats, risk factors and concrete measures to create resilience and, ultimately, a robust society. Download the Life science book and gain insights that will help your organization strengthen its robustness, meet regulations such as DORA and NIS2, and create security in the digital future. DownloadSafety advice from senior experts Consulting from senior expertsThe pressure from outside the organization is constantly increasing with regulatory requirements as well as requirements from supervisory authorities. To interpret requirements correctly and manage risk while maintaining the pace of change, our advisors and experts are key partners to our Life Science clients. We help you with systematic information security work and methods, as well as compliance over time and delivery with our Ciso tool. Read moreCratonProtection of sensitive business information Healthcare, like other essential activities, currently handles valuable and sensitive information, sometimes of a classified nature. Craton™ is an effective solution for protective security in digital systems and meets the highest quality and security requirements on the market. Craton even meets military requirements for classified information - without complicating operations. You get a complete solution combining technical components, design, and proven ways of working. The result is a secure platform, built on modern principles and with full traceability of everything that happens. Read moreOffensive securityTest the protection mechanisms of your systemsThe increasing threats from the outside world place even greater demands on these systems to be cybersecure and reliable. As your digitalization partner in cybersecurity, we help you protect your systems, data and users through tailored solutions that cover both modern and legacy IT structures. We ensure that your digital transformation takes place without compromising security, and that all systems, from IT solutions for critical innovation to research data, are protected against potential threats. With our expertise, we ensure that you can deliver safe, efficient and future-proof solutions. With offensive security, we can systematically work on verifying and testing the security of many of your components. Read moreCybersecure digitizationSecure digitization for the present and futureAs your digitalization partner in cybersecurity, we help you both protect your existing systems and cybersecure your new ones. Through our tailored solutions, we ensure that your digital transformation is safe, whether you are building new platforms or upgrading legacy systems. We ensure that all aspects of your business, from patient data to research data, are protected from potential threats. With our expertise, you can develop and implement new digital solutions without compromising security - delivering safe, efficient and future-proof solutions. Read moreIntegrationIntegration with complianceWith large amounts of data scattered across different systems to be compiled for analysis, we can help you with an integration strategy without compromising on cybersecurity. Our methodology and delivery model create an efficient integration framework that ensures compliance with applicable regulatory requirements. Read morePatrik LannergårdBusiness Manager Life Sciencepatrik.lannergard@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "Cybersecurity is a crucial factor in life sciences. That's why we offer secure solutions and protect sensitive patient data, healthcare systems and research.",
        "excerpt": "",
        "modified_at": "2026-10-12T13:42:56+00:00"
    },
    {
        "title": "Public sector",
        "url": "/en/public-sector/",
        "content": "Public sector We strengthen Sweden's resilienceThe public sector is at the crossroads of increasingly stringent regulations and a rapidly changing world. We offer a systematic approach to security in a changing world. Contact an expertFor the public sectorOur servicesThe demand for Sweden's resilience is increasing, as is the need for cybersecure digitization. As the threat landscape evolves rapidly, organizations need partners who combine technical excellence with a deep understanding of protective security requirements. Omegapoint has long been a trusted partner to authorities with missions worthy of protection, where security protection and cybersecurity are central parts of the business. Protecting critical infrastructure is no longer a technical issue - it's a societal issue. With our expertise in cybersecure digitization and strategic advice, we offer end to end solutions for public authorities that want to stay ahead. Strategy and security advisoryWe are experienced in supporting public authorities in identifying business risks, implementing systematic approaches to information security and ensuring compliance with relevant regulations. Crisis managementStrengthen your organization's preparedness with a tailored crisis management exercise. We help you practice, evaluate and develop the ability to act quickly and safely in a crisis. Craton™Our Craton product meets the highest security requirements on the market, and is designed to ensure that classified information is protected effectively and securely. Offensive securityThrough penetration tests, among other things, we identify potential vulnerabilities. Both IT systems and employees are put to the test to assess the organization's actual resilience. Integration and cloud servicesWe create a cybersecure integration strategy. Benefit from cloud solutions - we make sure they comply with the security standards your business is subject to. Crisis preparedness and total defenseWe support public actors in developing their crisis preparedness and total defense capability through strategic advice and operational support that strengthens the organization's robustness over time. Strategy and security advisoryInformation security and complianceThe external pressure on your business is constantly increasing with both regulatory and supervisory requirements. To ensure regulatory compliance and manage risk while maintaining the pace of change, we can support your business with the following: Systematic information security work with proven methods and structures Compliance and capability measurement of business-critical systems and applications Ongoing compliance and follow-up using our tool Ciso. Protection of critical functions through frameworks, business continuity plans, training and system support to reduce vulnerability to incidents Read moreCrisis management exercisesCritical operations must continueCrisis management exercises are crucial to ensure that the right people make the right decisions at the right time. In the public sector, the consequences of an incident can quickly become widespread, placing high demands on coordination, communication and clear leadership. By practicing in advance, you will strengthen both the preparedness and the self-confidence of your crisis organization. We help you prepare for the unexpected.Our offer includes: Tailored crisis management exercises with realistic scenarios based on your business Complementary efforts such as media outreach, phishing campaigns and vulnerability assessments Clear monitoring and evaluation to identify strengths, development areas and training needs Contact usCratonProtective Security in digital systemsPublic authorities and essential services often handle security-sensitive information. Complying with security legislation, for example, by storing a computer with classified information in a safe, can ensure compliance. At the same time, however, it can limit the availability of the information to authorized users who need it for their daily activities. Craton is the only product of its kind that makes it possible to manage classified information in digital systems. It is built to meet the most stringent legal requirements without compromising business productivity and collaboration. From order, a full installation and commissioning of a system can take place within a few months. Read moreOffensive securityDo you have the right safeguards in place? Public sector IT environments often consist of both legacy and newer systems that have evolved over time. As complexity increases, it becomes more important than ever to keep track of the entire ecosystem. Through our proactive security services, we can identify vulnerabilities, propose concrete measures and support you in building a structured and sustainable approach to cybersecurity. Some of our services in offensive cybersecurity: Simulations of real-life cyber attacks where we test how well the organization withstands different types of attacks Review of systems and development processes to ensure that security is included from the start and continuously monitored Penetration testing to identify vulnerabilities in everything from applications to underlying infrastructure Read moreIntegration and cloud servicesStrategic IT architecture for you in the public sectorPublic authorities are faced with complex IT environments, security zones and rapidly growing data volumes. This requires a clear strategy for how systems, data, and integrations should work together - securely, efficiently and sustainably. We help you develop a coherent integration strategy, with an information model that works across system boundaries. Our delivery model ensures that integrations take place with the right structure and compliance with regulations and internal policies.For organizations using cloud services, we offer support in architecture, security and cost control. When off-the-shelf solutions are not enough, we develop customized and scalable cloud applications that integrate seamlessly into your existing environment and strengthen the digital platform. Read moreCrisis preparedness and total defenseBuilding capacity for robust resilienceThe public sector plays a central role in maintaining essential societal functions during crises, heightened states of alert, and war. Meeting the increased demands requires a well thought-out strategy, clear processes, and an organization that knows how to act when it matters. We help you assess your current capabilities and needs, identify critical dependencies, and prioritize the right actions. We can support you in everything from planning and management to training of the crisis organization. Working closely with your organization, we strengthen structure, leadership and operational capacity. Always with a holistic approach that builds resilience over time.Whether you are in the start-up phase of your total defense work or need to gear up existing capabilities, we are there to support you along the way. Read moreLarry BjörkqvistBusiness Manager Public Sectorlarry.bjorkqvist@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "The public sector is at the intersection of increasingly strict regulations and rapid global developments. We offer security work in a changing world.",
        "excerpt": "",
        "modified_at": "2026-10-12T13:41:00+00:00"
    },
    {
        "title": "Defense",
        "url": "/en/defense/",
        "content": "Defense Security must be regarded as a top priorityWe help customers with the highest security requirements protect their most valuable information against external and internal threats. Contact an expertFor critical operationsOur servicesCustomers with critical operations often have the highest security requirements. Our role is to protect their most valuable information against internal and external threats. We do this by implementing systematic security work, offering senior consulting services with deep expertise in operational security and protective security, and providing the market's most secure IT platform Craton. Crisis preparednessWe identify needs and propose measures so that your organization can act effectively during a crisis or heightened alert. Total defenseWe provide support and advice in your total defence planning and propose measures to enable your organization to act effectively during a crisis, heightened alert or war. Systematic security workOur systematic security work covers business continuity management, risk management, information security, personnel security and security protection. CratonThe only product on the market that allows you to digitize your security-sensitive operations and comply with the Security Protection Act. Strategy and security advisoryWe offer senior consulting advice in business continuity management, risk management, information security, personnel security and security protection. Security protectionWe have extensive experience in protecting both information and operations that are important for Sweden's security. What do our customers say about us?Get inspired by our projectsVattenfall\"Your consultants are unique in their expert support and possess deep knowledge in civil defense. Through strong competence and good structure, they have contributed to Vattenfall being perceived as a role model in its work in civil defense.\" Markus Tegnhammar, Chief Resilience Lead, Vattenfall Group Security protectionSystematic security workProtective security is about protecting information and operations that are important to Sweden's national security. We have many years of experience in protecting information assets from unauthorized access, alteration or destruction and always apply systematic security work in our customer deliveries. This includes business continuity management, risk management, information security, personnel security and security protection. Read moreCratonDigitization of security-sensitive and critical operationsCraton is the only product of its kind on the market that allows you to digitize your security-sensitive operations while complying with the Security Protection Act. Craton meets the highest security requirements and has been in operation in both civilian and military security sensitive environments for several years. With Craton, you get a secure system that meets the most stringent requirements, while increasing the efficiency and productivity of your security-sensitive business. Read moreCrisis preparedness and total defenseWe prepare you for the unexpectedOur priority in crisis preparedness and total defense is to strengthen the capacity and resilience of your business. We achieve this by raising risk awareness and ensuring your employees have a solid foundation of understanding, enabling them to make informed decisions at all times. Our approach focuses on maintaining the efficiency of your operations while preparing for any disruption.We work with you to develop strategies and plans that enable your organization to operate effectively in times of disruption, high alert and war. Read moreStaff securityDo you know who you are hiring?Background checks are an important security measure in the recruitment process. They provide verified information about a candidate's qualifications and help assess potential risks in relation to your organization's requirements and values, supporting a secure and effective recruitment process. Supplementing security interviews is part of maintaining a good security culture for activities that are not covered by security legislation. These can be held at the time of recruitment or regularly during employment. We have in-depth experience in all aspects of personnel security, from operational safety to security protection. Contact usNicklas HaglundBusiness Manager Defensenicklas.haglund@basalt.seContact me",
        "post_type": "page",
        "meta_description": "We help customers with the highest security requirements protect their most valuable information against external and internal threats.",
        "excerpt": "",
        "modified_at": "2026-10-12T13:39:31+00:00"
    },
    {
        "title": "Energy",
        "url": "/en/energy/",
        "content": "Energy Society must never go darkSecurity in the energy sector is critical. We deliver cybersecure solutions that protect both operations and the environment. Today and tomorrow. Talk to an expertFor those in the energy sectorOur servicesAs the demand for renewable and sustainable energy sources increases, it has a significant impact on the IT stack of energy companies, especially in terms of security. The integration of these new energy sources - such as wind, solar and hydropower - relies heavily on advanced IT systems to manage energy production, distribution and storage. These developments pose several important security challenges that we want to help solve through partnerships. Strategy and security advisoryWe are experienced in supporting energy companies in identifying business risks, implementing systematic approaches to information security and ensuring compliance with relevant regulations. Craton™Our Craton product meets the highest security requirements on the market and is designed to handle classified information efficiently and securely. Offensive securityThrough security audits and penetration tests, we identify potential vulnerabilities in the complex infrastructure of energy companies and test the actual resilience. Data management and integrationWe create a cybersecure and efficient integration strategy with a coherent information model. Maximize the value of your data. Cloud servicesWe optimize your cloud solutions according to industry standards and cybersecurity requirements - and build bespoke cloud applications when off-the-shelf solutions are not enough. Energy bookWelcome to download our practical guide. It provides clear guidance on how to strengthen your cybersecurity and build resilience. What do energy companies say about us?What our customers sayVattenfall\"Your consultants are unique in their expert support and possess deep knowledge in civil defense. Through strong competence and good structure, they have contributed to the company being perceived as a role model in its work in civil defense.\" Markus Tegnhammar, Chief Resilience Lead, Vattenfall Group Stockholm Exergi\"The hub of our IT environment is our integration platform that enables connectivity with our internal systems and external partners, an important prerequisite for achieving our ambitious goals. This platform is built and managed by Omegapoint, a key IT partner for Stockholm Exergi.\" Jimmy Renström, IT Director, Stockholm Exergi Strategy and security advisoryConsulting from senior expertsThe pressure from outside the organization is constantly increasing with regulatory requirements as well as demands from supervisors. To interpret requirements correctly, and manage risk while maintaining the pace of change, our advisors and experts are a key asset in our partnership with energy customers. We help your business with the following, among others: Systematic information security work and methods. Compliance and capability measurement of systems and third-party applications Compliance over time and delivery with our tool Ciso Protect critical functions through frameworks, business continuity plans, training and system support to minimize disruption during incidents Read moreCraton™Protective Security in digital systemsThe energy sector, like other critical industries, often handles security-sensitive information. Locking a computer with classified information in a safe may meet compliance requirements, but access will be very limited. Craton is the only product of its kind that makes it possible to manage classified information in digital systems. It is built to meet the most stringent legal requirements without compromising business productivity and collaboration. From order, a full installation and commissioning of a system can take place within a few months. Read moreOffensive securityHow resilient is your business?Many renewables are integrated into legacy infrastructure, which may not have been designed with modern cybersecurity challenges in mind. The increasing complexity of hybrid systems that combine both traditional and renewable energy sources requires robust security measures to prevent legacy vulnerabilities from being exploited. Organizations with a vast and complex IT ecosystem need to work systematically to verify and test the security of many components. With our offensive security services, we can identify vulnerabilities, concretize measures and help you create a structured approach. Some of our services in this area: Penetration tests to identify vulnerabilities in business infrastructure and applications, among others. Reviewing systems and development processes to ensure that they are built and managed securely. Simulation of real cyber-attacks to assess the resilience of your business. Read moreData management and integrationManage your business data with the right integrationsWith vast amounts of data for analysis, reporting and production planning in different security zones, a clear game plan and governance documents are required for how systems, data and OT integration should work in a cybersecure, efficient and future-proof way. We can support your organization with a short and effective presentation of your integration strategy and develop an internal information model that is connected across system boundaries and security zones (Zero Trust Architecture) to effectively use the data stored. Our methodology and industry proven delivery model create an efficient integration framework that ensures compliance with your strategy and information model. Read moreCloud servicesTake advantage of the possibilities of cloud technologyIn the parts of your business that use cloud solutions, it is important that you follow guidelines for security, architecture and cost control. We draw on the Cloud Adoption Framework and Well Architected Framework of cloud providers and add our deep knowledge and experience in cybersecurity. By involving roles responsible for governance, architecture, security and change management, we create a common structure for how cloud services are introduced, managed and further developed. This enables a controlled and efficient cloud journey where both technology and business work together. All to utilize the full potential of cloud computing. When off-the-shelf solutions don't fully meet your business requirements, we develop tailor-made cloud applications that are optimized for your specific needs. Solutions that are scalable, robust and cost-effective, with a seamless integration to your existing IT environment. Through our expertise in both systems development, cybersecurity and supported by coordinated roles ensuring compliance, innovation and skills development - we help you maximize the value of your cloud services and create a future-proof digital platform for your business. Read moreApplication developmentApplication development - Secure by DesignWe see every digital solution as an investment in the future of your business and our promise to you is simple: We take full responsibility from the initial idea to ongoing development, ensuring that every step creates tangible value for your business. Our collective experience is based on hundreds of tailor-made deliveries. It has shaped a way of working where cross-functional teams of skilled consultants turn your unique needs into robust, secure and scalable solutions. They create measurable business value early on. We start by understanding your goals and challenges in depth. Together we formulate a vision where security - Secure by Design - is a natural part of the business strategy. In close collaboration, we translate the vision into an application that strengthens your competitiveness, simplifies processes and opens new opportunities for growth. Once the solution is launched, our dedicated enhancement team provides proactive support and continues to develop the solution as needs evolve. The result is an efficient and secure application that continues to deliver business value - year after year. Contact usDownload the Energy BookIn today's digitalized society, the energy industry is one of the most critical sectors. Energy supply is fundamental to the functioning of society as a whole, but at the same time, the digital transformation means increased vulnerability. The Energy Book aims to provide practical and clear guidance on how energy companies can strengthen their cyber security and protect their operations from cyber attacks. It describes the most common threats, risk factors and gives you concrete actions to build resilience and ultimately strong protection. DownloadStefan ReineboBusiness Manager Energystefan.reinebo@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "Security in the energy sector is critical. We deliver cybersecure solutions that protect both operations and the environment. Today and tomorrow.",
        "excerpt": "",
        "modified_at": "2026-10-12T13:37:48+00:00"
    },
    {
        "title": "Banking and Finance",
        "url": "/en/banking-and-finance/",
        "content": "Banking and finance A safer bank Information flows in banking and finance have long been digital. We provide the expertise and solutions you need for secure, sustainable development. Talk to an expertFor those in the banking and finance sectorOur servicesFinancial institutions face three key challenges: digital modernization, pressure to reduce time to market, and growing regulatory demands. Regulatory frameworks, led by DORA, are becoming more detailed and require systematic processes. At the same time, digitalization means that many organizations are undertaking major system transformations, requiring modern ways of working, tactical integrations and secure-by-design solutions. To cope with the increased pace, cloud-like infrastructure and early security investments are key to robust and efficient development. Strategy and security advisorySystematic security work to manage operational risks in the banking and financial sector. We support consistent compliance with applicable regulations and legal requirements. Offensive securityWe have extensive experience in integrating security methodology into development and system support, as well as conducting penetration tests where the actual resilience of the business is put to the test. PCI DSSWe offer a full range of services to help you achieve and maintain compliance with the PCI DSS. We provide audit, implementation, guidance and support. Integration responsibilities with secure DevOps philosophy We ensure smooth system integrations and compliance with standard system changes through a structured, security focused approach. Private and public cloud servicesCloud services enable innovation and efficiency but require security, compliance, and risk management. With the right approach, we help you maximize the potential of the cloud. Application development - Secure by DesignWe design and build secure and scalable systems that drive your digital business. And from deployment, we ensure that it continues to deliver value through proactive management and further development as needs change. Download the BankbookDigitalization has moved the banking and finance industry onto a new playing field. The threat landscape is no longer primarily physical but digital, and trust is built through reliable cybersecurity rather than locked vaults. At the same time, both regulatory requirements and customers’ expectations for fast, secure, and transparent services are increasing. The Bank Book provides a comprehensive overview of the challenges and opportunities in the industry. It demonstrates how proactive cybersecurity, strategic governance, and well-integrated regulatory compliance can become drivers of innovation, trust, and long-term competitiveness. The book aims to provide practical and clear guidance on how companies in the banking, finance and insurance industries can strengthen their cybersecurity. Gain insights that will help your organization strengthen its resilience, meet regulations such as DORA, and create security in the digital future. DownloadOur casesGet inspired by our projectsIkano Bank\"Omegapoint has not only created a secure digital platform, but also a sustainable future. Every tree saved is a step towards a greener planet.\" Peter Carlsson, Head of Operations, Ikano Bank Kivra\"By working with Omegapoint, their security team has helped strengthen our capabilities and develop Kivra into an even safer service\" Henrik Hammarberg, CISO, Kivra Strategy and security advisoryAdvice from our senior expertsWe offer strategic advice and operational support to ensure a systematic and efficient security approach for you in banking and finance. By working consistently with the common controls and policies required by regulations such as DORA, FFFS and other relevant legal requirements, we help you achieve full compliance while optimizing business operations. Our advisory services include: Legal and regulatory compliance and risk management Information security and cybersecurity Security architecture and technical advice Read moreIntegration responsibilities with secure DevOps philosophy Seamless integrations for standard system changesWe have extensive experience in developing integration solutions for major standard system changes, both for services in savings, loans, investments and insurance, but also for central functions such as authorization management. This experience also includes new development and effective management of the internet banking platform. By working secure-by-design in DevOps and with effective system support, it is possible to achieve good control and continuous compliance with rules and security requirements when implementing standard systems. Read moreApplication developmentApplication development - Secure by DesignWe see every digital solution as an investment in the future of your business and our promise to you is simple: We take full responsibility from the initial idea to ongoing development, ensuring that every step creates tangible value for your business. Our collective experience is based on hundreds of tailor-made deliveries. It has shaped a way of working where cross-functional teams of skilled consultants turn your unique needs into robust, secure and scalable solutions. They create measurable business value early on. We start by understanding your goals and challenges in depth. Together we formulate a vision where security - Secure by Design - is a natural part of the business strategy. In close collaboration, we translate the vision into an application that strengthens your competitiveness, simplifies processes and opens new opportunities for growth. Once the solution is launched, our dedicated enhancement team provides proactive support and continues to develop the solution as needs evolve. The result is an efficient and secure application that continues to deliver business value - year after year. Read moreOffensive securitySafety in the development processOmegapoint has extensive experience in introducing security methodology in development processes and implementing effective system support for both large and small players in the banking and financial sector. In an industry where regular penetration tests are a requirement to ensure compliance with regulations such as TIBER-EU, we offer a reputable group of experts who carry out tests both as individual efforts and as a continuous part of our customers' product development. Read morePrivate and public cloud servicesTake advantage of the possibilities of cloud technologyFor many of our customers, public cloud services are a key component of their digital strategy, enabling faster development of products and services, increased scalability and cost efficiency. At the same time, the banking and financial sector's strict regulatory framework sets high standards where security, compliance and risk management must be integrated at every stage of cloud deployment. We draw on the Cloud Adoption Framework and Well Architected Framework of cloud providers and add our deep knowledge and experience in cybersecurity. By involving roles responsible for governance, architecture, security and change management, we create a common structure for how cloud services are introduced, managed and further developed. This enables a controlled and efficient cloud journey where both technology and business work together. All to utilize the full potential of cloud computing. When off-the-shelf solutions don't fully meet your business requirements, we develop tailor-made cloud applications that are optimized for your specific needs. Solutions that are scalable, robust and cost-effective, with a seamless integration to your existing IT environment. Through our expertise in both systems development, cybersecurity and supported by coordinated roles ensuring compliance, innovation and skills development - we help you maximize the value of your cloud services and create a future-proof digital platform for your business. Read morePCI DSSStrengthen compliance with PCI DSSWe work with banking and financial services clients on an ongoing basis to ensure compliance with the PCI DSS - from audit and implementation to ongoing advice and improvement. With deep technical expertise and hands-on experience, we help you protect payment data, meet requirements and minimize risk. We understand the complexity of both regulatory and business requirements, and tailor our efforts to your needs. Together, we create a sustainable and secure foundation for managing card payments, now and over time. Read moreKim WikbrandBusiness Manager Banking & Financekim.wikbrand@omegapoint.secontact me",
        "post_type": "page",
        "meta_description": "We offer expertise and solutions that enable secure and sustainable development for you in the banking and finance sector.",
        "excerpt": "",
        "modified_at": "2026-10-12T13:37:43+00:00"
    },
    {
        "title": "Cybersecure AI",
        "url": "/en/cyber-affairs-ai/",
        "content": "Cybersecure AI Accelerate with cybersecure AI​AI creates great opportunities, but many companies struggle to turn them into real business value securely. ​Wherever you are on your AI journey, we help you make AI a business-driving and secure part of your business. ​ Contact usCybersecure AIIncrease efficiency and drive your business with AIWe help you make AI useful and profitable for your business. With a business focused approach, we deliver solutions that streamline your work and enable new business opportunities. In a cybersecure way, we take you securely from idea to measurable results. AI for increased efficiencyStreamline working methods with safe AI for productivity, quality and profitability ​ AI to drive businessDrive business with secure AI through new products, services and increased customer value​ Technically ready for cybersecure AIBuild the technical structure and data availability required for scalable and secure AI​ Strategically ready for AIEstablish an AI strategy that maximizes business value, is technical feasible and safe​ Customers upgrading with cybersecure AI​AI that reduces manual work and increases precisionStrengthened food safety in EuropeChallengeThe European Food Safety Authority's processes for tracking contaminants and trace elements in food were previously mostly manual, which was time-consuming and resource-inefficient. The Swedish Food Agency (SLV) was tasked with developing a streamlined tool for all EU countries. SolutionOmegapoint is strengthening SLV with AI expertise during 2025-2026 to take their idea from feasibility study and proof-of-concept to a complete AI service – automated data conversion and reporting with high precision, integrated directly into existing workflows. ResultsAlready in its pilot phase, the AI service shows accuracy on par with manual work and lays the foundation for a fast, scalable and precise reporting process with greatly reduced manual work and higher quality as an effect. AI for secure and scalable developmentTools and principles for code generation and informationChallengeIn 2025, Apoteket noted that development teams were already using AI tools to increase efficiency, but without governance and clear security principles. To scale usage, a unified and secure approach was required. SolutionOmegapoint was contacted and, together with Apoteket, has established guidelines for the selection and packaging of AI tools. In parallel, clear security policies and guidelines were developed for how AI should be used for code generation and information retrieval in practice. ResultsA pilot with a complete packaging of Claude AI/Claude Code has been implemented. Through standardization and updated security classifications, the conditions are now created to scale the solution in the organization. Apoteket has laid the foundation for a high development rate without compromising security. Discover our offering in cybersecurity AI.Download our one-pagerAI for increased efficiencyStreamline your working methods with secure AI for productivity, quality and profitability​Our experts will help you to:​ Develop AI solutions that automate manual work, shorten lead times, strengthen your operational capacity and quality​ Ensure your AI tools are used in a cost-effective, scalable and cybersecure way​ Increase your skills and support both your business and your development team​ Measure your efficiency gains through predetermined KPIsfollow-up​ ”AI used correctly frees up capacity” ​ ML | Deep Learning | LLMs | GenAI | AI Agents | Automation​ AI to drive businessDrive your business with secure AI through new products, services and increased customer value​Our experts will help you to:​ Develop business-adapted solutions that drive innovation, create new revenue opportunities and increase customer value​ Integrate new AI initiatives so they become a seamless part of existing products and services​ Drive initiatives all the way, from development to activation, ​in a safe way​ Measure your business impact through predetermined KPI tracking​ ”Integrated AI initiatives drive business” ​ AI Products | AI-Driven Growth | Intelligent Customer Experiences | Personalized services​ Technically ready for cybersecure AIBuild your technical structure and make data available for secure and scalable AI​Our experts will help you to:​ Customizable organization and context of data so that AI can use it​ Build your technical structure in a scalable way so that it adapted to your business and more AI initiatives​ Establish secure data management, classification and controlled access for seamless collaboration​ Ensure you are technically ready and scalable by activate a first AI pilot ”AI only works if your technology and data do” ​ Data Platform | AI Integration | Embeddings | RAG Systems | AI Applications​ Strategically ready for AIEstablish an AI strategy that maximizes business value, is technically feasible, and secureOur experts will help you to:​ Map and prioritize AI investments by weighing business benefit (ROI) versus technical difficulty and risk​ Choosing AI tools and agents according to business needs results; Copilots, ML platforms, LLM platforms​ Establish an organizational structure that enables effective, safe and proper use of AI​ Ensure you are strategically ready and scalable in a structured way workshop format ​ ”A good AI strategy strengthens the business – in a secure way” AI Strategy | AI Compliance | AI Governance | AI Risk Management | AI Operating Model​ ​ Contact us if you want help with cybersecure AIKarin VictorinBusiness Manager, Cybersecure AIkarin.victorin@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "We help you develop, deploy and use AI in a safe, responsible and controlled way. We combine cybersecurity, data analytics and AI expertise.",
        "excerpt": "",
        "modified_at": "2026-10-12T13:14:42+00:00"
    },
    {
        "title": "Application Services – Secure by Design",
        "url": "/en/application-services-secure-by-design/",
        "content": "We build systems that make a difference Secure Application Development From concept to management, we build applications where security and business value go hand in hand. The result is a secure foundation for your digital growth. Talk to an expertApplication development - Secure by DesignApplications that strengthen your businessWe see every digital solution as an investment in the future of your business and our promise to you is simple: We take full responsibility from the initial idea to ongoing development, ensuring that every step creates tangible value for your business. Our collective experience is based on hundreds of tailor-made deliveries. It has shaped a way of working where cross-functional teams of skilled consultants turn your unique needs into robust, secure and scalable solutions. They create measurable business value early on. We start by understanding your goals and challenges in depth. Together we formulate a vision where security - Secure by Design - is a natural part of the business strategy. In close collaboration, we translate the vision into an application that strengthens your competitiveness, simplifies processes and opens new opportunities for growth. Once the solution is launched, our dedicated enhancement team provides proactive support and continues to develop the solution as needs evolve. The result is an application that continues to deliver business value year after year. Secure application development that protects the business Security in digital solutions is critical to protecting your brand, customer trust, and business. By working proactively with principles such as Secure by Design, Defence in depth, OWASP, we identify and minimize risks already in the development phase, before they affect the business. We build security into all layers of the solution, from web development and frontend to backend, integrations and databases. The result is stable and reliable solutions that reduce the risk of costly incidents, operational disruptions and regulatory consequences. You get a secure digital foundation that strengthens the business – today and over time. ​​Customized solutions for your needs ​ ​We always start from your business goals and adapt the solution to how you create value. This means you get the right functionality, at the right time, that suits your business. Regardless of whether we complement your existing organization or take overall responsibility, we ensure that the solution contributes to more efficient working methods, faster time-to-market and better business results. We have long and wide techniqueexperience in many various industries, and is always ready to learn just you technology or together make the next technology choice, whether it is modern or old web framework, cloud or un-premium, migration of today's solution to tomorrow's or greenfield development. Inclusive user experience through accessibility and responsive design A well-thought-out and accessible user experience creates value throughout the organization – not only in the customer encounter, but also in internal working methods. By ensuring that both external services and internal tools are simple, efficient and accessible to all users, we reduce friction in everyday life and free up time for value-creating work. We work systematically with WCAG guidelines and the Accessibility Act/LPTT to ensure that your services work for all users – regardless of conditions or device. The result is higher productivity, fewer errors and increased employee satisfaction, while you strengthen the customer experience and strengthen your brand. ​A complete partner throughout the digital lifecycle ​We offer expertise at all stages of a project, from initial vision to long-term stability. Our teams can lead the entire engagement, handle requirements and UX design, and be responsible for technical development. The solution is continuously managed and refined to meet new market demands and technical conditions, providing a secure and sustainable investment over time. A proven flow for modern application developmentFrom idea to directionWe help you to clarify your needs, goals and priorities. Together we lay the foundation for a solution that is feasible, scalable and commercially sound from the start. MVP in productionWe quickly produce a first version that creates real value. The focus is on the right scope, short lead time and a solution that can be tested, used and built on. Further developmentOnce the solution is operational, we continue to develop it based on user behavior, business needs, and new requirements..This way, the right improvements are prioritized in the right order, with continuous impact over time. Refinement & protectionWe take responsibility for further management, operational support and security work. Through proactive monitoring and ongoing improvements, we ensure that the solution continues to be stable, relevant and secure. Pelle AndelBusiness Manager Application Developmentpelle.andel@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "From concept to management, we build applications where security and business value go hand in hand. The result is a secure foundation for your digital growth.",
        "excerpt": "",
        "modified_at": "2026-10-12T13:11:53+00:00"
    },
    {
        "title": "Offensive and defensive security",
        "url": "/en/offensive-and-defensive-matters/",
        "content": "Offensive and defensive security We anticipate and preventAs cyber attacks have become part of everyday life and grown increasingly sophisticated, vulnerabilities need to be detected and addressed before damage is done. By exposing your systems to simulated attacks and equipping them to withstand real ones, we strengthen the resilience of your business assets. Contact an expertOffensive and defensive securityWe strengthen your ability to resist real attacksOmegapoint provides comprehensive security services that combine offensive security testing with defensive assessments and improvements, all tailored to your business, technology stack, and security level. Through a combination of deep technical expertise, structured working methods and business understanding, we help our customers identify, understand and fix security gaps - before an attacker does. Offensive securityWe test your defense capabilitiesOur approach to penetration testing and security reviews combines: Experienced and highly trained consultants with certifications such as OSEP, OSWE, OSCP and others. In close dialogue with the developers and operators of the systems (white box approach), with an emphasis on manual exploratory penetration testing. Deep analysis where we often identify critical vulnerabilities that automated black box tests are not able to detect. As a result of this approach, we have registered several CVEs, been mentioned in the EU Hall of Fame and, as part of responsible disclosure with stakeholders, shared our knowledge. Read more on our security blog. Defensive securityWe strengthen your digital defensesWe evaluate and improve your defensive security level by: Security audits.We take a holistic approach to your technical environment by analyzing the source code, architecture and infrastructure, as well as making risk assessments that guide you forward in proposed concrete measures. Often in combination with threat modeling and offensive penetration tests. Establishing a structured approach to security, where we ensure that development, operations and business objectives are well aligned with your security requirements and needs. Often linked to information security management systems (ISMS). Advice and training empowering your teams with the knowledge, practices and tools to face both today's and tomorrow's security threats - as well as increasing demands. Some examples of how we havecontributed: - As a contributor to OWASPs ASVS - Through articles on our security blog - As a speaker at security conferences such as NDC Security and Security Fest - As co-author of the book Secure By Design etc. A long-term partner combining technology and strategyOffensive security at the cutting edgeIn our offensive missions, we apply an active and adaptive approach to cybersecurity. By 'thinking like an attacker', we can better protect your business in a constantly changing threat environment. Defensive security that prevents and protectsIn our defensive missions, we always have a clear focus on detecting, preventing and responding to attacks as quickly and effectively as possible. It is not just about reacting, but about anticipating and countering threats in real time, before they take hold. A structured and proven approachWe always work methodically, systematically and continuously with clear processes, roles, tools and objectives to both detect vulnerabilities and protect and recover from attacks. For example, through threat modeling and risk analysis, we identify what is most vulnerable, valuable and likely to be attacked. Per-Olof StrandBusiness Manager Securitypeo.strand@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "By exposing your systems to simulated cyber attacks and equipping them to withstand them, we ensure high resilience of your business assets.",
        "excerpt": "",
        "modified_at": "2026-10-12T12:42:32+00:00"
    },
    {
        "title": "Advisory services",
        "url": "/en/counseling-services/",
        "content": "Strategy and security advisorySecurity requires both technical expertise and strategic commitment - we help you build long-term protection with sustainable solutions. Talk to an expertCybersecurity from the ground upYour digital security, simplified and reinforced.In a world where digitalization creates both opportunities and risks, companies and organizations need a strategy that combines technology, governance and compliance. Omegapoint is your strategic partner to ensure that security and compliance become a natural part of your business - pragmatic, systematic, automated and measurable. Find out more about our areas of expertise: Information securityRisk managementContinuity managementCompliance and control​Security protection​Crisis preparedness and total defense​PCI DSS​Education and trainingTechnical Due Diligence​Information security​Information security aims to protect an organization's information assets across four key areas: confidentiality, integrity, availability, and traceability. There are increasing demands on organizations to be able to demonstrate a systematic approach to managing their digital business risks - which requires an information security management system (ISMS). We can support your work with, among other things: Gap analyses in relation to accepted working methods, such as ISO/IEC 27001 or other internationally recognized standards Design of an information security management system (ISMS) tailored to your organization Implementation of information security management systems Certification support and internal audit of information security management systems Does your business need help managing digital business risks and information security in an easy way? With our product Ciso, you get all the information collected in one place so that the organization's work can be structured in the right way. Read more about CisoRisk managementConducting risk management in information security and IT security aims to identify, assess and manage potential threats and vulnerabilities that could affect an organization's digital assets and mission-critical systems. This includes:​ Risk assessments focusing on information security and IT security risks, based on recognized frameworks such as ISO/IEC 27005 and other relevant standards. Development and implementation of tailored risk management strategies and guidelines to ensure adequate levels of protection. Support in implementing risk management processes and tools to continuously monitor and manage risks. Continuity managementBusiness continuity management aims to ensure that the organization can maintain critical business functions and minimize disruption in the event of unplanned events or disasters. This includes: Designing or implementing business continuity plans and recovery strategies tailored to the business to ensure rapid recovery of operations in the event of any disruptions or incidents. Testing and evaluating continuity plans to ensure their effectiveness and relevance through simulated exercises​ Support in the implementation of continuity work and training to improve the organization's ability to manage and recover operations after incidents. Compliance and control​Increasingly, regulatory requirements embrace cybersecurity and place demands on organizations. Ensuring compliance and control within the organization requires a systematic strategy to maintain and monitor compliance with relevant laws, regulations and internal guidelines. The more regulatory requirements an organization has to comply with, the more complex the work becomes to both design and maintain a management system that meets these requirements. Our offering includes:​ Conducting audits and evaluations to assess the organization's compliance with applicable laws and regulations. Design and implementation of control measures and internal guidelines to ensure compliance and minimize the risk of violations. Support in implementing monitoring and reporting mechanisms for continuous compliance. Security protectionBy continuously working on their security protection work, organizations can maintain good protection. We can help you analyze and build protection for your business from a security protection perspective. We can support in all areas: information security, physical security and personnel security. Of course, we work to increase knowledge and create processes to strengthen security protection throughout the business. Here's how we can help you with your security work: Conduct a security analysis of the business​ Review the business's information security and system architecture​ Conduct security checks on your staff Training in the various sub-areas​ Methods, processes & documentation for the business​ Security solution suggestions Crisis preparedness and total defense​Operations must function even when the unexpected happens – in peacetime, on high alert and in war. This requires more than just documentation. Real preparedness means the ability to lead, make decisions and act in a coordinated manner under pressure. Our senior experts at Omegapoint help you build that capability. We analyze your current situation, identify dependencies and ensure that the right interventions are prioritized. Our advisors support you in everything from strategic planning and governance to practical training of the crisis management organization.We work closely with your business and strengthen both structure, leadership and operational capabilities – with a holistic approach that makes preparedness an asset, not just a requirement.​Our offer includes:​ Analysis and current status of your ability to handle crises​ Strategy, governance and planning of strategies for crisis management and total defense​ Tailor-made crisis management exercises based on high-relevance events Long-term capability building to develop and manage a robust preparedness capability over time PCI DSS​​The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard created by the Payment Card Industry Security Standards Council (PCI SSC) – a collaboration between card issuers such as Visa, Mastercard, American Express and Discover. The purpose of PCI DSS is to protect cardholder payment information and reduce the risk of fraud, data breaches and information leaks. ​​All organizations that store, process, or transmit payment card data must comply with PCI DSS – regardless of size. Failure to comply can result in high fines, legal penalties, and the loss of the ability to process card payments. ​​We offer a complete range of services to help you achieve and maintain PCI DSS compliance. Our services include:​​PCI DSS Audit ​A PCI DSS audit is a thorough review of your systems, processes, and procedures to identify any deviations from the standard's requirements. We use multiple methods, including interviews, technical testing, and document review, to assess your compliance with the 12 core PCI DSS requirements. ​ Implementation ​Implementing PCI DSS is not just about technical controls – it also requires documentation, processes and training. We will help you implement the right measures based on the results of the audit. ​ Guidance and support​PCI DSS is not a one-time project. Maintaining compliance requires monitoring and continuous improvement. ​​Do you have questions about what PCI DSS means for your business? Contact us and we will help you clarify any questions you may have. ​ Contact usEducation and trainingThrough qualified advice and targeted training efforts, Omegapoint helps organizations strengthen their resilience, make informed decisions and meet increased demands for security and governance. A security-conscious culture starts with people. When employees are kept up to date with modern technology and current security methods, the risk of costly mistakes is reduced. That is why training is a central part of our offering – both as part of a larger security effort and as a concrete measure to reduce vulnerabilities in everyday life. ​​Our senior experts hold a range of in-demand training courses, including: Cybersecurity training, which embraces IT security and information security​ NIS2 training together with Dataförening Kompetens​ Threat modeling for the board and management​ Geopolitics and cybersecurity from a board perspective, together with the Board Academy ​ ​ We of course offer tailor-made training based on your business needs. Please contact us if you would like to know more about how we can support you with skills development in the cybersecurity area. Contact usTechnical Due Diligence​When we are assigned to review a fast-growing fintech company for a potential investment, for example, we have a dialogue with both the company and the investor to create a picture of the need and conditions for a Technical Due Diligence (TDD). Here, we want to quickly create a common picture of the current situation, the target image and the most important issues.​We then methodically get to the bottom of what really matters – and deliver a decision basis that weighs risks and opportunities from three central perspectives: people, technology and organization. During our TDD, we dive deep into the company's IT structure and look for key insights, such as: ​ ​ Team and organization – Talented developers, but a worrying dependency structure around a few key people. What happens if they leave? Architecture and system design – An architecture that is not aligned with the investor’s ambitions for the company, such as an older monolithic architecture, can slow the pace of innovation and would require significant investment to modernize. This would hinder scalability and inhibit growth. ​ Operations and Management – ​​An outdated disaster recovery strategy could mean the service is down for hours – or days – in the event of a serious outage. ​ Cybersecurity – Several red flags can be raised here. Vulnerabilities in code and poor access management pose a real risk to both robustness, compliance and data breaches. ​ Code review – Technical debt in the form of old frameworks and low test coverage can show that development speed may decrease over time. Conducting a TDD is not just about identifying risks – it’s about giving both investors and companies a clear path forward. This is why we love our job. Insights lead to smarter deals and safer investments. CISOHelping you manage risk and information securityCiso is a tool that helps you manage digital business risks and information security. With all information in one place, your organization's work can be properly structured. As cyberthreats increase and regulations tighten, information security becomes more complex. High costs, revoked licenses and lost customer trust can result if you are not in control. With Ciso, you can more easily detect gaps, prevent risks and turn regulations into business opportunities. Read moreArticlesDiscover more about securitySee all articlesPress2026-10-20Omegapoint contributes expert competence to national effort against AI-driven cyber threatsThrough AI and security expert Dan Bergh Johnsson, Omegapoint has an active role in a national gathering of forces where authorities, business and research collaborate to strengthen Sweden's cybersecurity. The work has already...BlogCropped shot of an unrecognizable businessmans silhouette against a glass wall in his office.2026-10-19The antidote to shadow AI is not a tighter policyEmployees installing or using software on their own initiative, often called shadow IT, in violation of IT department instructions, is an old problem. In an era when AI development is accelerating,...Blog2026-10-14What happens to security when AI starts acting on its own?AI has in a short time gone from being for many just a tool we ask questions to, to advanced systems that can perform tasks for us. The next step is...RecoSimpler safety testsOur Reko product makes the security clearance process safer, easier and more efficient. Please contact us below to find out more about how Reko can support you and facilitate your business. Contact usWhat do our customers say?Your digital security, simplified and reinforced.Hector Rail\"We at Hector Rail have hired Omegapoint twice to learn staff methodology and train our crisis management group. The exercises have been realistic and given us both tools and increased ability to act and work in staff. We have benefited greatly from both exercises and training when we had a serious accident, for example. We have realized the benefits of continuous training and can highly recommend Omegapoint.\" Björn Nettervik - Safety and Quality Manager Hector Rail. Peab\"Omegapoint delivered a very good crisis management exercise adapted to Peab's needs and capabilities. The exercise was based on a complex, escalating scenario based on a cyber attack where the inputs were built with a number of combined events so that we could exercise our entire crisis management staff. We started with a lesson in Staff Methodology (theory and practice) where we focused on: staff orientation, managerial orientation, time ruler, decision-making in general and situational awareness using the four-field tool. Preparations through interviews of Peab's executives set a good foundation for the exercise and it was noticeable that the exercise leaders were well versed in Peab's crisis management. Through this exercise, Peab has increased its crisis management capacity and we look forward to the next exercise.\" Peter Martin, Safety Manager at Peab Tim SönderskovBusiness Manager Security Consultingtim.sonderskov@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "Security requires both technical expertise and strategic anchoring – we help you build long-term protection with sustainable solutions.",
        "excerpt": "",
        "modified_at": "2026-10-12T12:39:32+00:00"
    },
    {
        "title": "Safe integrations in a new world",
        "url": "/en/things-integration-in-a-new-world/",
        "content": "Safe integrations in a new worldSecurity is critical to every business. We deliver secure solutions that protect your operations and the environment, today and tomorrow. Talk to an expertSecure system integrationOur servicesCyberattacks happen every day, but in critical operations they can have devastating consequences. System integration is complex and spans an extensive IT ecosystem, where large volumes of data must be transported between security zones. Therefore, the integration strategy, information and delivery model must ensure that both availability and security meet business requirements. Integration strategyInformation modelDelivery modelCybersecure integration strategyAvailability and safety must go hand in hand Integration capabilities rely almost exclusively on different technology stacks, on-prem or cloud solution, to handle system integration, OT integration and data integration. Increased demands for making data available securely, preferably in real time, place ever higher demands on technology, architecture, organization and processes. The above-mentioned requirements and challenges require a clear integration strategy and a robust target architecture with a common information model. Once this is in place, an effective delivery model is required to implement integration securely while maintaining the pace of change. We offer a systematically assured integration delivery model that aims to support organizations in addressing future challenges related to integration. Cybersecure integration strategyA strategy that enables actionStrategy does not have to mean a lengthy process. Our experience enables us to quickly develop a practical integration strategy that provides clear direction. A document that sets the game plan with guidelines and rules, definition of integration service, target architecture, organization, process and roles etc. We work on reusing structural capital and have an efficient process to collect data and produce something useful in a short time without overburdening the business.If you already have a strategy, we are happy to verify its timeliness and accuracy as this is an important component for a successful integration delivery. Cybersecure integration strategyThe different elements of the integration strategy We define: Overall business and operational objectives Overall mapping of integrations and IT landscape (infrastructure and application) Integration rules and guidelines. Definition of: Integration (what is the definition of OT integration, system integration, API integration and data integration) Integration service (existing integration solutions on-prem, cloud and in different technical platforms) Target architecture (what are the overall architectural guidelines for different types of integration solutions in terms of technology and function) Organization and processes How should the integration ordering process work? How are strategy and target architecture maintained over time? How are integration solutions effectively managed within the organization? Roadmap for implementation How do we implement the agreed integration strategy over time? Cybersecure information modelBetter control, increased efficiency and reduced risk of errorsWith our long experience in the field of integration and the specific challenges of critical operations, we help you set a robust information model that lasts over time and streamlines integration implementation. In essential activities, several different systems are often used for documentation, operation, maintenance, monitoring and control. In order for the collected information to be used effectively, a common information model is required that enables traceability, context and correct identification of objects between systems. Historically, many businesses have worked in separate systems without the need to cross-reference data. But with increased demands for analysis, reporting and holistic understanding, the need for a more coherent and data-driven IT landscape is growing. At the same time, complexity is increasing, placing higher demands on structure, coordination and data quality. Introducing a centralized information model - mapped to each system's implementation - creates better control, increased efficiency and reduced risk of errors. It is also crucial to establish which system is the master for different parts of the model, to avoid parallel and conflicting versions of the same information. Safe, efficient and competent delivery modelOur valued delivery model is built on deep domain knowledge in critical operations. Understanding nomenclature and common business challenges is a strong advantage when working together to accelerate integration delivery. Our teams are committed to safe and efficient delivery: DevSecOps methodology Agile production methodology for systematic threat modeling, dependency checks, CI/CD and scheduled pentests. Secure By Design Our own \"house bible\" that is mandatory reading for all our team members for safe and quality-assured development and architecture. Secure Development Procedure If we are not working in the customer's management system, we work according to our Secure Development Procedure to comply with our ISO-27001 certification. Well-Architected Framework Where we use the largest commercial cloud providers, we ensure that we follow current best practice in terms of architecture and set-up of underlying services. Security assurance Our reporting tool to prove and report that we build and deliver secure integrations and applications. Structure and accountabilityTo leverage all domain knowledge and secure delivery methodology, we put together well-balanced teams to create efficiency with governance and reporting from our team leads. Our standard reports show, in monthly reconciliations, what we have achieved and at what cost, broken down by opex/capex and follow-up of any incidents and management commitments. On top of our team delivery, we bring in expertise for specific issues around cybersecurity, change management, procurement support and compliance. Stefan ReineboBusiness Manager Energystefan.reinebo@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "Security is critical to every business. We deliver secure solutions that protect your operations and the environment, today and tomorrow.",
        "excerpt": "",
        "modified_at": "2026-10-12T12:18:13+00:00"
    },
    {
        "title": "The bank book",
        "url": "/en/banking-and-finance/the-bank-book/",
        "content": "The bank bookCybersecurity is no longer just a technical issue, it’s a business-critical foundation for banking and finance. The Bank Book shows how organizations can combine proactive security and clear regulatory compliance to build resilience, meet new expectations, and accelerate digitalization. DownloadCybersecurity in a new reality Digitalization has moved the banking and finance industry onto a new playing field. The threat landscape is no longer primarily physical but digital, and trust is built through reliable cybersecurity rather than locked vaults. At the same time, both regulatory requirements and customers’ expectations for fast, secure, and transparent services are increasing. The Bank Book provides a comprehensive overview of the challenges and opportunities in the industry. It demonstrates how proactive cybersecurity, strategic governance, and well-integrated regulatory compliance can become drivers of innovation, trust, and long-term competitiveness. Download The Banking Book and gain insights to help your organization strengthen resilience, meet regulations such as DORA and NIS2, and create security in the digital future. References mentioned in the Bank Book IBM X-Force (point 1 on page 20) Forbes (point 2 on page 20) ENISA (point 5 on page 21) NIST (s. 28)",
        "post_type": "page",
        "meta_description": "The bankbook shows how organizations can combine proactive security and regulatory compliance to build resilience and accelerate digitalization.",
        "excerpt": "",
        "modified_at": "2026-10-01T06:25:09+00:00"
    },
    {
        "title": "Where do humans fit into a development process where AI agents write the code?",
        "url": "/en/articles/where-is-the-human-at-home-in-a-development-process-where-ai-agents-write-the-code/",
        "content": "Increasingly, code production can now be performed by AI agents, with humans taking a step back. This raises a legitimate question: where does the human belong when agents write code, and how do we secure a way of working where much happens automatically? What characterizes the agent-driven development loop? A recurring pattern is a three-step loop: Intent – people define goals based on, for example, requirements.Agent loop – agents produce code in a feedback loop with minimal human intervention, through a mix of AI, traditional (deterministic) scripts and DevOps tools.Reviews – people do risk-proportional quality assurance and move on to deployment, or send feedback back to the loop. One way to balance risk and speed is to classify each change by risk. A high-impact change may require multiple mandatory human reviewers, while a well-defined and harmless change may go through with fewer, if any, reviews. What protections do we need in the loop? From a security perspective, four things in particular appear to be important to automate to a high degree, often with the help of AI: - Security feedback to those who formulate the goals (intent). Are we giving agents enough context to understand the threat model and the non-functional security requirements, such as the authorization model?- Security review of produced code inside the agent loop. Ensure that the code is improved in line with the goals until it is ready for verification (review).- Risk assessment of the changes that are ready for verification. Fast, accurate risk classification is a key factor in maintaining high speed without compromising security.- Security feedback to those verifying changes. Is the change ready for acceptance testing and deployment? Are compliance and security requirements met? Common to automation in these steps is the need for a technically detailed and accurate threat model that spans infrastructure configuration, code, logs, documentation, and requirements. Without that context, the agent lacks the ability to make secure decisions with the right risk assessment. How do we build a secure way of working? The foundation is the same as for all secure system development: well-established principles and patterns such as Secure by Design, Defense in Depth, Zero Trust and Least Privilege. The difference is that we now need to weave them into a way of working where a large part of the code is produced automatically, and where the controls need a high degree of automation to meet the demands for a higher pace of development. The level of human involvement needed, primarily in the intent and review stages, should be proportional to the organization’s threat model and risk appetite. Just because other teams choose to run fully automated in ”YOLO mode” doesn’t mean it’s right for you! If you want to read more about responsibility and risk when AI acts, we also recommend AI Agents and the New Reality: Reflections from RSAC 2026, Whose responsibility is it when AI makes mistakes? and How dangerous is it to let AI-based agents into your own systems?.For more in-depth information, there is material on Omegapoint's security blog, including an article about agent-driven application security and a blog post about why context is crucial.",
        "post_type": "post",
        "meta_description": "Increasingly, code production can now be performed by AI agents. This raises a legitimate question: where does the human belong when the agents write the code?",
        "excerpt": "Alltmer av kodproduktionen kan i dag utföras av AI-agenter, där människan tar ett steg tillbaka. Det väcker en berättigad fråga: var hör människan hemma när agenterna skriver koden, och hur säkrar vi ett arbetssätt där mycket sker automatiskt? Vad kännetecknar den agentdrivna utvecklingsloopen? Ett återkommande mönster är en loop i tre steg: Intent – människor […]",
        "modified_at": "2026-09-25T11:47:21+00:00"
    },
    {
        "title": "In the Shadow of the Hugging Face Attack: How to Safely Sandbox AI Models",
        "url": "/en/articles/in-the-shadow-of-the-hugging-face-attack-you-sandbox-ai-models-in-a-safe-way/",
        "content": "Hur kontrollerar man sina AI-modeller om inte ens ett av världens ledande AI-företag klarar av det? Det är en fråga som har fått mycket utrymme, sedan det i juli 2026 stod klart att en nyutvecklad modell från OpenAI skapat agenter som brutit sig ut ur den skyddade testmiljö som utvecklarna använde, och hackat sig in i företaget Hugging Face's system. About a week after the attack, OpenAI themselves published a technical report about what happened. In short, the report revealed the following: The AI model had been placed in a sandbox, meaning, in a protected test environment without free access to the internet. The agents were then given cybersecurity tasks in ExploitGym. The tasks involved finding ways to exploit vulnerabilities in software to elicit a specific response, called a ”flag”. Some of the tasks were so difficult that there was no known solution. The model had access to OpenAI’s internal tool Artifactory to install software. OpenAI ran the model as a large number of agents. The agents used their read and write permissions in Artifactory as a kind of bulletin board to communicate with each other. They then began to communicate and delegate work among themselves. The agents found a vulnerability that allowed arbitrary requests to be sent to the internet via Artifactory. At this point, the agents began to collaborate with each other. OpenAI describes it as starting to see themselves as a collective, or an ”agent swarm,” trying to solve the task together. Based on the communication between the agents, it was shown that a group of agents \"convinced\" the others that they would help each other with the tasks they were originally assigned individually. The agents concluded that there could be value in breaking into Hugging Face's internal systems to solve some of the tasks. The OpenAI report states that some agents initially refused to hack Hugging Face but were persuaded that it was necessary. They broke in through two vulnerabilities in Hugging Faces' handling of datasets, and then obtained keys and permissions from within the system. The exposed login credentials mentioned in the report belonged to other services and were used to build attack infrastructure, much like a human attacker would have done. The agents came across material linked to the test tasks themselves, and some of it ended up on public services that they used for temporary storage. However, Hugging Face states that no customer data or customer models were affected. The attack went on for just over four days before it was stopped, and OpenAI only discovered it about a week later. At Hugging Face, the security tools raised an alarm, but he alert was given the wrong priority and never reached the on call team. So does this mean we can't control AI agents during development? The answer is no, but it highlights the need to be forward-thinking and careful when creating our sandboxes. OpenAI's model in this case was new and much more powerful than the agents publicly available today, but given the pace of development, we need to think beyond the capabilities of agents today. To begin with, we need to understand that LLMs are extremely goal-driven. They effectively lack the social constraints and implicit moral judgments that human developers apply. If you ask an AI agent to solve a task, it will, unless properly constrained or trained, do everything in its power to solve it. These models are incredibly powerful and, as the example shows, creative. In the Hugging Face case, the agents went so far as to try to mislead OpenAI so that the company wouldn’t discover what the swarm of agents was actually doing. The agents’ motives were not evil, but rather that they were looking for shortcuts to solving the task. You could say they wanted to cheat. You therefore need to treat your prompt environment, that is, what instructions and feedback you give the agent, as an environment that is just as sensitive as a development environment. An effective sandbox not only needs to contain restrictions for the agent, it also needs to be monitored. In the current test, OpenAI had even turned off several guardrails. The monitoring cannot be based on the agent reporting what it is doing. It must be at the layers the agent does not control; what leaves the environment in network traffic, what is actually running there, and what the model itself reasons out. The last is also one of the areas OpenAI says it has tightened up afterwards. It is also important to have a good egress policy. The sandbox regulates what an AI agent is allowed to do inside in a test environment, while the egress policy regulates what it is allowed to do outside of it. That is, exactly what it is allowed to retrieve or what calls it is allowed to make in systems, tools or services outside the sandbox. Here it is also important to remember that each added service that the agents have access to can be a potential way to break out of the sandbox. This was another weakness in OpenAI's setup. So OpenAI has every reason to think about how they build their sandboxes. When Hugging Face was going to analyze the attack logs, they were blocked by the commercial models' own protective barriers. So the attacker was not limited by any rules, yet the defender was. That's remarkable. The point is not that AI agents are impossible to control. The point is that one must assume that a sufficiently capable agent will try to find ways around the limitations that are built in. The sandbox must therefore be designed as a security system – with isolation, strict egress, limited permissions, monitoring and multiple independent layers of protection. The more capable the agents become, the more important it becomes that security is tested against precisely the behaviors that the developer had not anticipated.",
        "post_type": "post",
        "meta_description": "How do you control your AI models if even one of the world's leading AI companies can't do it? It's a question that has received a lot of attention.",
        "excerpt": "Hur kontrollerar man sina AI-modeller om inte ens ett av världens ledande AI-företag klarar av det? Det är en fråga som har fått mycket utrymme, sedan det i juli 2026 stod klart att en nyutvecklad modell från OpenAI skapat agenter som brutit sig ut ur den skyddade testmiljö som utvecklarna använde, och hackat sig in […]",
        "modified_at": "2026-09-09T13:13:54+00:00"
    },
    {
        "title": "Cyber security",
        "url": "/en/cybersecurity/",
        "content": "Cyber securityFor companies that want to stay one step ahead of threats. We help you develop and cyber-secure your digital business. Together, we make your business ready for today's threats and tomorrow's demands. Talk to an expert950+Experts20+Years of experience1600+Customer projectsWhat is cybersecurity? Cybersecurity is the work of protecting systems, applications, data and mission-critical processes against digital threats and unauthorized access. This can be done through processes, methods and technical solutions. For Omegapoint's customers, secure digital development is business critical. We are hired when the demands on security, quality and delivery are high, and we collaborate with customers in areas such as energy, defense, e-commerce and banking & finance.. From security advice in the first choices, to developing, integrating, delivering and operating solutions that are used every day, we take responsibility for making change work. Why cybersecurity is crucial — and what an attack costs youThe most common threats right now, and what is actually at stake if an attack succeeds. COMMON THREATSPhishing & social manipulationMost common route in - an employee is tricked into clicking or providing informationRansomwareData is encrypted and operations are locked until a ransom is paid.Data breaches & leaksUnauthorized persons gain access to customer data, trade secrets or personal information.CONSEQUENCES IF YOU ARE AFFECTEDDowntimeProduction, deliveries and revenues come to a standstill as long as the systems are down.Fines & legal liabilityNIS2, DORA and GDPR can result in penalty fees and personal liability for management.Breach of trustCustomers, partners and the market lose trust — often harder to repair than the technical error.Do you know where you stand today?It can be difficult to know where to start. Tell us briefly about your current situation and what you're thinking about, and we'll help you find a relevant next step.Get help assessing the current situationOur areas of expertiseAI that is cybersecureIncrease efficiency and drive your business with AI Integrations and data flowsMake complex IT environments business‑aligned Handling of critical infrastructure and classified informationDigitize your security-sensitive operations Application development and cloud servicesDevelop customized business solutions Defensive and offensive securityPrevent attacks and strengthen your defenses Strategy and security advisoryBuild your ability to make better decisions Your partner for innovation and business developmentFrom advising on the first choices, to developing, delivering and operating solutions that are used every day, we take responsibility for making change work. With deep expertise, AI solutions, and our well-proven delivery model, we take you smoothly from advice to completed implementation. Through independent and scalable expert teams, we deliver safely at a high pace. Proven ability to deliverWe make innovation and business value happen through deep domain expertise and highly productive teams. Together we turn ideas into measurable results. Satisfied customers through partnershipWe believe in combining excellence with generosity in close partnership with our customers. That's why they give us top marks every year. With a cNPS of 69, we have some of the most satisfied customers in the industry.Safe from the ground upSecurity permeates everything we do, from our employee recruitment and working methods, to our development processes and deliveries. We are ”Secure by Design”.Latest cybersecurity newsBlogNews2026-09-25Where do humans fit into a development process where AI agents write the code?Increasingly, code production can now be performed by AI agents, with humans taking a step back. This raises a legitimate question: where does the human belong when the agents write the code, and how...Blog2026-09-09In the Shadow of the Hugging Face Attack: How to Safely Sandbox AI ModelsHow do you control your AI models if even one of the world's leading AI companies can't do it? It's a question that has received a lot of attention since July 2026...Blog2026-04-17Speaking of Mythos: When AI increases the pace of cyber threatsAnthropic has recently presented a new AI model, Claude Mythos Preview. The unusual thing that happened was that Anthropic chose not to release the model publicly. The justification is that it has received such strong...Swedish Security IndexOmegapoint's own annual survey of the threat landscape and maturity of Swedish decision-makers. In the 2026 report, we see that the numbers are high; 7 out of 10 decision-makers (70%) experience the threat landscape as serious.Read the reportResults in practiceIntegrations for secure and scalable expansionA modern platform for mission-critical data flowsChallengeAnicura has expanded significantly through acquisitions and integrated over 800 operations. To enable efficient reporting, information from many different local systems needed to be integrated; including financial information, operational information, time reporting with payroll systems, and scheduling with clinic systems. SolutionOmegapoint established a modern integration platform that matched the challenges of Anicura's IT landscape. The platform was developed with high security and quality requirements. For example, Secure by Design, Zero trust and Defence in Depth with the help of several DevSecOps teams. ResultsThe new platform enabled approximately 240 integrations in the initial project and created a scalable foundation for continued expansion. Additional countries and systems could be integrated quickly and cost-effectively, while legacy integration solutions could be phased out. The platform is now a central part of AniCura's IT landscape, processing more than 50 million transactions per year, 24/7. AI for secure and scalable developmentTools and principles for code generation and informationChallengeIn 2025, Apoteket noted that development teams were already using AI tools to increase efficiency, but without governance and clear security principles. To scale usage, a unified and secure approach was required. SolutionOmegapoint was contacted and, together with Apoteket, has established guidelines for the selection and packaging of AI tools. In parallel, clear security policies and guidelines were developed for how AI should be used for code generation and information retrieval in practice. ResultsA pilot with a complete packaging of Claude AI/Claude Code has been implemented. Through standardization and updated security classifications, the conditions are now created to scale the solution in the organization. Apoteket has laid the foundation for a high development rate without compromising security. Frequently Asked Questions about CybersecurityWhat is the difference between cybersecurity and information security?Information security is the broader term and is about protection that encompasses all information, regardless of format. Cybersecurity focuses specifically on protection against digital threats in networks and systems. How much does a security audit cost?The price of a security audit can vary and depends on the scope and depth of the audit. Factors that affect the price include the number of systems, the methodology, and the size of the organization. What does it take to become an NIS2 survivor?To comply with NIS2, an EU directive that is being implemented in Sweden through the new Cybersecurity Act, systematic work is required on management responsibility, risk management and strict times for incident reporting. The regulations cover areas such as management responsibility and organization, risk management and security measures, and incident reporting. Which industries need to work with cybersecurity?In industries where the demands on security, quality and delivery capacity are high, such as energy, defense, e-commerce and banking & finance, a cyber-secure operation is especially important. But regardless of which industry a company operates in, it is important to keep track of and protect its data and digital operations. Bobby Singh SangheraAdvisor in secure digitalizationbobby.sanghera@omegapoint.seContact me",
        "post_type": "page",
        "meta_description": "We help you develop and cyber-secure your digital business. Together we ensure that your business withstands today's threats and tomorrow's demands.",
        "excerpt": "",
        "modified_at": "2026-09-09T07:20:42+00:00"
    },
    {
        "title": "The CRA's first requirements are now in effect. Are you ready?",
        "url": "/en/articles/cyber-resilience-act-first-requirements/",
        "content": "On September 11, the first requirements of the EU's Cyber Resilience Act (CRA) will come into effect. For manufacturers of products with digital components, this means that the new reporting obligations now apply. If an actively exploited vulnerability is discovered in a product, the clock starts ticking. An early warning must be issued within 24 hours of the manufacturer becoming aware of the vulnerability. This requires that the organization not only prepare for CRA, but actually have processes and responsibilities in place when something happens. What do you need to have in place? From September, organizations need to have: • ability to detect actively exploited vulnerabilities and incidents that affect the security of your products • ability to report these to authorities in a short time via ENISA's reporting platform • ability to quickly develop and distribute security updates So the question is no longer just whether you have started preparing for CRA. Do the right people know what to do when a vulnerability is discovered? Can you get the information you need? And can you act quickly enough? New clarifications from the EU During the summer, the European Commission published new guidance that can make it easier to interpret and implement CRA in the organization. The guidance clarifies, among other things: • when remote processing solutions are covered by CRA • what constitutes a significant change to a product • how reporting and risk assessment requirements are to be met For organizations that are still working on interpreting what CRA means for their own products, the guidance can provide answers to several of the questions that arise when the regulations are put into practice. How far have you come? ENISA has also published new support during the summer. One of the tools is SME Cyber Resilience Maturity Assessment Model, which together with an Excel template can be used to assess the organization's current maturity level and identify which activities need to be prioritized to strengthen product security. ENISA has also published a final version of Security by Design and Default Playbook, which provides more detailed support on how products can be developed in a secure manner. For the mandatory reporting, ENISA has also published more information on Single Reporting Platform, which should be used to report actively exploited vulnerabilities and incidents that affect product security. What do you need to focus on until 2027?The implementation of the reporting obligations is only a first step. Until December 2027, when the CRA becomes fully applicable, affected organizations need to continue developing their processes for, among other things, risk management, vulnerability management and secure product development. Use the fall to test whether your processes actually work: can you detect, report, and manage a vulnerability when one is discovered? Do you want to delve deeper into CRA? On September 17, we will be holding a breakfast seminar at Omegapoint where we will go into more depth about what the new requirements mean in practice and how you can plan your work until December 2027. Read more and register for the breakfast seminar → here",
        "post_type": "post",
        "meta_description": "The Cyber Resilience Act comes into effect in September. See what you need to have in place for reporting, vulnerability management and product security.",
        "excerpt": "Den 11 september börjar de första kraven i EU:s Cyber Resilience Act (CRA) att tillämpas. För tillverkare av produkter med digitala komponenter innebär det att rapporteringsskyldigheterna nu blir verklighet. Om en aktivt utnyttjad sårbarhet upptäcks i en produkt börjar klockan ticka. En tidig varning ska lämnas inom 24 timmar från det att tillverkaren fått kännedom […]",
        "modified_at": "2026-09-08T15:04:25+00:00"
    },
    {
        "title": "Search",
        "url": "/en/search/",
        "content": "What are you looking for? Search",
        "post_type": "page",
        "meta_description": "",
        "excerpt": "",
        "modified_at": "2026-09-07T14:04:23+00:00"
    },
    {
        "title": "Incident management and cybersecurity",
        "url": "/en/faq/incident-management-and-cybersecurity/",
        "content": "Frequently asked questions about incident management and cybersecurityHow can we help you with incident management and cybersecurity?Read moreContact usIncident management and cybersecurityWhat is a cybersecurity incident? A cybersecurity incident is an event that affects, or risks affecting, the security of information, systems, networks or digital services. This could include unauthorized access, malware, ransomware, data leaks, operational disruptions, or attacks against availability. The important thing is that the organization can quickly detect, classify, manage and, if necessary, report the incident according to clear roles, processes and time requirements. How do you report a security incident according to NIS2? According to NIS2, significant cybersecurity incidents must be reported to the competent authority or CSIRT according to the deadlines and procedures that apply in the national implementation, in Sweden through the Cybersecurity Act. early warning message incident report ongoing updates as needed final report To be able to report on time, the organization needs to have an established incident process, clear criteria for what is reportable, responsible roles, decision-making paths and documented traceability for assessments, actions and communication. How do you report incidents according to DORA? According to DORA, financial actors must report major ICT-related incidents to the competent supervisory authority, in Sweden normally the Financial Supervisory Authority. The reporting is done in stages through an initial report, supplementary updates and a final report. In order to clear this required clear classification criteria, responsible roles and documented traceability for decisions, actions and communication. What is the difference between incident management and crisis management? Incident management is about detecting, analyzing, containing, and remediating a specific security event. The focus is on understanding what happened, mitigating the damage, restoring affected systems, and documenting decisions and actions. Crisis management is activated when the incident has, or risks having, such a significant impact that it threatens the business's ability to function, the organization's trust, or the safety of customers, employees, or essential services. In short: incident management handles the incident, while crisis management deals with the consequences for the business.Not all incidents become crises, but a serious cyber incident may need to be escalated to crisis management. How do you conduct a cyber exercise? A cyber exercise is conducted to test the organization's ability to detect, manage, communicate, and recover from a cyber incident. A practical approach is to define the objectives and scenario, such as ransomware, data breach, supplier incident or critical service disruption. Then determine which functions will participate, such as IT, security, operations, management, legal, communications and suppliers. The exercise is often conducted as a tabletop exercise or technical simulation where participants are given the opportunity to handle a realistic sequence of events with new inputs over time. After the exercise, a structured evaluation is conducted with identified strengths, weaknesses and concrete improvement measures. Most importantly, the results lead to updated plans, clearer responsibilities and better capabilities for a real incident. More from OmegapointInspiration and newsTake advantage of news, articles and blog posts that deepen your expertise and increase your business opportunities.EventsHere you will find our upcoming seminars, webinars and industry events - both those we arrange ourselves and those we participate in.Swedish Security IndexWelcome to download the report for 2026, which also serves as an important basis for decision-making.",
        "post_type": "page",
        "meta_description": "",
        "excerpt": "",
        "modified_at": "2026-09-04T12:50:20+00:00"
    },
    {
        "title": "Cyber Resilience Act",
        "url": "/en/faq/cyber-resilience-act/",
        "content": "Frequently Asked Questions about the Cyber Resilience ActHow can we help you with the Cyber Resilience Act?Read moreContact usEU Cyber Resilience ActWhat is the EU Cyber Resilience Act? EU Cyber Resilience Act (CRA) is a EU regulation with the aim of strengthening security requirements in the products with digital components (software) that we use. The fact that it is an EU regulation means that it applies throughout the EU directly without needing to be adapted by each EU country. What products are covered by the Cyber Resilience Act? The products covered are alla products with digital components (software), as defined. This means physical products that contain software but also pure softwareproducts that are installed as an app on a phone or as a program on a computer. If the product talks to a backend, via for example an API, it is also included in the CRA requirements. When does the Cyber Resilience Act come into effect? It comes into force in two stages, with the first part “Reporting obligations” happening now in September 2026 and the remaining full requirements in December 2027. The first part, “Reporting obligations” in September 2026 means that: You must report to EU authorities (ENISA) within 24 hours of becoming aware that users of your product(s) are affected by vulnerabilities that are being exploited or that you are affected by a security incident related to the product. A complete report must be submitted within 72 hours with You should also have the ability to offer an updated version of your product where the exploited vulnerability is fixed. The second major part in December 2027 means that all your products with digital components must meet all requirements in the CRA: Essential requirement (13 items) Vulnerability action (8 pieces) Based on the cybersecurity risk assessment you have conducted for each product, you implement the requirements you consider relevant. How does CRA affect software development? CRA doesn't really affect software development other than the need to show that you has a functioning process for safe development and that there is documentation that proves that you are working as has been said. For each release you should saves this “evidence” saysmmans with a Software Bill often Materials (SBOM) which lists the components open-source/third-party-components contained in the product. How does CRA affect SaaS providers? Limited direct impact (as the focus is on products). But if a SaaSsolution is used as backend to SaaS-the company's own product with digital components will SaaS-part be included. How can businesses prepare for the CRA? Implement secure development processes, inventory components (SBOM), improve patching and create vulnerability management routines Determine the product's lifespan (minimum 5 years), which will be the time during which you must provide security updates. For your own sake and that of your users, you should ensure that the product can be updated easily and automatically. Automated build and deploy flows to create SBOM and proof that the product has no known exploitable vulnerabilities. More from OmegapointInspiration and newsTake advantage of news, articles and blog posts that deepen your expertise and increase your business opportunities.EventsHere you will find our upcoming seminars, webinars and industry events - both those we arrange ourselves and those we participate in.Swedish Security IndexWelcome to download the report for 2026, which also serves as an important basis for decision-making.",
        "post_type": "page",
        "meta_description": "",
        "excerpt": "",
        "modified_at": "2026-09-04T12:45:17+00:00"
    },
    {
        "title": "ISO 27001",
        "url": "/en/faq/iso-27001/",
        "content": "Frequently asked questions and answers about ISO 27001How can we help you with ISO 27001?Read moreContact usISO 27001What is ISO 27001? ISO 27001 is an international standard that describes how an organization establishes, implements, operates and continually improves an information security management system (LIS/ISMS). The key point is that information security is not seen as an isolated IT issue, but as a governance issue at the business level. The standard is based on a risk-based approach where the organization identifies its most critical information assets, analyzes threats and vulnerabilities, and decides on proportionate protective measures. The result is a structured and auditable‑A flexible working method that enables both internal control and external verification. What is an LIS/ISMS? An LIS is the framework that makes information security work systematic, repeatable and controllable. It typically includes: governing documents (policies, guidelines, goals) organization (roles, responsibilities, decision structures) processes (risk management, incident management, supplier management) controls (technical and organizational) The LIS functions as the \"engine\" of security work - it is through this that the organization plans, implements, monitors and improves its security measures. This means a shift from protecting systems to ensuring that operations function despite disruptions. What is the goal of ISO 27001? The goal is to protect the organization's information by ensuring: confidentiality (the right people have access) accuracy (the information is correct) availability (the information is available when needed) But at a higher level, it's about reducing business risks. ISO 27001 ensures that risks related to cyber threats, operational disruptions, data leaks and suppliers are managed in a structured manner and in line with the business's risk appetite. What does an ISO 27001 certification mean? Certification means that an external, independent auditor verifies that the organization's LIS meets the requirements of the standard. The important thing here is not the certificate itself, but what it represents: that processes are documented that responsibility is clearly defined that risks are managed systematically that the work is traceable and auditable The certification thus serves as external proof that information security is not ad hoc but structured. Which organizations can be certified? ISO 27001 is completely industry neutral and can be applied by: authorities SaaS companies industrial company finance company small and large organizations The difference is not whether you can be certified, but how comprehensive the LIS needs to be. The standard is designed to be adapted to the size, complexity and risk profile of the business. Why do organizations implement ISO 27001? The most common driving forces are: Risk reduction The organization gains control over cyber risks, supplier risks and operational risks. Governance and structure Safety work is moving from person-dependent to process-based. Regulatory compliance ISO 27001 serves as a framework to meet requirements in NIS2, DORA, GDPR, etc. Business value Certification is often required in procurement and strengthens customer confidence. In practice, ISO 27001 is often a combination of compliance‑needs and business strategy. How does ISO 27001 affect business? ISO 27001 has a direct connection to business: Many procurements require certification (or equivalent) It reduces the risk of business-critical incidents It increases trust among customers and partners But most importantly, it allows the organization to demonstrate how risks are managed – not just claim it. This is often crucial in regulatory and commercial dialogues. How does ISO 27001 create trust? Trust comes from transparency and structure. ISO 27001 means that: responsibility is defined risks are documented decisions are traceable controls are implemented and monitored This allows customers, auditors and authorities to understand how the organization works with security – which significantly reduces uncertainty. Can ISO 27001 have economic effects? Yes, both directly and indirectly: Directly: fewer incidents less downtime reduced restoration costs Indirectly: better business opportunities more efficient processes reduced regulatory risk Many organizations see ROI primarily through avoiding large incident costs. Is ISO 27001 just documentation? No – but that is a common misconception. Documentation is a prerequisite for: traceability audit steering But the value lies in how the documentation is used: as a basis for risk decisions as support for processes as a basis for follow-up A good LIS is not a document archive, but an active control system. What does ISO 27001 cover? ISO 27001 covers both governance and operational implementation of information security. This means that the standard covers the entire chain from decisions to implementation and follow-up. Specifically, it includes: establishment of governing documents (policies, goals, guidelines) risk management (identification, analysis, treatment) introduction of security controls (technical and organizational) incident management supplier management internal audit and follow-up continuous improvement The key point is that ISO 27001 not only defines What to be done, without how it should be managed and monitored. It is therefore a management system – not a control library. What does risk-based working method mean? The risk-based approach is at the core of ISO 27001. This means that the organization: Identifies their information assets (systems, data, processes) Analyzes threats and vulnerabilities Assessing consequences for the business Decides which measures are proportionate The important thing here is that: not all controls need to be implemented the security level should correspond to the business risk So it is not “maximum safety” that is the goal, but the right security based on risk and business needs. What are security checks? Security controls are the concrete measures the organization puts in place to manage identified risks. They can be: technical (e.g. MFA, logging, encryption) organizational (e.g. policies, division of responsibilities) process-related (e.g. incident management, change management) An important point in ISO 27001 is that controls: should always be linked to risk must be documented and justified (via SoA) should be monitored and measured So it is not controls per se that are the focus – but controls as a consequence of risk decisions. How much documentation is required? Documentation is central but must be appropriate. ISO 27001 requires documentation to ensure: traceability (what has been decided and why) responsibility (who does what) audit (can this be audited externally/internally) Typical documents: information security policy risk register process descriptions guidelines and instructions audit reports The important thing is that the documentation: actively used (not just existing) reflects how the organization actually works What does continuous improvement mean? ISO 27001 is based on a PDCA‑logic (Plan–Do–Check–Act). This means that LIS is not static but should: be followed up (measurement, KPIs) reviewed (internal audit) evaluated (management review) improved (actions, updates) In practice, this means that: risks change → measures are updated incidents occur → processes improve requirements change → LIS is adjusted This is crucial to ensure that LIS does not become a “shelf warmer”. How to implement ISO 27001? A typical implementation takes place in steps: Current situation analysisWhat is the organization doing today? Scope definitionWhat should be covered? GAP analysisDifference between current situation and requirements Establishment of LISPolicies, roles, processes Risk managementIdentify and address risks Introduction of controlsTechnical and organizational measures Internal audit & improvementPrepare for certification The important thing is that the implementation is run as a business initiative – not an IT project. What is a GAP analysis? A GAP analysis compares the organization's current way of working with the requirements of ISO 27001. The result is: identified deficiencies (gaps) priority actions a roadmap for implementation It is used to: create a realistic plan avoid overwork focus on real shortcomings In practice, the GAP analysis is often the most important first step in structuring the work. What role does management play? Management is crucial in ISO 27001. They are responsible for: to set goals and direction to decide on risk acceptance to allocate resources to follow up on the work This is also an important connection to NIS2 and DORA, where: management has formal responsibility deficiencies can have regulatory consequences An LIS where management is not actively involved will almost always be ineffective. Are external consultants needed? No – but often yes in practice. Consultants are typically used to: accelerate implementation contribute with methodology and experience avoid common mistakes ensure auditable quality But: It is crucial that the organization itself: owns his/her LIS understands their processes conducts its security work Otherwise, the solution will be dependent on an external party. Can the work be digitized? Yes – and it is often a key to success. Digital tools are used to: manage risk registers structure controls and requirements follow up compliance document and share information manage supplier risks The great value is that: the work becomes scalable responsibility and status become transparent follow-up is simplified Without support, LIS risks becoming cumbersome and manual. How does certification work? The certification process usually takes place in several steps and is basically about verifying that the organization's LIS works in practice – not just on paper. Step 1 – Preparation LIS is established risk management is carried out controls are implemented internal audit is carried out Stage 2 – Audit (Stage 1) overall review of documentation and structure ensures that the organization is ready for the main audit Step 3 – Audit (Stage 2) in-depth review of how LIS works in practice interviews, sampling, verification of processes Step 4 – Certificate issued if the requirements are met with any requirements for action The crucial thing is that the audit tests actual working method, not just documentation. How often is the system monitored? A certified LIS is subject to both internal and external monitoring: Annual follow-up audits (external) Recertification every three years Ongoing internal monitoring (KPIs, controls, risks) But the most important thing is the internal rhythm: risk analyses are updated regularly management follows up on LIS incidents and deviations are analyzed This means that LIS must be a living control system, not something you “update for revision”. What happens in case of deviations? Deviations are a natural part of a functioning LIS and are not seen as a failure – but as part of the improvement work. When a non-conformity is identified, the organization shall: Document the deviation Analyze root cause Take corrective action Ensure that the problem does not recur In an external audit, there is normally: minor deviations (must be addressed) major deviations (may affect certification) The important thing is to show control and systematic management, not to be completely flawless. How do you keep LIS alive? This is one of the most common pitfalls – that LIS “stops” after certification. A functioning LIS is kept alive by: recurring risk analyses continuous follow-up of controls regular internal audit active management involvement education and awareness The key is to integrate LIS into: business planning change work decision-making If LIS becomes a separate activity, it quickly loses its effectiveness. How does ISO 27001 relate to NIS2? ISO 27001 and NIS2 overlap to a large extent, but have different roles: ISO 27001: framework for how to work systematically focus on structure, process and risk NIS2: legal requirement (legally binding) specifies what organizations must do ISO 27001 covers many of the core requirements of NIS2, for example: risk-based work governance and responsibility documentation control of suppliers But NIS2 imposes additional requirements, such as: mandatory incident reporting clearer management responsibilities supervision and sanctions In practice, ISO 27001 is often used as basic, which is then supplemented for full NIS2‑compliance. How does ISO 27001 relate to DORA? The relationship between ISO 27001 and DORA is similar to NIS2, but even clearer: ISO 27001: generic framework (all industries) focus on information security DORA: sector-specific (finance) focus on operational resilience and ICT risk ISO 27001 covers parts of DORA, such as: management and governance risk management control structure But DORA goes further in: ICT risk management (in more detail) incident reporting to authorities resilience testing (e.g. scenario/tests) third-party and supplier management This means that ISO 27001 is a strong foundation – but not sufficient in itself. Is ISO 27001 sufficient for DORA? No – and that is an important point in dialogue with customers. ISO 27001 provides: structure processes steering But DORA requires: regulatory adaptation sector-specific controls more detailed documentation and reporting explicit focus on operational resilience So the right way to see it: ISO 27001 = platform DORA = expansion + stricter requirements However, organizations that already have ISO 27001 have a clear advantage in DORA work. What is scope in ISO 27001? Scope defines: which parts of the organization are covered which systems, services and processes are included It is a strategic demarcation and affects: scope of certification what risks are being managed what is reviewed in an audit A too narrow scope can: reduce the value create risks outside LIS A scope that is too broad can: make implementation heavy Therefore, scope is one of the most important decisions early in the project. What is SoA (Statement of Applicability)? The SoA is a key document in ISO 27001 that: lists which controls are included justify why they are chosen specifies how they are implemented shows which controls are not being used (and why) It acts as a “bridge” between: risk analysis and the implementation SoA is also central to auditing because it shows that the organization: understands its risks makes conscious decisions can justify their safety work What is the biggest success factor when implementing ISO27001? The single most important factor is integrating information security into business governance. This means that: management is actively involved risks are linked to business decisions LIS is used in everyday life responsibilities are clearly distributed Failed implementations are often characterized by: that it is run as an IT project that it lacks management support that it is not connected to the business Successful implementations: uses LIS as a tool for management links security to business goals works continuously – not project-based More from OmegapointInspiration and newsTake advantage of news, articles and blog posts that deepen your expertise and increase your business opportunities.EventsHere you will find our upcoming seminars, webinars and industry events - both those we arrange ourselves and those we participate in.Swedish Security IndexWelcome to download the report for 2026, which also serves as an important basis for decision-making.",
        "post_type": "page",
        "meta_description": "",
        "excerpt": "",
        "modified_at": "2026-09-04T12:44:40+00:00"
    },
    {
        "title": "NIS2",
        "url": "/en/faq/nis2/",
        "content": "Frequently asked questions and answers about NIS2How can we help you with NIS2?Read moreContact usNIS2 What is the NIS2 Directive/Cybersecurity Act?NIS2 (Network and Information Security Directive 2) is an EU directive that aims to raise the common level of cybersecurity within the EU. It replaces the previous NIS Directive and places stricter requirements on both private and public organizations. The directive focuses on: systematic and risk-based cybersecurity work clearly management responsibility requirements for incident reporting strengthened requirements for supply chains supervision and sanctions Since it is a directive, it is implemented nationally, in Sweden through Cybersecurity Act. What is the Cybersecurity Act? The Cybersecurity Act is the Swedish implementation of the NIS2 Directive and means that the requirements defined at the EU level become legally binding for organizations in Sweden. Which organizations are covered by NIS2? NIS2 includes organizations that are considered socially important or important for the economy. This includes, for example: energy, transport, healthcare financial sector digital infrastructure and IT services public sector certain manufacturing and industrial companies Organizations are divided into: essential entities (stricter supervision) important entities The classification is mainly based on: sector size criticality of the business What is the difference between NIS and NIS2?NIS2 is a further development of the first NIS Directive and involves a clear tightening: NIS (formerly): limited sector coverage less demands on management less harmonised supervision NIS2: covers more sectors and more organizations clear requirement for management responsibility and accountability more detailed risk management requirements stricter requirements for incident reporting imposes sanctions in case of deficiencies In short: NIS2 makes cybersecurity a business and management issue, not just an IT issue. How do I know if my company is covered by NIS2? To determine if you are covered, you need to analyze three things: SectorDo you belong to a sector that is covered (e.g. energy, finance, IT, public sector)? SizeMany requirements apply to organizations above a certain size (e.g. medium/large companies). CriticalityIs your business essential to society or dependent on digital infrastructure? In practice, this is often done through: an initial NIS2 screening/analysis dialogue with supervisory authority (in certain cases) What requirements does NIS2 place on cybersecurity? NIS2 requires organizations to work systematic, documented and risk-based with cybersecurity. The core requirements are: establish a risk management framework implement technical and organizational security measures ensure incident management work with continuity and resilience manage supplier risks clarify management's responsibilities This is close to how an LIS according to ISO 27001 is structured – which is why the standard is often used as a basis. What security measures are required under NIS2? NIS2 does not specify exact technical solutions, but requires organizations to implement ”appropriate and proportionate measures”, including: risk management processes incident management continuity and recovery plans (backup, redundancy) access control and authentication supply chain security education and awareness The important thing is that measures: are risk-based documented followed up What does incident reporting mean according to NIS2? Organizations must report serious cybersecurity incidents to regulators within defined timeframes. This means: that the organization must have a defined incident process that incidents are classified (what is reportable?) that reporting takes place within established time windows that follow-up and final report are required This places demands on both: technology (detection and logging) process (who reports and how) What sanctions are there for non-compliance with NIS2? NIS2 introduces clearer sanction options than before: administrative penalty fees orders from regulatory authorities requirements for action in some cases personal responsibility for management This means that cybersecurity is no longer “voluntary improvement” but regulatory requirement with consequences. How to prepare for NIS2? A structured working method is crucial. Common approach: Screening – are we covered? GAP analysis – what is missing? Establish framework (often ISO 27001) Implement controls and processes Ensure reporting and follow-up The key is not to implement point solutions but to build a coherent system (LIS). How to conduct an NIS2 maturity assessment? A maturity assessment analyzes how well the organization meets the NIS2 requirements. It typically includes: governance and management risk management technical controls incident management supplier management The result is: current situation identified gaps prioritized action plan This is often the first step in an NIS2 program. How can management work with NIS2? Management has a central role according to NIS2 and is responsible for: to approve risk management measures to follow up on cybersecurity work to secure resources to integrate security into operational management In practice, this means that: Cybersecurity is being lifted from IT to management level risks are managed as business risks decisions are documented This is one of the biggest changes compared to previous regulations. How does NIS2 affect the supply chain? NIS2 sets clear requirements for organizations to manage risks in the supply chain. This means that you must: identify critical suppliers set security requirements in contracts follow up with suppliers ensure that third-party risks are managed This is often one of the most demanding areas of practice, as it involves: several parties dependencies between systems and services need for continuous follow-up More from OmegapointInspiration and newsTake advantage of news, articles and blog posts that deepen your expertise and increase your business opportunities.EventsHere you will find our upcoming seminars, webinars and industry events - both those we arrange ourselves and those we participate in.Swedish Security IndexWelcome to download the report for 2026, which also serves as an important basis for decision-making.",
        "post_type": "page",
        "meta_description": "",
        "excerpt": "",
        "modified_at": "2026-09-04T12:44:34+00:00"
    },
    {
        "title": "Risk management",
        "url": "/en/faq/risk-management/",
        "content": "Risk managementHow can we help you with risk management?Read moreContact usRisk management What is cyber risk management? Cyber risk management is the systematic work of identifying, analyzing, evaluating and managing risks associated with the organization's digital assets and IT.‑environments. It’s not just about technology, it’s about connecting cybersecurity to business risk. The organization must therefore understand which digital assets are critical, what threats exist, and what consequences these could have for the business. Mature work means that risks are documented, prioritized based on business impact, managed through clear measures and followed up continuously. This is the basis of ISO 27001, NIS2 and DORA. How do you conduct a cyber risk analysis? A cyber risk analysis is carried out in a structured manner and in several steps. First, the organization's assets are identified, then threats and vulnerabilities are mapped. The next step is to assess the consequences if something happens, both from a business perspective and a‑ and regulatory perspective. The probability is then assessed and a risk level is determined. Finally, it is decided how the risk should be managed – for example, by reducing it with safety measures, accepting it or transferring it. The most important thing is that the analysis is linked to the business's priorities and not solely driven by technical perspectives. How do you identify critical assets? Identification of critical assets is based on what the business depends on to function. This can be systems, data, processes or external dependencies. An asset is considered critical if its failure would have a major impact on the business, for example in the form of downtime, financial losses or regulatory consequences. In practice, information classification, business mapping and business impact analysis (BIA) are often used. This is also central to DORA, where organizations need to understand their critical functions and dependencies. How do you work with third-party risks? Third-party risks include all risks associated with suppliers and external parties. A structured approach means that the organization identifies its suppliers, classifies their criticality, sets requirements in contracts, conducts risk assessments and monitors compliance on an ongoing basis. A central principle is that responsibility cannot be outsourced – even if a service is delivered by an external party, the organization is still responsible for the risks. How can cyber risks in the supply chain be reduced? Third-party risks include all risks associated with suppliers and external parties. A structured approach means that the organization identifies its suppliers, classifies their criticality, sets requirements in contracts, conducts risk assessments and monitors compliance on an ongoing basis. A central principle is that responsibility cannot be outsourced – even if a service is delivered by an external party, the organization is still responsible for the risks. What risks do DORA and NIS2 focus on? DORA and NIS2 focus on similar types of risks, but with different focus areas. DORA targets the financial sector and focuses on ICT‑risks, operational resilience, supplier dependencies and the ability to manage and recover from incidents. NIS2 is broader and covers critical operations in several sectors, with a focus on cybersecurity risks, systematic risk management, management responsibility and incident reporting. Common to both sets of regulations is that risks should be managed in a structured manner, linked to operations and monitored continuously. More from OmegapointInspiration and newsTake advantage of news, articles and blog posts that deepen your expertise and increase your business opportunities.EventsHere you will find our upcoming seminars, webinars and industry events - both those we arrange ourselves and those we participate in.Swedish Security IndexWelcome to download the report for 2026, which also serves as an important basis for decision-making.",
        "post_type": "page",
        "meta_description": "",
        "excerpt": "",
        "modified_at": "2026-09-02T06:33:43+00:00"
    },
    {
        "title": "FAQ",
        "url": "/en/faq/",
        "content": "Frequently asked questions and answersHere we have collected frequently asked questions and answers to help organizations understand regulations, risks and security requirements in a changing digital world. What can we help you with?DORANIS2ISO 27001Cyber Resilience ActIncident management and cybersecurityRisk managementHow can we help you?Contact usJob vacancies",
        "post_type": "page",
        "meta_description": "",
        "excerpt": "",
        "modified_at": "2026-09-01T14:20:09+00:00"
    },
    {
        "title": "DORA",
        "url": "/en/faq/dora/",
        "content": "Frequently asked questions and answers about DORAHow can we help you with DORA?Read moreContact usDORAWhat is DORA?DORA (Digital Operational Resilience Act) is an EU regulation that aims to strengthen the digital operational resilience of the financial sector. Unlike a directive, it applies directly in the Member States without national implementation. The aim is to ensure that financial organisations can withstand, manage and recover from IT incidents, have control over their ICT risks and maintain stable financial services even in the event of disruptions. DORA is therefore not just a security framework – but a regulatory framework for operational resilience in a digital economy. What does DORA mean for the financial sector? DORA represents a clear shift from traditional IT‑security to operational resilience. Organizations must be able to identify and manage IT‑risks systematically, maintain operations in the event of incidents, quickly restore operations and ensure that dependencies work. This means a shift from protecting systems to ensuring that operations function despite disruptions. Which companies are covered by DORA? DORA covers in principle the entire financial sector within the EU, including banks, insurance companies, securities companies, payment institutions and fintech‑company. In addition, critical third-party suppliers are also covered, such as cloud services, IT‑hosting providers and SaaS‑platforms, which means that external actors are also indirectly affected. How do I know if my company is covered by DORA? You are directly covered if you are a financial operator as defined by the EU. You may be indirectly covered if you supply IT‑services or supports critical functions for financial players. In practice, a regulatory analysis and mapping of business relationships is often required to determine this. What requirements does DORA place on IT security? DORA requires organizations to establish an ICT‑risk management framework, ensures incident management, implements continuity and recovery, conducts testing and manages third-party risks. It's not just about technology, but about governance, processes and continuity throughout the organization. What is ICT risk management according to DORA? ICT risk management is the core of DORA and means that the organization should have a documented and comprehensive risk framework. It covers the entire life cycle: identification protection discovered response recovery The framework should be integrated into governance and monitored continuously. What does DORA mean for banks and insurance companies? For banks and insurance companies, DORA means stricter requirements for governance, IT‑risk management, operational resilience and supplier control. IT‑Risk becomes a business-critical issue where management has a clear responsibility, often driving larger transformation programs. How does DORA affect third-party providers? Organizations must map, classify, and track all suppliers that impact critical functions. This means that: responsibility cannot be outsourced the entire supply chain must be managed and controlled continuous follow-up is required What happens if you do not comply with DORA? Because DORA is a regulation, legally binding requirements apply. Lack of compliance can lead to: penalty fees supervisory measures requirements for action impact on business and licenses Supervision takes place on an ongoing basis, not just in the event of incidents. How to prepare for DORA? A structured approach is crucial: analyze whether the organization is covered implement GAP‑analysis establish frameworks (often based on ISO 27001/22301) implement processes and controls test and follow up The most important thing is to build a coherent system, not isolated measures. What skills are needed to meet DORA? DORA requires a combination of skills in: information security ICT risk management continuity and recovery compliance IT‑architecture As well as change management and governance to have an impact in the organization. How to conduct a DORA gap analysis? A DORA‑GAP analyzes the current situation against the requirements within: ICT risk management incident management resilience supplier management governance The result is a clear list of gaps, priorities and a roadmap forward. How can a consulting company help with DORA? Consultants help with: interpretation of the regulations GAP‑analysis establishment of framework implementation of processes program management It reduces risk, increases pace and ensures auditable quality. How much does a DORA project cost? The cost varies depending on: size of the organization maturity level existing frameworks complexity in IT‑environment and suppliers It should be seen as a transformation program rather than a single project – where the investment reflects both compliance and long-term resilience. More from OmegapointInspiration and newsTake advantage of news, articles and blog posts that deepen your expertise and increase your business opportunities.EventsHere you will find our upcoming seminars, webinars and industry events - both those we arrange ourselves and those we participate in.Swedish Security IndexWelcome to download the report for 2026, which also serves as an important basis for decision-making.",
        "post_type": "page",
        "meta_description": "",
        "excerpt": "",
        "modified_at": "2026-09-01T14:17:08+00:00"
    },
    {
        "title": "Whistleblowing",
        "url": "/en/whistleblowing/",
        "content": "WhistleblowingWhat is whistleblowing and in what cases can you report? Whistleblowing gives everyone the opportunity to report wrongdoing that comes to their attention in a work-related context. This means that employees, contractors, trainees, external consultants, etc. can make a whistleblowing report. Some examples of misconduct that can be reported include: Circumstances that endanger the life or health of employees Damage to the climate or environment (dangerous products, pollution, etc.) Corruption, bribery or other financial crimes (such as embezzlement, theft, fraud, etc.) Misuse of financial resources Unhealthy work environment (harassment, bullying, sexual harassment, discrimination, racism, etc.) Violations of the Code of Conduct, our Whistleblowing Policy and other applicable policies or guidelines. If what is reported concerns a crime, a report will be made to the Police Authority. The Whistleblower Act does not apply to the reporting of security classified information or certain information related to national security. Where the conditions are met, the reporting person receives protection in the form of a discharge, prohibition of obstructive measures and reprisals. The discharge has certain limitations, e.g. it does not entail the right to disclose documents. Anyone who commits an offense by reporting or obtaining information is not protected. The employer is required to establish reporting channels and procedures for reporting and follow-up. You can read more in the Act (2021:890) on the protection of persons who report misconduct. How to report: Omegapoint Group has engaged the company Lantero to manage the reporting process. In addition to receiving reports, their responsibilities include confirming receipt, following up on reported matters, and providing feedback on actions taken. Anyone handling a follow-up case is bound by a duty of confidentiality. Your identity is handled with 100% anonymity. Your identity will not be revealed without your consent. Lantero collects your personal data for the duration of the case. What is stored is name, e-mail address and phone number. When the case is closed, all information is deleted from the encrypted servers located at GleSYS in Falkenberg and/or Stockholm. You always have the right, according to GDPR, to request to see what information is stored and request to delete information about you and your identity, under certain conditions. If you want to report a grievance, use the link via the button below, or call 020-899 433 if you want to submit your report verbally. Submit a report here",
        "post_type": "page",
        "meta_description": "Whistleblowing gives everyone an opportunity to report misconduct that comes to their attention in a work-related context.",
        "excerpt": "",
        "modified_at": "2026-08-25T11:07:03+00:00"
    },
    {
        "title": "Previous Events",
        "url": "/en/previous-events/",
        "content": "EventsThere’s always something happening at Omegapoint. Explore our upcoming seminars, webinars, and industry events, both those we host and those we take part in. Past eventsLocationAllGothenburg, SwedenMalmöonlineÖrebroStockholmUmeåVisbyType of eventAllEventExternal eventMasterclassSeminaryWebinarSee current eventsCONCLUDED14 oktober 202608:00 - 17:00BankTech 2026The financial sector is facing a crucial technological shift. Welcome to a meeting place for decision-makers, innovators and tech experts in banking and finance. We explore how data, ecosystems and AI are actually solving the industry's most critical challenges - here and now.StockholmCONCLUDED1 oktober 202608:30 - 17:00Di Tech Strategy Summit 2026Do you work with IT at a strategic level and want to be one step ahead in digital development? At Tech Strategy Summit you will get concrete tools, insights and contacts to drive innovation and create business value in your organization.StockholmCONCLUDED24 juni 202608:00 - 17:30Almedalen 2026During Almedalen, we are arranging three panel discussions with leading representatives from the cybersecurity industry, a number of socially important activities and politics.VisbyCONCLUDED21 maj 202608:00 - 09:00Breakfast seminar about Mythos and GlasswingIn April, Anthropic launched the AI model Mythos, which is unusually capable of independently producing exploits, i.e. working attacks. Dan Bergh Johnsson is one of the authors behind the report that NCSC and AI Sweden published in connection with the Mythos news. During the seminar, we will go through what actually happened, what Glasswing protects and what we can do concretely.…StockholmCONCLUDED19 maj 202608:00 - 17:00AI focus 2026AI-fokus is a one-day, no-nonsense conference for developers, architects, and tech leaders who want to stay ahead in the rapidly evolving world of artificial intelligence.StockholmCONCLUDED7 maj 202608:30 - 17:00Di Resilience & Infrastructure 2026Di Resilience & Infrastructure 2026 brings together decision-makers from the energy, transport, industry and public sectors to discuss how we strengthen the resilience of our most critical systems. The focus is on concrete solutions for risk management, security investments and new technologies that can protect – and future-proof – the entire social fabric.StockholmCONCLUDED4 maj 202608:00 - Vitalis 2026Vitalis is the Nordic region's leading meeting place for the future of health, care and welfare and is held every year at the Swedish Exhibition and Congress Centre in Gothenburg. It brings together experts, companies, authorities and healthcare players to discuss and showcase solutions in areas such as e-health, AI, digitalisation and welfare technology.Gothenburg, SwedenCONCLUDED28 april 202608:00 - 10:00Swedish Safety Index 2026 UmeåA warm welcome to our breakfast seminar in Umeå: Swedish Security Index 2026 on the perceived threat landscape among decision-makers in socially important activities. We will go through the fresh results and you will receive the printed report to take home with you.UmeåCONCLUDED17 april 202609:00 - 23:00Student Conference 2026Welcome to an exciting and inspiring event organized by Omegapoint, aimed at students across Sweden.StockholmCONCLUDED17 mars 202608:30 - 18:00Radar Security 2026Cybersecurity challenges us all and the trend is still going in the wrong direction. Any zero vision in the area feels like a utopia right now. Radar Security will provide data, insights and advice for all companies and businesses that want and need to take a clearer grip on their robustness and resilience.Stockholm",
        "post_type": "page",
        "meta_description": "Here you can see previous events, lectures and seminars that we have had online and around the country.",
        "excerpt": "",
        "modified_at": "2026-08-25T11:06:28+00:00"
    },
    {
        "title": "Omegapoint in Almedalen",
        "url": "/en/almedalen-2024/",
        "content": "Welcome to our panel discussion in AlmedalenLet's talk about cybersecurity Growing geopolitical insecurity, ongoing conflicts in our vicinity and signals of impending war - with the changing security situation in Sweden, cyber attacks against Swedish businesses are increasing in both frequency and intensity. At the same time, surveys repeatedly show that Swedes' confidence in society's digital resilience is declining. This lack of trust is a security threat in itself, as the resilience of society rests on the public's confidence that decision-makers in socially important activities make the necessary decisions in time. As a leading cybersecurity company, Omegapoint invites for the first time ever to its own stage during the democracy week in Almedalen. On June 27, three panel discussions will be organized with leading representatives of the cybersecurity industry and socially important activities, with the aim of discussing how the business community, the public sector, politics and the public can together strengthen the digital robustness of Swedish society. Welcome to read more about our panelists. Program Tuesday 27 JuneHow do we create a safe and resilient digital society?10:00 - 10:45 am Participating panelists: Johan Malmliden, President and CEO, Omegapoint Patrik \"Paf\" Fältström, Chief Security Officer, Netnod Karl-Erik Svedin, Senior Security Advisor & Head of BCM, Tele2 Magnus Bergström, IT and Information Security Specialist, IMY The call is moderated byElin Ahldén, Lennox PR Read more about the program here How should society respond to the threat of cybercrime?13:00 - 13:45 Participating panelists Nicklas Haglund, CEO, Basalt Freddy Jönsson Hanberg, Chairman, Total Defense Foundation Björn Eriksson, Detective Inspector and Team Leader at the Complex Cybercrime Division, NOA Andreas Heed, Director Payment Law, Financial Supervisory Authority Anders Brännström, Major General and Senior Advisor on Crisis Preparedness and Total Defense, Basalt The call is moderated by Elin Ahldén, Lennox PR Read more about the program here Critical businesses get a bad rap on cybersecurity - who is responsible?14:00 - 14:45 Participating panelists: Johan Malmliden, President and CEO, Omegapoint John Billow, Head of the Cybersecurity Certification Inspectorate (ICC), FMV Hanna Linderstål, CEO and Security Consultant, Earheart Business Protection Agency Åke Holmgren, Head of the Cyber Security and Secure Communications Department, MSB Elin Ahldén, Moderator, Lennox PR Read more about the program here Presentation of our panelistsJohan MalmlidenJohan Malmliden is President and CEO of the cybersecurity company Omegapoint. He has worked with IT and information security issues since the late 80s, both in universities, research labs and in industry. Johan has built a number of expert companies in cybersecurity and advanced systems development since the late 90s. Patrik \"Paf\" FältströmPatrik \"Paf\" Fältström is Chief Security Officer at Netnod, a neutral and independent organization for internet infrastructure. Fältström is also a member of the Royal Swedish Academy of Engineering Sciences (IVA) and works part-time for the Swedish Armed Forces with cyber defense. Previously, he has been a technical internet expert in the government's IT policy security group, a member of the government's IT council and worked with human rights issues and international telecommunications policy at the UN. Karl-Erik SvedinKarl-Erik Svedin is Senior Security Advisor and Head of BCM at Tele2 in Sweden. In this role he also covers operational risks and total defense planning. Since the early 2000s, Mr. Svedin has worked in the Tele2 Group in the network and security domain. He represents Tele2 in external forums such as NTSG, FIDI-Telecom, Media Preparedness Council and GSMA Magnus BergströmMagnus Bergström is an IT and information security specialist at the Swedish Authority for Privacy Protection (IMY), where he makes assessments and provides guidance on appropriate security measures under data protection legislation. Mr. Bergström is also an expert in the government inquiry that will provide proposals on how the NIS2 and CER directives should be incorporated into Swedish law. Nicklas HaglundNicklas Haglund is the founder and CEO of the cybersecurity company Basalt, which publishes the annual Swedish Security Index report. Haglund has extensive experience as a technical consultant, IT architect, technical project manager and entrepreneur. Freddy Jönsson HanbergFreddy Jönsson Hanberg is chairman of the Total Defense Foundation, board member of the Civil Defense Association and strategic advisor to companies, authorities and politicians on issues related to total defense, security of supply and risk management. Mr. Jönsson Hanberg also has a direct assignment from NATO to lead a system analysis study on hybrid threats to renewable energy systems. Björn ErikssonBjörn Eriksson is a detective inspector and group leader of the Complex Cybercrime Division (KCB) at the Swedish Police Authority's National Operations Department (Noa). Eriksson has almost 20 years of experience within the Swedish Police Authority and currently works primarily with criminal investigations of cyber attacks against Swedish businesses. He has previously been an investigator of serious crimes and has a background in the private IT industry Andreas HeedAndreas Heed is Director Payment Law at Finansinspektionen. The legal department has a financial sector-wide responsibility for, among other things, supervision of IT risks and security protection, as well as coordination of the authority's assignment as responsible for the financial services of the contingency sector. Heed is responsible for issues related to the national and international financial infrastructure. Anders BrännströmAnders Brännström is a Major General, senior advisor in crisis preparedness and cyber security at the cyber security company Basalt. Anders Brännström is also a member of the Kungl. Krigsvetenskapsakademien (KKRVA) and has 40 years of experience from the Swedish Armed Forces, where he was, among other things, Army Commander. John BillowJohn Billow is Head of the Cybersecurity Certification Inspectorate (ICC) and the Cybersecurity and Certification Division at the Swedish Defense Materiel Administration (FMV), Sweden's national authority for cybersecurity certification under the EU Cybersecurity Act. Previously, Billow has been a legal advisor and police advisor at the Swedish UN representation in New York, focusing on peace and security work in the rule of law and cyber area, and worked with coordination and policy issues at Interpol's Cyber Directorate in Singapore. Hanna LinderstålHanna Linderstål is a security consultant, CEO and founder of the Earhart Business Protection Agency, which supports governments, organizations and the private sector with management advice on cyber threats, information security, digitalization and AI, as well as training on these issues. Mr Linderstål also co-chairs the Metaverse Cybersecurity Working Group of the International Telecommunication Union (ITU), the UN specialized agency for information and communication technologies. Åke HolmgrenÅke Holmgren is Head of the Cybersecurity and Secure Communications Division at the Swedish Civil Contingencies Agency (MSB). Holmgren is also a member of the Strategic Management Group of the National Cyber Security Center (NCSC) in Sweden, a member of the Supervisory Board of the Swedish Privacy Protection Authority (IMY) and a member of the Emergency Response Council of the Swedish Transmission Network Authority (SvK). Elin AhldénElin Ahldén is a communications consultant, founder of Lennox PR and an experienced moderator. She is an expert in crisis communication, strategic communication and corporate communications and has a focus on assignments in IT and infrastructure. How to get thereAll Omegapoints panel discussions take place at Takterassen, Hamngatan 5,Donnerska Huset in Visby For questions, please contact Johanna Jung, Lennox PR.",
        "post_type": "page",
        "meta_description": "Here you will find information about Omegapoint's participation at Almedalen.",
        "excerpt": "",
        "modified_at": "2026-08-25T11:02:11+00:00"
    },
    {
        "title": "Omegapoint in Almedalen",
        "url": "/en/almedalen/",
        "content": "Welcome to our panel discussion in AlmedalenBusiness Professionals Networking on a Rooftop Terrace During a Sunset Event with City Skyline ViewsCybersecurity as an enablerAs Northern Europe's leading tech company in secure digital innovation Omegapoint invites you to its own stage during Almedalen Week. On June 23, we will arrange three panel discussions focusing on how cybersecurity can go from being a brake to becoming an enabler for innovation, AI and societal development. We look forward to meeting you in Visby at Joda Bar, where through dialogue we can hopefully contribute to a safer Sweden. Welcome to read more about our conversations below. Program Tuesday, June 23From risk to progress: Cybersecurity as a catalyst for innovation 1:30 PM – 2:30 PM Participating panelists: Ewa Skoog Haslum, Head of the Armed Forces Operations Command Sandra Barouta Elvin, CSO, Microsoft Niclas Lamberg, IT Director, Swedish Transport Administration John Billow,Head of NCSC Daniel Deogun, CTAO and Partner, Omegapoint The conversation is moderated of Cissi Elwin Read more about the program here Add to your calendarAs AI accelerates – how do we secure trust? 3:00 PM – 4:00 PM Participating panelists: Jacob Henricson,CEO and co-founder Nørdsnipe Marcus Weiland,Vice President, Savantic Dan Bergh Johnsson, Head of AI and Partner, Omegapoint Niels Paarup-Petersen (C)Spokesperson for digitalization and cybersecurity Andreas Bergqvist,CSO, BankID The call is moderated by Cissi Elwin Read more about the program here Add to your calendarFrom paralysis to action – this is how we close the cybersecurity gap4:30 PM – 5:30 PM Participating panelists: Petra Klein,CSO, Swedbank Hanna LinderstålCEO Earhart and Safety Profile of the Year 2024 Johanna Parikka Altenstedt, Operations Manager for Cybernode, RISE Jonas Hasselberg, CEO, Omegapoint Per Olsson, Director Security, Bosch The call is moderated by Cissi Elwin Read more about the program here Add to your calendarOmegapoints VIP mingleSign up for our mingleWe invite you to a relaxed evening event about cybersecurity as an enabler of innovation, AI and societal development. Between 5:30 PM and 7:30 PM you will have the opportunity to mingle with colleagues in the industry and make valuable contacts. Please note that the mingle is very popular but unfortunately space is limited. We will confirm if you get a place. See you there! Sign up hereWelcome to themed breakfasts in Almedalen!Welcome to breakfast together with Omegapoint! We invite you to two themed breakfasts, on Wednesday and Thursday, June 24 and 25, respectively, at Villa Alma. Register via the links below. Please note that we have a limited number of places and our breakfasts are very popular. Once you have registered your interest on the link, we will return with a confirmation by email if you are offered a place. Wednesday 24/68:00 AM – 9:30 AMTheme: How can security-driven organizations grow when others slow down? A conversation about how proactive security work can lay the foundation for growth and competitiveness. And the realization that secure digital development is business-critical. LocationVilla Alma, Strandgatan 8, Visby Sign up hereThursday 25/608:00 – 09:30Theme: The new generation of AI is accelerating the pace of both society and organizations. Neither rigorous control nor productive chaos will work. Instead, trust between people, organizations, and technology itself will be crucial for both security and long-term growth. How should we govern and lead in this AI-driven world? How do we achieve responsible autonomy? LocationVilla Alma, Strandgatan 8, Visby Sign up herePresentation of our panelistsJacob Henricson Jacob Henricson is CEO and co-founder of Nørdsnipe. With a background as CISO at Ericsson and Skanska, and VP Services at deeptech company Foreseeti (sold to Google in 2022), he has deep experience in cybersecurity and the technology required going forward. Through the startup Nørdsnipe, Jacob focuses on creating tools for AI-assisted pentesting to meet the threats arising from new technology and a changing worldview. Petra KleinPetra Klein is Group Security Manager and Head of Group Security & Cyber Defence at Swedbank, with extensive experience in cybersecurity and socially critical IT. She has previously worked as an ethical hacker at FRA and with security solutions in both the Police and the financial sector. Petra is a valued speaker in cybersecurity, leadership and security culture, and also runs initiatives such as Swedbank Women in Tech to inspire more women to the tech industry. John BillowJohn Billow is the Director of the National Cyber Security Centre (NCSC) and has extensive experience in international security and cyber issues. He has previously worked at Interpol's Cybercrime Directorate in Singapore and has held several roles within the Swedish government, the EU and the UN with a focus on cybersecurity, security policy and international cooperation. He is a lawyer with a degree from Uppsala University. Dan Bergh JohnssonDan Bergh Johnsson is a well-known expert in secure system development and cybersecurity. He is one of the authors behind the report that AI Sweden and NCSC published in connection with the Mythos news and has dug deep into the available material. Dan is also co-author of the book Secure by Design and a valued international speaker in cybersecurity, AI and system design. Sandra Barouta ElvinSandra Barouta Elvin is the National Security Manager at Microsoft Sweden and has over two decades of experience in strategic and operational security work in both the public and private sectors. She is a driving force in raising awareness of cyber threats and strengthening organizations' ability to deal with them. Andreas BergqvistAndreas Bergqvist is Chief Security Officer (CSO) at BankID. In his role, he leads the company's efforts to protect one of Sweden's most critical digital infrastructures. Andreas has extensive experience in information and cybersecurity, including senior positions in Sweden's financial and telecom sectors. Johanna Parikka AltenstedtJohanna Parikka Altenstedt is the operations manager for Cybernoden – Sweden's national competence community for innovation and cybersecurity – at RISE, where she leads initiatives aimed at strengthening Sweden's cybersecurity capabilities through collaboration between academia, business and the public sector. Niclas Lamberg HR Director Swedish Transport AdministrationNiclas Lamberg Niclas Lamberg is IT Director at the Swedish Transport Administration and leads the agency's transformation with a focus on integrating AI and automation to improve infrastructure safety and efficiency. With extensive experience from both the public sector and business, he leads the work to implement digital solutions that strengthen the robustness of the transport system. Jonas Hasselberg Jonas Hasselberg is President and CEO of Omegapoint, which specializes in cybersecure digitization for business and society-critical operations. With a background from leading positions in Proact, TeliaCompany, Nokia and Microsoft, he has extensive international experience of driving development with a focus on security, trust and resilience. Daniel DeogunDaniel Deogun is Chief Technology & Academy Officer at Omegapoint and an internationally recognized expert in cybersecurity, secure system development and software architecture. He is the co-author of the book Secure by Design and has over 20 years of experience building secure digital solutions. Daniel is a sought-after speaker who combines deep technical expertise with an engaging and educational way of explaining how security can become a natural part of modern system development. Marcus WeilandMarcus Weiland is the Vice President of AI company Savantic and a respected figure in artificial intelligence, digital transformation and business development. He works to help organizations translate AI from vision to concrete business value, especially in industry, energy and social development. Marcus is also the founder of the podcast En AI till Kaffet and has been named AI Inspirator of the Year for his work in making AI understandable, practical and relevant to more businesses. Cissi ElwinCissi Elwin is a journalist, presenter and experienced moderator with a long career in media, leadership and communication. She has been CEO of the Swedish Film Institute, editor-in-chief of the magazine Chef and CEO of the Chefakademin. With her warmth, sharpness and extensive stage experience, she leads conversations with both energy and confidence – always with a focus on creating engaging and relevant discussions. Niels Paarup-PetersenNiels Paarup-Petersen is a member of parliament for the Centre Party and a prominent voice in digitalization, cybersecurity and technology policy. With a background as an entrepreneur and a strong commitment to innovation and democracy, he works to strengthen Sweden's competitiveness and digital resilience. Niels is a sought-after speaker who combines political perspectives with practical insights into the role of technology in societal development. Hanna LinderstålHanna Linderstål has over 25 years of experience in cybersecurity. She is a strategist with extensive expertise in advising governments, agencies and companies worldwide. Hanna's knowledge spans areas such as hybrid warfare, immersive AI, cyber threats and analytics, making her an authority on the rapidly changing digital threat landscape. In 2024, she was named Swedish Security Profile of the Year. Ewa Skoog HaslumEwa Skoog Haslum is the Chief of the Swedish Armed Forces' Operations Command. She was previously the Chief of the Navy and became the first woman in Sweden to reach the rank of Admiral. With extensive experience in security issues, leadership and international defence cooperation, she is a valued speaker on total defence, geopolitics and Sweden's security in a changing world. Par OlssonPär Olsson is Director of Security & Hardware Development at Bosch and has over 20 years of experience in software development, cybersecurity and technical innovation. With a background from Ericsson and Sony Mobile, he currently leads teams that develop secure and connected products for future mobility and IoT solutions. Pär is a sought-after speaker in cybersecurity, AI and secure product development, with a particular focus on how security can be integrated as a natural part of innovation and business development. How to get thereAll panel discussions take place in the courtyard of Joda Bar and Kitchen, Skeppsbron 24, Visby For questions, please contact Elin Agorelius, Lennox PR.",
        "post_type": "page",
        "meta_description": "Here you will find information about Omegapoint's participation at Almedalen.",
        "excerpt": "",
        "modified_at": "2026-08-25T11:01:52+00:00"
    },
    {
        "title": "Group management",
        "url": "/en/group-management/",
        "content": "Group managementHere you can find information about our Group Management Meet our senior management teamJonas HasselbergChief Executive Officer / CCOjonas.hasselberg@omegapoint.sePeter De VerdierCFOpeter.deverdier@omegapoint.seAnna-Clara SöderbaumCEO Swedenanna-clara.soderbaum@omegapoint.seWilhelm Hedman-DybeckCEO Stockholmwilhelm.hedman-dybeck@omegapoint.seAnna StormCEO Gothenburganna.storm@omegapoint.seFredrik LundbeckCEO Malmöfredrik.lundbeck@omegapoint.sePatrik LannergårdCEO Uppsalapatrik.lannergard@omegapoint.seDouglas IngmanCEO Örebrodouglas.ingman@omegapoint.seNicklas HaglundCEO Basaltnicklas.haglund@basalt.seHow can we help you?Contact usJob vacancies",
        "post_type": "page",
        "meta_description": "Here you will find information about our group management.",
        "excerpt": "",
        "modified_at": "2026-08-25T11:00:12+00:00"
    },
    {
        "title": "Events",
        "url": "/en/event/",
        "content": "EventThere’s always something happening at Omegapoint. Explore our upcoming seminars, webinars, and industry events, both those we host and those we take part in. Current eventsLocationAllGothenburg, SwedenMalmöonlineÖrebroStockholmUmeåVisbyType of eventAllEventExternal eventMasterclassSeminaryWebinarSee previous events12 november 202608:00 - 17:00Radar Summit 2026At Radar Summit, you will get the tools, analysis and network that will help you build resilience and digital independence in a turbulent world, optimize your IT budget with FinOps and new exit strategies, and transform R&D into business value through AI, quantum and green tech.Stockholm=\",\"type\":\"DATE\"}],\"no_results_template\":\"4466\",\"post_status\":\"publish\",\"paged\":1,\"posts_per_page\":\"10\"}\" data-original-query-vars=\"[]\" data-page=\"1\" data-max-pages=\"1\" data-start=\"1\" data-end=\"1\">",
        "post_type": "page",
        "meta_description": "Here you can see our events, lectures and seminars that we hold online and around the country.",
        "excerpt": "",
        "modified_at": "2026-08-25T10:57:58+00:00"
    },
    {
        "title": "Energy Fair 2025",
        "url": "/en/energy-fair-2025/",
        "content": "21-22 MAY 2025 Come and meet us at Energy Fair 2025 The Energy Fair 2025 is the obvious arena for innovation, collaboration and business. Whether you are leading, developing or implementing energy solutions, this is the meeting place where you take the next step. Omegapoint will talk about digitized security protection and welcomes you to stand D:42. Listen to our presentations:Digitization of security-sensitive and critical information.WEDNESDAY MAY 21 AT 09.30 - 10.15 Accessibility and security are often two opposites. Locking your computer with classified information in the safe may meet compliance, but accessibility will be very limited. What do you do when you need to collaborate with others on security-protected data in different geographical locations? And how do you ensure that shortcuts do not occur so that your employees can easily maintain security? Building a solution to protect the security of digital systems is one of the most difficult things you can do. Yet we have done just that. Welcome and let me tell you how. Nils Ågren, Business Manager Craton, OmegapointMats Balkö, Head of Development and Sustainability at Varberg EnergiThe energy system and the challenge of energy companies in hybrid warfareTHURSDAY MAY 22, 10.15 - 10.45 The electricity grid and energy companies are at the center of hybrid warfare attacks. The energy system we have today consists of both physical electricity grids and virtual 'electricity grids' in the form of Virtual Power Plants. It also includes new energy resources such as grid batteries, home batteries and charging points. Based on experiences from the attack on Ukraine's power grid and a simulated attack on Varberg Energi, we describe the opportunities and challenges of the Virtual Power Plant. Fredrik Sandström, Senior Security Consultant, BasaltYou can find us at booth D:42 together with our experts in cybersecure digitizationCome and meet our security experts: Stefan Reinebo, Business Manager Energy Nils Ågren, Business Manager Craton Fredrik Sandström, Senior Security Consultant Larry Björkqvist, Senior Business Advisor Jonas Rehn, Senior Business Advisor Magnus Ahlgren, KAM Tim Sönderskov, Business Manager Consulting Get your free trade show ticket or buy a half-price conference ticket with our exclusive link. Get your ticketCraton™ - proven solution for security protection in digital systemsCraton is the first and only product of its kind on the market that allows you to digitize your security-sensitive operations while complying with the Security Protection Act. Article series - Defense in depth - Building secure systemsDigitization is moving fast and too often security is a lower priority. This series of articles is about development and getting it right from the start Ciso - Helping you manage risk and information securityCiso is a tool that helps you manage digital business risks and information security. With all information in one place, your organization's work can be properly structured. Reko - Simpler safety testsOur Reko product makes the security clearance process safer, easier and more efficient. Please contact us below to find out more about how it can support you and make your business easier.",
        "post_type": "page",
        "meta_description": "Omegapoint is participating in the Energy Fair. Meet us there!",
        "excerpt": "",
        "modified_at": "2026-08-25T10:57:28+00:00"
    },
    {
        "title": "Document",
        "url": "/en/document-listing/",
        "content": "DocumentHere you will find documents and files that may be relevant to you as a customer at Omegapoint. All collected in one place for easy access and download. Our documentsHere we collect all of Omegapoint's downloadable documents in one place. Explore reports, manuals and other files. AllHandbooksWhitepapersReportsAnnual accountsThe bank bookThe Bank Book provides a comprehensive overview of the challenges and opportunities in the industry. It demonstrates how proactive cybersecurity, strategic governance, and well-integrated regulatory compliance can become drivers of innovation, trust, and long-term competitiveness. Annual Report 2025Annual Report 2025 in Swedish Annual report 2025Annual report 2025 in English Energy bookThe Energy Book is a handbook that aims to provide practical and clear guidance on how energy companies can strengthen their cybersecurity and protect their operations from cyber attacks. Insurance bookThe insurance book provides a comprehensive picture of the challenges and opportunities in the industry. It shows how proactive cybersecurity, strategic governance and well-integrated regulatory compliance can become a driver of innovation, trust and long-term competitiveness. Swedish Safety Index 2026The Swedish Security Index is our annual report where we measure the current threat landscape for decision-makers in critical operations. Swedish Safety Index 2025The Swedish Security Index is our annual report where we measure the current threat landscape for decision-makers in critical operations. Swedish Safety Index 2024The Swedish Security Index is our annual report where we measure the current threat landscape for decision-makers in critical operations. Swedish Safety Index 2023The Swedish Security Index is our annual report where we measure the current threat landscape for decision-makers in critical operations. 1 2 3 → The life science bookThe life science book is a handbook that aims to provide practical and clear guidance on how life science companies can strengthen their cybersecurity and protect their operations from cyber attacks. Insurance bookThe insurance book provides a comprehensive picture of the challenges and opportunities in the industry. It shows how proactive cybersecurity, strategic governance and well-integrated regulatory compliance can become a driver of innovation, trust and long-term competitiveness. The bank bookThe Bank Book provides a comprehensive overview of the challenges and opportunities in the industry. It demonstrates how proactive cybersecurity, strategic governance, and well-integrated regulatory compliance can become drivers of innovation, trust, and long-term competitiveness. Energy bookThe Energy Book is a handbook that aims to provide practical and clear guidance on how energy companies can strengthen their cybersecurity and protect their operations from cyber attacks. Agentic AIHow to ensure robust cybersecurity, operational resilience and regulatory compliance as you race to transform your business with agentic AI. Swedish Safety Index 2023The Swedish Security Index is our annual report where we measure the current threat landscape for decision-makers in critical operations. Swedish Safety Index 2024The Swedish Security Index is our annual report where we measure the current threat landscape for decision-makers in critical operations. Swedish Safety Index 2025The Swedish Security Index is our annual report where we measure the current threat landscape for decision-makers in critical operations. Swedish Safety Index 2026The Swedish Security Index is our annual report where we measure the current threat landscape for decision-makers in critical operations. Annual report 2025Annual report 2025 in English Annual Report 2025Annual Report 2025 in Swedish Annual Report 2010-2011Annual Report 2010-2011 Annual Report 2011-2012Annual report 2011-2012 in Swedish Annual Report 2013-2014Annual report 2013-2014 in Swedish Annual report 2015Annual Report 2015 in Swedish Annual report 2016Annual Report 2016 in Swedish Annual report 2017Annual Report 2017 in Swedish Annual report 2018Annual Report 2018 in Swedish Annual report 2019Annual Report 2019 in Swedish Annual report 2020Annual report 202 in Swedish Annual report 2021Annual Report 2021 in Swedish Annual report 2022Annual report 2022 in English Annual Report 2022Annual Report 2022 in Swedish Annual report 2023Annual report 2023 in English Annual report 2023Annual Report 2023 in Swedish Annual report 2024Annual report 2024 in English Annual report 2024Annual Report 2024 in Swedish",
        "post_type": "page",
        "meta_description": "Here you will find documents and files that may be relevant to you. All collected in one place for easy access and download.",
        "excerpt": "",
        "modified_at": "2026-08-25T10:56:13+00:00"
    },
    {
        "title": "Cookie policy",
        "url": "/en/cookie-policy/",
        "content": "Cookie policyBelow is a description of how AB Omegapoint, with organization number 559312-6120, ('us', 'we' or 'our'), uses cookies and any other similar technologies that collect information about visits to and use of our website www.omegapoint.se and related pages, (hereinafter collectively referred to as the \"Website\").",
        "post_type": "page",
        "meta_description": "How Omegapoint uses cookies and other similar technologies that collect information about visits to and use of our website.",
        "excerpt": "",
        "modified_at": "2026-08-25T10:52:12+00:00"
    },
    {
        "title": "Platform & architecture",
        "url": "/en/commerce/platform-architecture/",
        "content": "Commerce Safe change begins in architectureMany e-commerce initiatives fail not on ambition but on basic structure. With the right platform and architecture, you can scale, integrate, and evolve without each step becoming more expensive and risky. Change begins below the surfaceAn e-commerce platform should make it easier to change. Yet many organizations find themselves in a situation where every new feature, channel, or integration becomes expensive, slow, and risky. Often it’s not that the platform is “wrong.” It’s that the architecture, principles, and responsibilities aren’t clear enough to protect pace and control over time. The right platform and the right architecture create secure growth.You can deliver faster without building in new risks. Build for pace – not just functionTechnical lock-in rarely happens overnight. It develops when you: solves new needs with special adaptations that only a few can maintain builds tightly coupled integrations where multiple systems must be changed simultaneously lacks clear contracts for data and APIs puts safety and operational requirements before themselves until they become urgent The consequence is that the roadmap begins to be governed by limitations.“We can’t” replaces “this will have the most business impact.”. Pace becomes a matter of risk instead of a matter of priority. When architecture doesn't protect change, it starts to control the business.Behind every simple solution is a clear architectureWhat appears simple in business is often the result of many conscious technical choices. Architecture determines how systems interact, how data moves, and how change can occur without creating new risks. When architecture, principles and responsibilities are clear, complexity can be managed in a structured way – without it spilling over into the organization or slowing down the business. This means that: systems have clear roles and responsibilities data is owned, shared and changed in a controlled manner integrations are traceable and possible to further develop change can happen gradually, without risking the whole API-first and integration securityIn modern e-commerce, integrations are often the most business-critical. Orders, inventory, customer data, prices, and payments move between many systems – and every connection is a potential risk. When the architecture is based on clear API contracts and common principles, change becomes predictable. New features can be added without breaking existing flows, and the consequences of change can be assessed in advance. This means that: data has clear owners and defined sources of truth APIs are versioned and changed in a controlled manner integrations are traceable, monitored and debuggable security and authorization follow the entire flow When integrations are treated as a product, they become a strength, not a vulnerability. Safety is built into the architecture – so that change can occur without increasing risk.Composable & headless when flexibility is the right choiceComposable and headless architecture makes it possible to change parts of the solution without having to touch the entire platform. Experience, business logic and data can develop at different rates, with clear interfaces between them. It provides flexibility and pace, but also places higher demands on responsibility, governance and working methods. Therefore, it is an architectural choice that must support the needs of the business – not become an end in itself. Secure-by-design in architecture choicesSecurity is often an afterthought when the solution is already in place. The result is more controls, more friction, and slower pace. Secure-by-design is about the opposite: making the right decisions early on so that security becomes a natural part of the delivery capability. When security is built into the architecture from the start, both the business and the pace of change are protected. Risks can be managed before they become acute, and new features can be launched with greater predictability. Security built in early costs less and protects more. How we help youWe help you develop a requirements picture that is realistic – and translate it into architecture choices, priorities and a roadmap that can be implemented. Typical efforts: analysis of current situation: platform, integrations, data flows, operations and risk architecture goals and guiding principles decision support for platform and supplier selection, linked to business impact Implementation and management plan – how you deliver with control over time A good first step is to map out 3–5 business-critical flows, such as orders, inventory, pricing, customer and product data. Assess them based on pace, risk and traceability. It quickly becomes clear: Where do you gain the most from change? what must be taken in the correct order Do you want to know where you stand?We would like to start with a joint examination. Jens OdeBusiness Manager Commercejens.ode@omegapoint.seContact us",
        "post_type": "page",
        "meta_description": "We help you select, design and further develop e-commerce platforms and architecture that support change, scalability and control over time.",
        "excerpt": "",
        "modified_at": "2026-08-25T10:51:25+00:00"
    },
    {
        "title": "PIM",
        "url": "/en/commerce/pim/",
        "content": "Commerce Secure product data throughout the chainProduct information is more than content. It is the foundation for flows, decisions and trust from supplier to end customer. Product data that lastsWhen product data works, it's barely noticeable. Flows are connected, information is collected, and changes are made with control. When it doesn't, uncertainty arises. Additional work, manual corrections and errors that have to be caught in retrospect, often far from where they occurred. Secure product data is not built from more information, but from the right structure from the start. A foundation that holds up even when the range, markets and requirements change. PIM creates order in complexityAs product ranges grow, markets expand, and requirements increase, product data quickly becomes difficult to keep together. Information is spread across systems, files, and people, and what was once clear becomes difficult to understand. PIM collects product information in a common structure.Not to collect more data, but to create clarity: what is right, what applies and where the responsibility lies. When order is in place, product data becomes something you can trust even when reality changes. Secure product data starts with order. That's where we start.GS1 - a common language for product dataGS1 standards make product data comparable, machine-readable and automatable. The aim is simple: to ensure that the same product can be understood in the same way regardless of the recipient. In practice, it is about:unique identities for products and packaging levels clear definitions of attributes such as dimensions, weight and content a consistent way to share product data between parties When everyone interprets data in the same way, the risk of errors is reduced and trust can also be built between organizations. PIM as the basis for GS1GS1 describes how product data should be structured and shared. PIM is what makes the structure actually maintainable in everyday life. In practice, PIM is often the engine behind GS1 work. It is where product information is collected, quality assured and managed over time – not just for a launch or a single flow. This includes, among other things: model products and packaging hierarchies to reflect reality ensure data quality with rules and validation that catch errors early create clear workflows for enrichment, review, and approval build traceability: where the data comes from, who changed what and when When PIM and GS1 are linked, the standard does not become a separate requirement, but a natural part of how product data is managed. This is when security remains even when product ranges, markets and systems change. GS1 only works when the product data is in order.Common challenges in practiceWhen product data is to function throughout the chain, challenges often arise that are not due to a lack of ambition but to complexity that has developed over time. This concerns, for example: packaging levels and relationships that are not connected critical information that requires constant updating, such as ingredients and allergens different requirements per channel or market leading to parallel versions of the same product data Each of these may seem manageable. Together they create uncertainty, extra work, and a daily life where it is difficult to know what information actually applies. When the foundation doesn't holdWhen product data is lacking, it is rarely noticed directly in a system – but rather in the business. Time is spent correcting, supplementing and double-checking. Launches take longer and each change poses a new risk. The consequences are often: increasing manual labor and difficulty in scaling longer lead times when launching new products or markets increased risk of errors in logistics, listing and customer information reduced trust internally and externally What is missing is rarely more information. What is missing is a foundation that holds up, even when demands increase. How we help youWe help organizations with complex product ranges create order in product data from structure and working methods to system support and interaction between parties. With experience from trade, suppliers and e-commerce, we know where there are often shortcomings, and what is required to make PIM and standards like GS1 work in practice. The focus is always on what makes a difference in everyday life: a data model that reflects assortment and packaging hierarchies governance and workflows that make data quality sustainable over time integrations and flows that are robust, traceable and easy to manage We often start with a limited scope: a product group, a flow or a market.By mapping the current situation, identifying gaps and prioritizing the right initiatives, we create rapid impact and a foundation that can be built on. Jens OdeBusiness Manager Commercejens.ode@omegapoint.seContact us",
        "post_type": "page",
        "meta_description": "We offer support throughout the product data chain and help you create order, quality and control in your product information from source to channel.",
        "excerpt": "",
        "modified_at": "2026-08-25T10:51:04+00:00"
    },
    {
        "title": "Customer experience",
        "url": "/en/commerce/customer-experience-2/",
        "content": "Commerce Safer customer experienceIn e-commerce, the experience is more than an interface. It is a promise. That the customer can find the right product, understand the terms and conditions, and complete the purchase without unnecessary friction. Trust is built in the experienceIn e-commerce, the experience is more than just an interface, it's how the store actually works. It's the interplay between design, structure and technology that creates conversion. UX/UI is not decoration. It is the logic behind how the customer finds the right one, understands the terms and conditions and dares to make the purchase. When the experience is clear, fast and consistent, trust is built. UX work begins long before implementation: in analysis, structure, and tested prototypes that ensure the solution works in real customer scenarios. Simplicity that feels – and lastsA good experience feels simple – but is rarely simplified. It guides, explains and creates security without being burdensome. This means that: unnecessary complexity is stripped away clarity and transparency are strengthened safety aspects are integrated into the flow, not added on top When the experience is thought out in every detail, a sense of control arises. And that's where trust begins. Safer e-commerce is not something you add. It is something you build from the ground up.Behind every simple experience is thoughtful designA strong experience is not determined by how it looks, but by how it works. It is shaped by how everything is connected, how information is presented, how steps follow each other, and how the user is guided through without hesitation. Good UX is about understanding what the user is trying to do – and making it easy to succeed. This means that: the right information is in the right place the next step feels obvious uncertainty is caught before it becomes an obstacle complexity is handled without being hidden Security is built on what is done right from the startThis work needs to be done before the solution is actually built. When the structure is well thought out and tested, the implementation becomes more stable – and changes are less risky. When design decisions are based on real behavior and actual usage, the experience doesn't just look good. It's reliable, scalable, and can be improved over time.And that's where safer e-commerce begins. Not in what's added on top – but in what's built right from the start. What feels easy and safe starts below the surface.B2B and B2C have different requirementsIn B2B, the customer journey is often longer, with more steps involved and more roles involved — which places demands on UX/UI such as: handles complex information without losing the user's attention offers clear roles and the right access in the design visualizes conditions, pricing logic and flows without chaos In B2C, simplicity, speed, and expectations are often the driving forces — making micro-connections between UI details and conversion pipelines crucial. UX/UI becomes the tool that simplifies complex decisions and drives business goals rather than just looking pretty. AI in the experienceAI can enhance the experience. But only when it is used on the user's terms. When recommendations, personalization, and automation are clearly integrated into UX, they are experienced as support, not influence. This means that: recommendations are placed where they actually help decisions it is clear why something is shown the user can understand and influence their own experience When AI creates relevance without taking away control from the user, both conversion and trust are strengthened.It is crucial for safer e-commerce – even as technology becomes more advanced. How we help youWe see UX and UI as part of the business, not as a layer on top of technology. That's why we work with the experience from analysis to management, with a focus on measurable impact and long-term stability. We help you with: user insights and customer journeys that show where conversion is lost and trust is built design that makes complexity understandable and the right information visible in the right place implementation that makes the experience testable, measurable and possible to improve over time integrated risk and safety flows that feel natural – not tacked on A good first step is to analyze a critical part of the customer journey – such as search, product, shopping cart or checkout – from three perspectives: experience, business impact and risk. This provides a clear path forward towards safer, more sustainable e-commerce. Jens OdeBusiness Manager Commercejens.ode@omegapoint.seContact us",
        "post_type": "page",
        "meta_description": "We work with design and structure to create customer experiences that are consistent, useful and trust-building across all digital channels.",
        "excerpt": "",
        "modified_at": "2026-08-25T10:50:33+00:00"
    },
    {
        "title": "Digital Strategy",
        "url": "/en/commerce/digital-strategy/",
        "content": "Commerce Digital commerce strategyThe right order provides control. A sustainable strategy creates clear priorities, reduces risk and makes it possible to grow without complexity taking over. Strategy before platformDigital commerce rarely loses momentum due to a lack of ambition.It loses momentum when decisions are made in the wrong order. When the platform is chosen first and strategy, processes, data and security are solved afterwards, complexity is built in from the start. This leads to rework, increased costs and a roadmap that doesn’t hold up as the business grows. A sustainable digital commerce strategy doesn't just provide more visions. It provides direction, priorities, and control so you can grow without increasing risk and complexity with each new venture. From direction to implementationWhen the strategy is clear, it becomes easier to make the right decisions even when needs change. You get a common foundation that makes business, technology and working methods pull in the same direction. This often means that you can: Prioritize initiatives based on business impact, not internal demand develop new channels and functions reduce dependencies between systems and teams make faster decisions with better decision-making data The result is digital trading that can be developed step by step with control over both pace and risk. Strategy is not about choosing a solution.It's about choosing order.Strategy that keeps changingStrategy is about creating room for action, not about locking in a plan. When the direction is clear, it becomes possible to make consistent decisions even when conditions change. A sustainable strategy gives you a common framework for prioritizing. It makes it clear what is important, what can wait, and what should be avoided, whether it concerns new initiatives, platforms, or ways of working. When the strategy is clear, structure, architecture and technology can take shape in the right way to support the business, not as a governing force. Digital commerce strategy in practiceDigital retail strategy is about more than just management choices. It affects how quickly you can launch new product lines, how easily you can enter new channels, and how well customer experience, data, and technology connect in your everyday life. When the strategy is clear for e-commerce, it becomes possible to make consistent decisions even when needs change – without every initiative requiring a re-do. In practice, this means that you can: develop and change the customer journey without disrupting existing flows launch new channels and markets without increasing complexity uncontrollably keep assortment, content and data together across system boundaries Prioritize development based on business impact and customer value Digital commerce strategy thus creates room for action where business, customer experience and technology move in the same direction. In digital trading, strategy is not a plan. It's the ability to make the right decisions - over and over again.Strategy that creates secure growthIn digital commerce, change is happening all the time. New requirements, new channels and new expectations mean that the strategy must hold up even when conditions change. A well-thought-out digital commerce strategy creates security by enabling change without risk and complexity taking over. It gives you control over how business, customer experience, data and technology evolve together. It is this security that makes strategy a tool for growth, not an obstacle to change. How we help youWe help you make digital commerce strategy practical.The focus is not on more plans, but on creating clarity in the decisions that control pace, risk and development over time. Together with you, we work to: create a common picture of the current situation – business, e-commerce, data and technology clarify which choices actually matter for your continued development Prioritize initiatives based on business impact and feasibility ensure that strategy, customer experience and technology are pulling in the same direction The result is a clearer direction for your digital commerce – and better conditions for development without complexity and risk taking over. Jens OdeBusiness Manager Commercejens.ode@omegapoint.seContact us",
        "post_type": "page",
        "meta_description": "We offer strategic advice that helps you make informed decisions and build a sustainable foundation for long-term development.",
        "excerpt": "",
        "modified_at": "2026-08-25T10:50:06+00:00"
    },
    {
        "title": "Data, insights & AI",
        "url": "/en/commerce/data-insights-ai/",
        "content": "Commerce Data, insights and AI We help you go from measurement to decision, and from insight to impact. With structured optimization, and AI as support, not shortcuts. Trust is built in decisionsGrowth in e-commerce is rarely a matter of more ideas. It's about making the right decisions – more often, faster, and with less risk. When data is reliable and insights can be translated into action, optimization becomes part of everyday life. Then small improvements in the customer journey, assortment and flows can have a measurable effect over time. Here, data and AI are about decision quality. About clear signals, controlled analysis and a way of working where growth is built in a structured way with respect for integrity and security from the ground up. Secure growth is built from the ground upData does not create value by itself. It is only when measurement, analysis and working methods are connected that insights become decisions, and decisions become impact. A sustainable growth model is built on trusting the numbers, understanding what actually affects the business, and daring to make decisions without guessing. Then optimization becomes something that happens continuously, not in exceptions. This is also where security comes in. When structure, quality and responsibility are in place, you can move faster – without losing control of business, technology or integrity. Growth is less about more ideas, more about better decisions.Growth optimization as a continuous effortSustainable growth rarely comes from individual initiatives. It is built through ongoing work where hypotheses are tested, effects are measured, and learning is implemented in the next step. When optimization becomes a rhythm rather than a one-off effort, the reliance on large releases is reduced. Instead, a way of working is created where improvements happen more frequently, with lower risk and a clearer connection to business goals. The foundation is simple but requires discipline: clear priorities, reliable measurement, and short feedback loops between insight and change. That's how growth becomes both measurable and secure. Measurement as decision supportMeasurement only has value if it helps you prioritize correctly. Not when it reports everything – but when it makes it clear what actually affects the business. To make confident decisions, you often need to understand the interaction between multiple perspectives, rather than optimizing individual KPIs in isolation. For example, it is about being able to see: Where in the customer journey are you losing customers – and why? how assortment and product information affect clicks, purchases and returns what effect performance and stability have on revenue which differences between channels and markets are real, and which are due to measurement errors The foundation is always the same: consistent definitions and traceability all the way. Without it, analysis becomes uncertain – and decisions unnecessarily risky. It's not the amount of data that matters, but what you do with it.AI in analysis and discoveryAI can be a powerful tool when the amount of data is growing and time for analysis is limited. Used correctly, it helps you see patterns faster and focus on what actually impacts the business. This may involve: identify behavioral patterns and segments in customer data detect friction in search, navigation, and interrupted flows flag deviations in KPIs, traffic or order patterns support prioritization by weighing effect, cost and risk But the value doesn't come from automation itself. It comes from using AI within clear boundaries, with known data sources and human review before decisions are made. Safe AI is not the fastest possible AI, but AI that can be trusted. Privacy by designHow you manage data affects more than compliance. It affects pace, collaboration, and trust both internally and externally. When privacy-by-design is built in from the start, it becomes easier to: make decisions without uncertainty about what is permitted build personalization that feels relevant, not intrusive adapt when requirements, technology or business change In practice, it is often a matter of collecting less but more relevant data, having clear purposes, and building access control and traceability as a natural part of the solution. What creates security below the surface makes it possible to move faster above. How we help youWe help organizations use data, insights and AI to drive growth in a way that can be trusted – from measurement and analysis to working methods and decision support. With experience from e-commerce, growth optimization and data-driven teams, we know where there are often shortcomings, and what is required for insights to actually lead to decisions and business impact. The focus is always on what makes a difference in everyday life: measurement and definitions that can be relied upon over time working methods for prioritization, experimentation and follow-up analysis and AI support that provides clear signals, not more noise Privacy-by-design structure that creates security in development We often start with a defined goal: a KPI, a flow or a part of the customer journey.By mapping the current situation, identifying gaps and prioritizing the right initiatives, we create rapid impact – and a foundation that can be built on. Jens OdeBusiness Manager Commercejens.ode@omegapoint.seContact us",
        "post_type": "page",
        "meta_description": "We help you collect, structure and use data including AI-based solutions for better decisions, more efficient working methods and sustainable growth.",
        "excerpt": "",
        "modified_at": "2026-08-25T10:49:34+00:00"
    },
    {
        "title": "Investor Relations",
        "url": "/en/investor-relations/",
        "content": "Investor relationsHere you will find annual reports describing our financial results and future outlook, helping you understand our long term growth and development. 530+Active customers950+Experts20+Years of experience1600+Customer projectsAB OmegapointOmegapoint was founded in 2001 and is Northern Europe's leading tech company in secure digital innovation. Together with our customers, we build digital businesses that are resilient from the ground up. The company is growing rapidly and currently has over 900 employees in Stockholm, Gothenburg, Malmö, Uppsala, Örebro, Enköping, Västerås and Umeå. Omegapoint is partly owned by employees and partly by FSN Capital. Highlights of the yearPress2026-10-20Omegapoint contributes expert competence to national effort against AI-driven cyber threatsThrough AI and security expert Dan Bergh Johnsson, Omegapoint has an active role in a national gathering of forces where authorities, business and research collaborate to strengthen Sweden's cybersecurity. The work has already...BlogCropped shot of an unrecognizable businessmans silhouette against a glass wall in his office.2026-10-19The antidote to shadow AI is not a tighter policyEmployees installing or using software on their own initiative, often called shadow IT, in violation of IT department instructions, is an old problem. In an era when AI development is accelerating,...Blog2026-10-14What happens to security when AI starts acting on its own?AI has in a short time gone from being for many just a tool we ask questions to, to advanced systems that can perform tasks for us. The next step is...Annual accountsAnnual Report 2025Annual Report 2025 - SwedishAnnual Report 2025 - EnglishAnnual report 2024Annual Report 2024 - SwedishAnnual Report 2024 - EnglishAnnual report 2023Annual Report 2023 - SwedishAnnual Report 2023 - EnglishAnnual Report 2022Annual Report 2022 - SwedishAnnual Report 2022 - EnglishAnnual report 2021Annual Report 2021 - SwedishAnnual report 2020Annual Report 2020 - SwedishAnnual report 2019Annual Report 2019 - SwedishAnnual report 2018Annual Report 2018 - SwedishAnnual report 2017Annual Report 2017 - SwedishAnnual report 2016Annual Report 2016 - SwedishAnnual report 2015Annual Report 2015 - SwedishAnnual report 2014-2015Annual Report 2014-2015 - SwedishAnnual Report 2013-2014Annual Report 2013-2014 - SwedishAnnual Report 2012-2013Annual Report 2012-2013 - SwedishAnnual Report 2011-2012Annual Report 2011-2012 - SwedishAnnual Report 2010-2011Annual Report 2010-2011 - SwedishPeter de VerdierCFO and Head of Investor Relationspeter.deverdier@omegapoint.seContact us",
        "post_type": "page",
        "meta_description": "Here you will find annual reports that describe our financial performance and our future prospects.",
        "excerpt": "",
        "modified_at": "2026-08-24T10:32:45+00:00"
    },
    {
        "title": "Digital sovereignty, buzzword or strategic decision?",
        "url": "/en/articles/digital-sovereignty/",
        "content": "European companies and organizations are deeply dependent on US cloud platforms such as Azure, AWS, and GCP. For a long time, this was seen as a straightforward choice: a high level of innovation, rapid scalability, and a mature service portfolio. However, geopolitical developments in recent years have changed the landscape. Since 2018, the US CLOUD Acthas allowed US authorities to require American cloud providers to disclose data, regardless of where that data is stored. This could conflict with GDPR and the EU's view on individual privacy. At the same time, US foreign policy priorities have shifted. This means that European businesses can no longer assume that American interests always coincide with European ones. For organizations that handle sensitive data, such as personal data, this is a strategic risk, not a technical detail. Many US cloud providers now offer European data centers and promise that customer data will be stored within the EU. It’s a step in the right direction – but not a guarantee. Data residency is about where data is stored. Data sovereignty is about who has the right to access it. The CLOUD Act means that US companies must be able to disclose data even if it is located in Frankfurt, Dublin or Stockholm. It is therefore important not to confuse geographical storage with legal protection. The real challenge: lock-in and dependencies The American cloud services offer a very mature ecosystem of services and tools. This makes them attractive – but also difficult to leave. Many organizations find that migrating away from these platforms is: costly time-consuming organizationally difficult to justify This creates a lock-in effect which means that businesses risk losing control over both costs and freedom of action. Three risks everyone should take seriouslyr1. Data protection riskThe most obvious. Sensitive data may be subject to US jurisdiction even if stored in the EU. For some businesses, this is an unacceptable risk for two reasons: regulatory compliance, such as GDPR, and the protection of business-critical information, intellectual property, or other data that may be of interest from an intelligence or national security perspective. 2. The risk of lock-inThe more an organization relies on proprietary services, the more difficult it becomes to respond when circumstances change, including geopolitics, supplier business models, and regulatory requirements. 3. Cost riskCloud services can provide significant efficiency gains, but they also create financial dependencies. The more difficult it is to move a service, the less flexibility an organization has if prices, terms, or business needs change. The strategic choice Staying in US cloud services may be the right decision. Leaving them may also be the right decision. But it must not be a casual decision. Organizations that handle sensitive data need to conduct a structured risk assessment and weigh: Legal risks Business-critical dependencies Cost development Technical flexibility The options are also not limited to American hyperscalers or on-prem solutions. European cloud providers have matured significantly in recent years and now offer everything from virtual servers to container platforms and managed services. For many organizations, they can therefore be a reasonable alternative.At the same time, increased control often means greater responsibility. Functions such as identity management, logging, monitoring, backup, and high availability must be built and managed by the business to a greater extent. Infrastructure deployment and automation can also be more time-consuming because tool support, integrations, and IaC modules are often less mature outside the major US cloud provider ecosystems.Conclusions – what everyone can do today Do a risk assessmentThe decision to use US cloud services must be based on legal, business and security considerations. Build for portabilityBuild systems modularly and avoid tight coupling to proprietary services. Use open standards where possible and abstract critical components such as databases, identity services and integration layers. This increases freedom of action in the long run. Automate operations and maintenanceAutomation reduces costs, increases robustness and makes it easier to move systems when needed.These three steps are not controversial and there are established tools and processes to manage them. Digital sovereignty is not just about where systems run today, but about how easily organizations can adapt to a constantly changing environment.",
        "post_type": "post",
        "meta_description": "What does digital sovereignty mean? Read about the CLOUD Act, cloud dependencies, and how organizations can strengthen control over their data and technology.",
        "excerpt": "Europeiska företag och organisationer är idag djupt beroende av amerikanska molnplattformar som Azure, AWS och GCP. Under lång tid uppfattades det som ett okomplicerat val: hög innovationsgrad, snabb skalbarhet och en mogen tjänsteportfölj. Men den geopolitiska utvecklingen de senaste åren har förändrat förutsättningarna. Sedan 2018 gäller den amerikanska CLOUD Act, som innebär att amerikanska molnleverantörer kan […]",
        "modified_at": "2026-08-20T09:44:22+00:00"
    },
    {
        "title": "Data protection policy",
        "url": "/en/data-protection-policy/",
        "content": "Data protection policyOmegapoint's data protection policyThis policy is designed to describe Omegapoint's handling of personal data based on the requirements of the EU Data Protection Regulation. AB Omegapoint with subsidiaries stores and processes personal data for staff, customers and suppliers with whom we have agreements. We also process personal data for those who have actively shown interest in Omegapoint as an employer, partner or for skills exchange. For marketing purposes, we will also register contact details of people who represent possible partners, customers and possible candidates for employment based on a balance of interests as described below. Registration of candidates may be based on tips from private individuals, recruitment companies or on information published by the person concerned. Omegapoint's handling of personal data on its websites No personal data that visitors do not knowingly provide will be stored. Temporarily, during your visit, information may be stored to ensure the functioning of the web, e.g. that login will work. Legal basis for the processing of personal data by Omegapoint All processing and storage of personal data at Omegapoint shall be carried out in a lawful, accurate and transparent manner in relation to the data subject.The conditions that describe what is a lawful processing and to which Omegapoint refers are consent, performance of a contract, fulfillment of a legal obligation or based on a balance of interests. These conditions are described below. Consent If there is no other legal basis for the processing of personal data, consent must be requested from the data subject. Omegapoint must then be able to demonstrate that the data subject has given consent. The data subject can withdraw their consent at any time and have the data concerned deleted. Performance of contracts \"Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.\" - GDPR Article 6 point 1b. The above normally applies to persons mentioned in business contracts signed by Omegapoint. It also applies to most information related to employment and employment conditions regulated in employment contracts. Fulfilling a legal obligation. \"The processing is necessary for compliance with a legal obligation to which the controller is subject.\" - GDPR Article 6 point 1c. This mainly applies to data and processing required to comply with laws and regulatory requirements, such as requirements in the Accounting Act and requirements from the Tax Authority. Balancing of interests. \"Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject\" - GDPR Article 6(1f). Omegapoint considers that there is a mutual interest in finding candidates for recruitment and representatives of possible clients or partner companies. Omegapoint may therefore choose to collect contact details such as (name, role, e-mail address, telephone number) and other information that the person has provided to us verbally or in writing. Your rights under the General Data Protection Regulation (Articles 15-18) You have the right to obtain confirmation as to whether personal data concerning you is being processed or stored by Omegapoint. If there is data, you can request access to these and information about the purpose for which they are processed. Furthermore, you have the right to request that the data be deleted if there is no legal requirement to keep it. In addition, you can request that incorrect data be corrected. How do you contact Omegapoint with questions about the Data Protection Regulation? To find out if we hold information about you and if you would like to receive copies of it or request, if permitted by law, that your data be deleted, please contact gdpr@omegapoint.se",
        "post_type": "page",
        "meta_description": "Here you can read our policy on how we handle personal data.",
        "excerpt": "",
        "modified_at": "2026-08-20T09:37:33+00:00"
    },
    {
        "title": "Whose responsibility is it when AI makes mistakes?",
        "url": "/en/articles/responsibility-for-ai/",
        "content": "Imagine using an AI agent as your first line of customer support. When a customer contacts you, they are greeted by an LLM-based chatbot that answers common questions. A perfectly reasonable solution that saves time for both the organization and the customer, who doesn't have to wait for an available agent. But what happens when the chatbot makes a mistake? When it provides incorrect information that has consequences for both the customer and the company. Who is then responsible? The customer? The developer? Or is it the company that the AI agent represents? This dilemma became very real for Air Canada in 2022. Their chatbot informed a customer that he could get money back on a trip after the fact because he was entitled to a discount. The problem? The chatbot was hallucinating. The discount only applied if it was requested before the journey. Air Canada offered a voucher, but the customer refused and sued the company. The court ruled in his favor: the company was liable for the chatbot's mistake. The airline had to pay the full amount plus legal costs. The case illustrates how complex the liability issue becomes when we let AI act on our behalf. It’s easy to think that Air Canada should have taken responsibility right away and just paid the discount. But when we consider the broader implications, the issue becomes much more complex: Who is responsible if an AI agent deletes all customer data, as actually happened in a high profile CASE involving the development tool Replit)? Who is responsible if a self-driving car causes an accident? Who is responsible if an autonomous weapons system commits a war crime? These are questions that researchers in ethics and law are grappling with around the world. Unlike classical code, AI models are non-deterministic. We cannot follow a string of code and see exactly why the model gave a certain response, which also makes them difficult to test. Therefore, we cannot consider AI errors as: a manufacturing defect a bug a teething problem Even as models improve, they will always be capable of making mistakes, just like humans. At the same time, AI models are often designed to provide helpful and agreeable responses, without having any real sense of ethics, morality, or context. They can sound confident even when they are wrong. That makes the issue of liability unique. To take advantage of AI's enormous benefits, we must weigh: The gain in efficiency and cost savingsagainst The risk of harm if the AI makes a mistake At one end of the spectrum: an incorrect discount. At the other, something that could threaten the entire organization. Therefore, there should always be someone who is responsible – whether it is a person or a company. My recommendations in brief: Clarify responsibilities — a person should be able to stop, correct or approve decisions. Introduce multiple levels of review in sensitive cases — important decisions should have multiple pairs of eyes on them. Let the risk guide you — is it a test environment or a live operation with customers? Adjust the level of control accordingly. Ensure that you have control over your AI agents. You need to ensure that the agents do not have the rights, in practice do not have the ability, to do things that you do not want. As experience has shown, you cannot trust them to refrain just because you have instructed them not to.",
        "post_type": "post",
        "meta_description": "Who is responsible when AI makes mistakes? We look at AI agents, risks, and why companies need clear accountability and human control.",
        "excerpt": "Ponera att du använder en AI‑agent som första linjen i din kundsupport. När en kund kontaktar er möts de av en LLM‑baserad chatbot som svarar på vanliga frågor. En fullt rimlig lösning som sparar tid för både organisationen och kunden, som slipper vänta på en ledig handläggare. Men vad händer när chatboten gör fel? När […]",
        "modified_at": "2026-08-11T08:58:37+00:00"
    },
    {
        "title": "Omegapoint at Almedalen – here are the insights",
        "url": "/en/articles/omegapoint-at-almedalen-week-has-the-insights/",
        "content": "Almedalen Week 2026 largely revolved around defense, security and – of course – AI. Here, Omegapoint representatives share what they are taking home from Gotland. Anna-Clara Söderbaum, COO: ”\"We are in a fantastic social change that will create a lot of madness. And it is in that madness that innovation is born. It is a blessing to be in it, first and foremost. Here in Visby, most of it has revolved around cybersecurity or AI. What is interesting is how we seem to view the two subjects as isolated phenomena. Today, it should not be about AI or not, but about how we relate to each other. When it comes to AI, we have no choice, that type of intelligence will change production Sweden and we will have to calculate in new ways, just like during industrialization. Where are people needed and where are they not needed. The same applies to cybersecurity, many are fumbling and talking about it instead of relating and letting security permeate the entire organization. At the same time, we have seen that many conversations in Almedalen have touched on just that.\"” Jonas Hasselberg, Group CEO: ”This year’s edition of Almedalen is lively, lively and energetic. Our questions are of great interest and everyone wants to talk about our areas of expertise. The geopolitical outlook is starting to brighten somewhat, the economy is as well, and we see that Sweden is making progress in everything that is being done to increase preparedness. Last year there was a lot of talk about what we have to do from a preparedness perspective – this year we see it happening. There is a belief in the future and a positive view of the possibilities of technology. Geopolitics and defense issues have become very dominant. The issue creates lively discussions and the issues are starting to be raised to a higher level of society. Today, cybersecurity is not just about bad guys who want to access information, but increasingly about how different actors could influence the opinions of an entire country. Another reflection is that many people talk about AI as a stand-alone phenomenon that will solve everything. But you have to look at AI from a larger business perspective and here some interesting examples are highlighted where AI is rather one of many technology components in entire business initiatives.” Dan Bergh Johnsson, AI security expert: ”First, there is a growing awareness of the role that security can play. Security is starting to be seen as urgently important, partly due to the Mythos discussions. The feeling among many is that we can’t snooze for much longer. There is a growing awareness that if you do, you risk getting into trouble. People are experiencing the situation more acutely and less hypothetically. Secondly, there is a growing realization that security, previously seen as a necessary evil, is increasingly being seen as an enabler. Compare this to driving a car with or without a seatbelt. With your seatbelt on, you automatically feel safer behind the wheel and can maintain a steady, high speed. Without your seatbelt on, you crawl and don't dare to accelerate. Good cybersecurity provides the same security and speed. In addition, I have been convinced that we need to focus more on how AI affects our workflows, more than on how AI affects individual work steps. To tie back to security, these are similar mechanisms, security is not about optimizing individual small steps, but about achieving a safer, stronger flow. AI and security are both enablers and are more similar to each other than we previously thought.” Daniel Deogun, Business Manager Academy: ”\"Resilience is a societal problem and not an IT problem. All of us who work with it every day know that, but awareness of it is lower among many others. It is also clear that the knowledge of technicians, developers and organizations about how to build systems with AI needs to be strengthened. With the rapid development and potent AI tools, it is even more challenging today. If yesterday you worked with a wooden hammer, today you have access to a laser hammer. Knowledge is key. Many organizations are groping around how AI can be used profitably, they try and try, and are still in a state of experimentation. Then it is easy to forget about security. It is important to continue talking about how it is a business continuity issue rather than an IT problem, the entire business must be involved.\"”",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Almedalsveckan 2026 kretsade till stor del kring försvar, säkerhet och – givetvis – AI. Här delar Omegapoints representanter med sig av vad de tar med sig hem från Gotland. Anna-Clara Söderbaum, COO: ”Vi befinner oss i en fantastisk samhällsförändring som kommer att skapa en massa galenskap. Och det är i den galenskapen som innovationen föds. Det […]",
        "modified_at": "2026-06-25T12:46:54+00:00"
    },
    {
        "title": "Why your risk approach does more harm than good",
        "url": "/en/articles/therefore-your-risk-method-does-more-harm-than-good/",
        "content": "Risk management is a central part of information security work. For a long time, organizations have used qualitative methods to identify, assess and prioritize risks. By estimating probability and consequence on a scale and compiling the results in a risk matrix, organizations have gained a structured way to create an overview and make decisions. This type of method has several strengths. They are relatively easy to understand, require limited resources to implement, and often work well as a common language between operations, the security function, and management. At the same time, many organizations face new challenges. Cyber threats are evolving rapidly, businesses need to better understand systemic risk, and security investments often need to be justified in competition with other business initiatives. In this environment, the question arises whether there are better ways to conduct risk assessments and provide stronger support for decision making. Is the risk matrix outdated? A common challenge with qualitative risk assessments is that the results are based on human judgment. Even with clear guidelines, different people can interpret concepts like \"high probability\" or \"serious consequence\" differently. The analysis tends to be fragmented rather than comprehensive, and the uncertainty surrounding the results becomes high. This can lead to scoring methods and risk matrices doing more harm than good in the assessment process and, in the worst case, functioning as a kind of \"analysis placebo\", where the feeling of having done a proper analysis replaces the actual benefit of it. The challenge becomes particularly clear when communicating risks to management and the board. While security specialists are often accustomed to reasoning about risk levels and security measures, top management needs to make decisions based on business priorities, investments and resource allocation. In such contexts, the need often arises to be able to describe risks in a way that more clearly connects security with business operations. There are proven alternatives Quantitative risk methods are nothing new. In insurance, finance and safety-critical industries such as aviation and process industries, risk has long been expressed in economic terms. There are also established frameworks that use scenario-based methods and shift the focus from individual assets to realistic attack chains, how a threat might actually materialize rather than an abstract assessment of a specific server or system. Common to the more modern approaches is the realization that quantification, even with incomplete data, provides a better basis for decision-making than subjective categories. By expressing risk as potential loss or exposure, a basis is created that can be easier to integrate into the business’s other decision-making processes. A risk approach that combines the best We have developed a scenario-based quantitative risk methodology that builds on these insights and is designed to work in practice, not just in theory. The methodology is structured into three interconnected levels: strategic, tactical and operational. Our experience from many organizations is that risk management is most valuable when it connects multiple levels of the business. At the strategic level, risks that could affect the organization’s goals and operational capabilities are identified and analyzed. These are scenarios that extend beyond individual systems, such as a ransomware attack that knocks out core business systems, impacts customer deliveries and triggers regulatory scrutiny. The consequences of these scenarios are expressed in kronor and calculated based on factors such as downtime, recovery costs, fines and indirect effects such as loss of trust. It is at this level that risk becomes a business language. The tactical level shows how a strategic scenario could actually unfold. Here we use MITRE ATT&CK as a structure to identify realistic attack methods and attack chains. This makes the analysis reproducible and rooted in how real threat actors operate, rather than in general assumptions. From the tactical analysis, the probability is derived, based on what security vulnerabilities actually exist in the environment, not on a subjective estimate. At the operational level, tactical risks are broken down into concrete issues per asset. For example, if the tactical risk is \"MFA missing,\" the operational level becomes \"MFA missing in M365.\" It is at this level that you see exactly what needs to be addressed and where. When these levels are connected, a clear line is created from operational risk to concrete security measures. The logic of the model is deliberate: the consequence is derived from the top, from the strategic level, since tactical risks are ultimately operational risks with an impact on the entire organization. The probability is built from the bottom, from the operational and tactical level, based on actual deficiencies in the environment. Together they give an Expected Annual Loss, a quantified measure in kronor per year. From color codes to better decisions The quantification is done using Monte Carlo simulation, which means that we do not calculate with a single point value but with a probability interval of possible loss. This reflects the genuine uncertainty that always exists in risk assessments, and it provides a much more honest and useful basis than a number that pretends to be exact. The result is a risk picture that security leaders can take to senior management and the board and talk about in business terms. Not \"we have ten high risks,\" but \"this scenario has an expected annual cost of SEK 2.4 million, and with this action we halve that exposure.\" It's a fundamental difference in how security work is perceived and prioritized at the management level. It is also, we believe, a more honest way to work. We know that our assessments contain uncertainty. The question is whether we hide it behind a color scale or whether we are transparent about it and use it as a tool for better decisions. But the value doesn't stop in the boardroom. By structuring the tactical analysis around MITRE ATT&CK's attack chains, the security team also gets a direct tool for prioritizing actions. Instead of treating security vulnerabilities as an equally long list to tick off, you can see where in an attack chain an action has the most effect, which actions break the most possible attack methods and thereby reduce the risk the most per invested krona. And because the method identifies concrete issues at the operational level, you know exactly which vulnerabilities need to be addressed and where. This is how we connect strategic decision-making with operational security work.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Risk management is a central part of information security work. For a long time, organizations have used qualitative methods to identify, assess and prioritize risks. By estimating probability and consequence on a scale and compiling the results in a risk matrix, organizations have been given a structured way to create an overview and make decisions. This type of method has […]",
        "modified_at": "2026-06-23T07:31:22+00:00"
    },
    {
        "title": "Sustainability work",
        "url": "/en/omegapoints-sustainability-work/",
        "content": "Our sustainability workAt Omegapoint, we believe that technology can be a force for good. We want to contribute to a safer, more sustainable and resilient society through solutions that are secure, resource efficient, and built for the future. Our sustainability work is about taking responsibility, both for our own impact and for how we can help our customers make the same journey. We want to improve the world and create a sustainable future.Omegapoint's vision is to create a future where everyone can trust technology when it really matters. You should be able to shop with your credit card even if your bank is subjected to a cyberattack. If you end up in hospital, your medical records should be available regardless of external threats. Your municipality should continue to deliver community services even in times of heightened alert. For technology to function even under pressure, systems must be built to withstand disruptions – such as when parts are temporarily down or data becomes corrupted.By working in a structured manner and building in robustness from the start, Omegapoint helps companies and authorities create technology that can truly be trusted. All human activity affects the environment, which is why we strive to always consider climate impact in our decisions.Our environmental policy is updated annually to ensure that the work is both ambitious and feasible in practice.The measures we choose must have a demonstrable effect, be in reasonable proportion to their cost and contribute to a real reduction in Omegapoint's climate footprint.By regularly reviewing and improving our work, we take steps toward becoming a more sustainable business Four focus areas for a sustainable Omegapoint Omegapoint strives for sustainability both with our customers and in our own operations. We divide our sustainability work into four main areas: Security, Environment, Social Responsibility, and Corporate Governance. SecurityA safe digital world is the foundation for a sustainable society. As a leading player in cybersecurity, we help our customers build secure systems that protect both people and businesses. We constantly develop our methods, share knowledge and act as advisors in a world where trust is a prerequisite for sustainable development. EnvironmentWe are actively working to reduce our carbon emissions in line with the Paris Agreement. Our climate impact is measured and monitored annually, and we are taking concrete measures in energy, travel and purchasing. Our goal is clear: that every decision we make – from how we travel to how we build IT solutions – should contribute to reduced environmental impact. Social responsibilityWe want to be a workplace where people grow and feel meaningful. Through our focus on inclusion, skills development and equality, we create a culture where everyone has the opportunity to contribute. We continuously measure engagement and satisfaction and we are proud to have one of the highest eNPS levels in the industry. Corporate governanceSustainability starts with responsible leadership.We work actively with ethics, transparency and good corporate governance to ensure that our operations meet both our own and our customers' expectations. Our Code of Conduct applies to all employees and is a cornerstone of how we run our business. Omegapoint's climate targets are validated by the Science Based Targets initiativeOmegapoint's climate goals are validated by Science Based Targets initiative (SBTi) and is based on the Paris Agreement's ambition to limit global warming to 1.5 °C. This means that we are committed to: Reduce our direct emissions (Scope 1 and 2) by 55 % until the year 2033 Reduce our indirect emissions (Scope 3) by 33 % until the year 2033 We track and report our progress annually in the Cemasys tool. By integrating climate data into our business planning, we ensure that our decisions lead to real, measurable change. Read moreCurrent status reportOur emissions are decreasing year by year and we are on track towards the goals we committed to through the Science Based Targets initiative (SBTi). Here we report on how things are actually going. Scope 1+2 decreases by 6% per year and Scope 3 by 3% per year since the base year 2023 Would you like to know more about our sustainability work?We believe that technology can be a positive force in society – and we want to collaborate with more people who share that belief. Contact us if you want to know more about how we work to unite technology, business value and sustainability, or read more in Omegapoints annual and sustainability report.",
        "post_type": "page",
        "meta_description": "We want to contribute to a safer, more sustainable and resilient society through solutions that are safe, resource-efficient and built for the future.",
        "excerpt": "",
        "modified_at": "2026-06-16T09:52:50+00:00"
    },
    {
        "title": "Every incident is a learning opportunity – if the culture allows it",
        "url": "/en/articles/every-incident-is-a-learning-opportunity-if-the-culture-allows-it/",
        "content": "Imagine a pack of monkeys breaking into your organization’s data center. They pull out wires, knock over servers, and create complete chaos. How would your systems fare — and how would you as an organization react? This thought experiment is exactly what Netflix did when they introduced their Chaos Monkey test in 2011. They wanted to test how their own infrastructure, and organization, would function if a large number of the company's computers suddenly stopped working. The goal is to design systems that are prepared for attacks from chaotic monkeys, even though no one knows when they will arrive or what they will destroy. The result was a system that has become a benchmark for how we create real resilience, but Chaos Monkey is not really about monkeys or servers. It is about how people and organizations react when something unexpected happens. Because ultimately, we want to create anti-fragile systems. Anti-fragile systems are not just robust — they are improved by disruption. Each incident makes them stronger than before. Much like a shinbone gets stronger when it heals after a fracture. Then system architecture is not enough. It is also about how everyone in the organization behaves. So it is not just a technical issue, but also a social one. Let's return to the monkeys in the Netflix server room. If the organization's main focus becomes who who forgot to lock the door, we not only lose valuable time, we also risk thwarting learning. The main question – once we have secured operations – is of course what we can do to prevent it from happening again. Then we also need to have a culture where everyone dares to be open about their mistakes, and raises their hand to contribute. If I was the one who didn't double-check that the door was closed, I do the most good by telling you about it and perhaps pointing out that maybe the door closer isn't working properly. If I wrote the code that created a vulnerability, I contribute best by sharing how I thought and why it went wrong. This requires a safe culture that permeates the entire organization. To create and maintain one, individuals, teams, managers and employees in other parts of the company must take responsibility. Everyone needs to contribute to an organization where we not only do our best to maintain resilience and safety, but also where we all dare to talk about our failures. Otherwise, we cannot become stronger from incidents. Otherwise, we are not a learning organization. So my checklist after an incident is: Create forums for learning — Document, discuss, and follow up on incidents systematically. Ensure psychological safety — Ask yourself if people dare to talk about mistakes, hesitations, and observations. Analyze behaviors and incentives — How do you react? How does the team react? How does the organization react? What drives these behaviors? As I and my co-authors Daniel Deogun and Dan Sawano writes in the book Secure by Design Security is not just about code and architecture, it's just as much about creating a security-conscious culture. That's how we work at Omegapoint, and that's the gospel we spread to our customers, and to anyone else who will listen.",
        "post_type": "post",
        "meta_description": "What can organizations learn from Netflix's Chaos Monkey? About safety culture, psychological safety, and how incidents strengthen the business.",
        "excerpt": "Föreställ dig att en flock apor tar sig in i din organisations serverhall. De drar ut sladdar, välter servrar och skapar fullständigt kaos. Hur skulle era system klara sig — och hur skulle ni som organisation reagera? Detta tankeexperiment är exakt vad Netflix gjorde när de introducerade sitt Chaos Monkey-test 2011. De ville testa hur […]",
        "modified_at": "2026-06-16T09:09:30+00:00"
    },
    {
        "title": "Quantum computers are coming – here's how to protect your business today",
        "url": "/en/articles/how-do-you-quantum-secure-your-business/",
        "content": "Let's play with the idea that some unknown actor has already managed to secretly build a usable quantum computer today – what could it/they actually do? And how serious would this threat be? The answer is that the consequences would be enormous. Such an actor would not only be able to secretly read almost all the information we send over the internet today. They would also be able to forge almost all digital identities and signatures. So it's not just your private emails or the confidential conversations of decision-makers that would be wide open to reading. The threat also applies to logins to online banks, identification with authorities, signing financial transactions, digital checks of passports and credit cards and more, i.e. large parts of what today builds the foundation of our digital society. In this text, I will try to break down the issues in a way that is useful for those of you who want to take action and protect your systems and your data against this threat. How do quantum computers work and why do they pose a threat? Quantum computers solve problems in a completely different way than conventional computers. In simple terms, ordinary computers work digitally with weak electrical currents such as zeros and ones, while quantum computers use quantum mechanical states and probability distributions. For the vast majority of problems, quantum computers will always be clumsy, extremely expensive, and inferior to the classical computers we already have today. But for certain specific mathematical problems, we know of algorithms that only work on quantum computers, and that can exploit the hard-to-tamed potential power of quantum computers. Unfortunately, it happens to be the very mathematics that underlies the security of the best and most common algorithms we commonly use today to secure our systems. In practice, this means that quantum computers risk sweeping away the security we have today with standards for encryption and signing such as RSA and Elliptic curves, whose security is based on the fact that it is extremely demanding for ordinary computers to factor very large numbers. When will quantum computers arrive? If the threat is so serious, why hasn't everyone already rebuilt systems and algorithms to prevent this? The answer is that there are many different estimates of how far in the future the threat lies. Building a usable quantum computer is an extreme technical challenge, and it is not even certain that they will ever become a real threat. But technology is advancing rapidly, and as always, it is difficult to predict when a new technology will go from Proof of Concept to a working product. In recent years, great progress has also been made on the theoretical side, where it has been possible to optimize the theoretical quantum algorithms in such a way that they could be executed on significantly smaller quantum computers than previously thought. The gap between today's working Proof of Concept and a fully realized threat is narrowing. The most optimistic guesses say we could see quantum computers large enough to break the first codes within two years. Others say five to ten years. American National Institute of Standards and Technology (NIST) has set a timeline where our current algorithms will be considered insecure by 2030, and must be completely replaced by 2035. Google have recently announced that they will start requiring post-quantum secured algorithms as early as 2029. What should I do to quantum secure my business? The way forward is to switch to new algorithms that are designed based on what we know today to be safe for quantum computers. However, the new algorithms have only recently been standardized, so there is not yet much proven experience on how to implement them. There have also been examples of proposed ”quantum-safe” algorithms that have proven to be relatively easy to crack for conventional computers. It is therefore a matter of both replacing now and preparing to be more flexible in the future. With all the technological developments, it must be easy to correct, adapt and replace algorithms to maintain security. The two most important things that should be done immediately, or at least as soon as possible, are: InventoryThe first thing you need to do is list the algorithms used in the systems. This is a rather tricky task, considering that it also includes all the algorithms that your subcontractors for the systems use. You also need to make sure that you can continuously monitor which algorithms are used. Build preparednessOnce you have taken stock of the algorithms used in all parts of the systems, you need to make sure they can be replaced and have a plan for how to proceed when the time comes. If you are lucky, a simple reconfiguration will suffice, otherwise you will need to rebuild. In summary, the uncertainty is now great. Even if the probability of useful quantum computers appearing within one to two years is very small, the consequences would be enormous. Therefore, we must act on the risk now. Waiting and seeing, until the risk suddenly becomes a fact, is downright unwise. The image shows the current best guess for when quantum computers will be able to break our algorithms. Source: Inéz Atug, RSA Conference 2026",
        "post_type": "post",
        "meta_description": "Play with the idea that an unknown actor has secretly managed to build a usable quantum computer – what could it do? And how serious would this threat be?",
        "excerpt": "Låt oss leka med tanken att någon okänd aktör i hemlighet redan idag har lyckats bygga en användbar kvantdator – vad skulle den/de faktiskt kunna göra? Och hur allvarligt vore detta hot? Svaret är att konsekvenserna skulle vara enorma. En sådan aktör skulle i hemlighet inte bara kunna läsa nästan all information vi skickar över […]",
        "modified_at": "2026-06-14T17:06:20+00:00"
    },
    {
        "title": "Make cybersecurity an election issue",
        "url": "/en/articles/makes-cybersecurity-an-elective/",
        "content": "This opinion piece was published in Industry Today on June 3, 2026. Cybersecurity needs to be elevated to the political mainstream now. Not after the next breach, and not after the next system disruption, but before the pace of threat development sets the framework for what is even possible to defend, writes Dan Bergh Johnsson, partner at Omegapoint. What is missing is not more strategies, but a clear political focus on pace, prioritization and responsibility in an environment where attacks are developing faster than the systems that are supposed to stop them, writes Dan Bergh Johnsson, partner at Omegapoint. Sweden is heading towards elections in a situation where security dominates the agenda. Defense, energy and crime are being intensely discussed. But one of the most crucial issues is being left in the shadows, namely cybersecurity – even though it is precisely the one that now needs to be protected against increasingly advanced AI-driven attacks. It is remarkable. Sweden is one of the world's most digitalized economies – and therefore also one of the most vulnerable. And now the threat landscape is fundamentally changing. In April, Anthropic launched a new AI model that marks a breakthrough in several ways. The new thing is not that AI can identify vulnerabilities in code, as that type of functionality has existed for some time. The crucial thing is instead that the model can handle the entire chain: it can not only find a vulnerability and understand it, but also independently write code that exploits it in practice. The third stage has so far been dependent on human intervention. With the time from discovery to exploitation now at risk of shrinking from weeks to days, or even hours, the balance between attack and defense is changing fundamentally. Defense relies heavily on detecting, analyzing, and fixing vulnerabilities before they are exploited, while attacks rely on speed and surprise. With AI accelerating the entire process, this balance is clearly shifting in the attacker’s favor. The fact that the technology is initially only being made available to a few players, including Apple, Google and Microsoft, shows how serious the development is considered to be. The reasoning is that these players should be given a head start to secure their systems before similar tools become more widespread. The time window is estimated to months rather than years. This is not a hypothetical scenario, but a rapid escalation of an already existing threat. For Sweden, this means several concrete consequences: Firstly Our economic model is directly exposed. Banks, payment systems, industry and the public sector are deeply integrated digitally, which means that an attack rarely stops at a single system but risks affecting entire value chains. Secondly Total defense is dependent on civilian digital infrastructures, which means that cyberattacks can no longer be considered an isolated technology problem but as an integrated part of modern security policy. Thirdly There is a risk that societal trust will be affected. As attacks become faster, more scalable and harder to detect, the likelihood of disruptions that can affect everything from healthcare to central societal functions increases. A review of the parties' positions shows that cybersecurity is included in both defense and digitalization policies, but is rarely treated as a strategic issue in its own right. At the same time, AI and cybersecurity are largely handled separately, even though it is in their combination that the most profound change in the threat landscape is now taking place. What is missing is not more strategies, but a clear political focus on pace, prioritization, and responsibility in an environment where attacks are evolving faster than the systems that are supposed to stop them. Three questions should each party be able to answer: 1. How should Sweden reduce the time from discovery to action in critical systems? 2. How should the public and private sectors collaborate when threats become AI-driven and real-time? 3. How do we ensure competence, investment and division of responsibilities in an environment where the scale of attacks is rapidly increasing? This is fundamentally a core economic, security and democratic issue. Historically, crises have often been what forced action. In an era where threats are evolving at an ever-increasing pace, this is a risky approach, as the next crisis could develop faster than our ability to react. That's why cybersecurity needs to be elevated to the political mainstream now. Not after the next breach, and not after the next system disruption, but before the pace of threat development sets the framework for what is even possible to defend.",
        "post_type": "post",
        "meta_description": "Cybersecurity must become an electoral issue. AI-driven cyberattacks threaten Sweden's economy, total defense, and societal functions.",
        "excerpt": "Denna debattartikel publicerades i Dagens Industri den 3 juni 2026. Cybersäkerhet behöver lyftas upp på den politiska huvudscenen redan nu. Inte efter nästa intrång, och inte efter nästa systemstörning, utan innan tempot i hotutvecklingen sätter ramarna för vad som överhuvudtaget är möjligt att försvara, skriver Dan Bergh Johnsson, partner Omegapoint. Det som saknas är inte fler […]",
        "modified_at": "2026-06-10T05:25:06+00:00"
    },
    {
        "title": "If you haven't started adapting to CRA, you're already behind.",
        "url": "/en/articles/if-you-havent-started-adapting-to-the-cra-youre-already-behind/",
        "content": "Already after the summer, Swedish companies that build and sell products with software should be ready for the first part of the next major EU regulation in the area of cybersecurity. Cyber Resilience Act (CRA) will be introduced in two stages, with the first part coming into effect on September 11, 2026, while the larger part comes into effect in December 2027. So things are starting to get hectic. For years, terms of use for software products have gotten away with being sold ”as is,” with no promises of warranty or cybersecurity. The CRA aims to change this so that customers get what they already think they’re getting: products without known vulnerabilities that will be kept up to date over time. I would therefore argue that the regulation is not really a question of compliance but of reasonableness. The CRA requires that all products that are or contain software must be free of known vulnerabilities that can be exploited at the time they are released for sale. This means that you should not be able to launch a new product without knowing that it does not contain any known security flaws. It also requires that the development process create evidence and documentation that this is the case. This means that there must be documented processes, security tests, and reports from security tools. All product companies must do this from December next year when the entire law comes into force. But as of September 11th of this year, a reporting obligation will be introduced for products already on the market. This means that you must report this to the authorities within 24 hours of discovering a vulnerability that affects your customers. You must also be able to quickly send out an update. The CRA requires that you offer security updates for at least five years after the product has been sold. The consequences are not cosmetic: you may be forced to stop sales, recall products or pay penalty fees. What you need to secure for September is: The ability to detect: Do you have the ability to see when a customer is affected by a vulnerability? The ability to report: Is there a process? Who owns it? Who should have the information? The ability to remedy: Do you have the tools, processes and infrastructure to quickly develop and distribute updates? You should also have started the major work of meeting all the requirements of the CRA when it comes into effect on December 11, 2027. While it may feel overwhelming, there is support available. There are established processes to apply and models to follow. ENISA has published a preview of its upcoming ”Security by Design and Default Playbook” which provides concrete advice primarily for SMEs on how to work towards meeting the requirements of the CRA. It's high time to get started.",
        "post_type": "post",
        "meta_description": "The Cyber Resilience Act introduces new requirements for companies selling software products. Here's what you need to have in place by September 2026.",
        "excerpt": "Redan efter sommaren ska svenska företag som bygger och säljer produkter med mjukvara vara redo för den första delen av nästa stora EU-reglering på cybersäkerhetsområdet. Cyber Resilience Act (CRA) kommer att införas i två steg där den första delen träder i kraft den 11 september 2026, medan den stora delen träder i kraft i december 2027. Det […]",
        "modified_at": "2026-06-01T11:53:10+00:00"
    },
    {
        "title": "AI Agents and the New Reality: Reflections from RSAC 2026",
        "url": "/en/articles/ai-agents-and-the-new-reality-reflections-from-rsac-2026/",
        "content": "This article was first published in Current Security, May 28, 2026. After this year's RSA Conference 2026 in San Francisco, one thing is clear: the cybersecurity discussion has quickly shifted from generative AI to autonomous AI agents. In a post-conference look, Margarita Sallinen and Linda Nieminen, information and cybersecurity specialists at Omegapoint, describe how AI agents are changing the way we think about risk, responsibility, and control – and why security work must now adapt to a threat landscape that operates at “machine speed.”. The RSA Conference is one of the world’s most influential cybersecurity conferences, bringing together tens of thousands of security experts, decision-makers and technology companies in San Francisco each year to discuss the latest developments in cybersecurity, technology and policy. One month after this year’s conference, one thing is particularly clear: in just one year, the cybersecurity discussion has shifted from generative AI to autonomous AI agents. The focus is no longer primarily on the information AI produces, but on the ability of AI agents to make decisions and act on their own, and the opportunities, risks and security challenges that this brings. A changing risk picture One of the recurring insights from RSA Conference 2026 was that AI agents represent a fundamental shift in how organizations use artificial intelligence. Unlike generative AI and AI assistants, which primarily generate content or answer questions, AI agents can make decisions, interact with systems, and perform tasks autonomously. This is changing not only how operations are automated, but also how risk, responsibility, and control need to be understood in the cybersecurity space. One of the conference's memorable quotes came from Jeetu Patel, Chief Product Officer at Cisco, during one of this year's keynotes: “With chatbots, you worry about getting the wrong answer. With AI agents, you worry about them taking the wrong action.” The quote captures the essence of the changing risk landscape that characterized much of the discussions at the conference. As organizations have implemented generative AI, the discussion has focused primarily on information leakage, exposure of sensitive data, and lack of control over information flows. But with autonomous AI agents, the risk landscape changes even further. The risks are no longer just about what information the systems process or generate, but about their ability to make decisions and translate these into autonomous actions in real time. In parallel, threat actors are also beginning to operationalize AI agents for offensive purposes. Attack chains that previously could take days or weeks to execute can now be automated and greatly accelerated, from initial access to lateral movement and impact in a matter of seconds. This creates a threat landscape where traditional manual security processes risk becoming inadequate, and where security measures must increasingly be able to operate at “machine speed,” without continuous human intervention. A recurring observation during the conference was also how quickly developments are now taking place. Several discussions were characterized by an almost implicit consensus: AI-driven threats have fundamentally changed the cyber threat landscape and continue to develop at a very high rate. Human responsibility and AI agents A clear trend at RSA Conference 2026 was how AI agents are challenging traditional identity and access management (IAM) models. Historically, these systems have been designed to manage both human users and machine identities, such as service accounts, applications, and API keys. AI agents, however, introduce a new category of identity: systems with the ability to make decisions, adapt their behavior, and act autonomously in dynamic environments. Unlike traditional machine identities that follow predefined rules and clearly defined instructions, AI agents can interact with multiple systems simultaneously, interpret context, and perform tasks with a high degree of autonomy. This creates significantly more complex issues around governance, authorization models, and division of responsibilities. What rights and privileges should an AI agent have? Under what conditions should it be allowed to act autonomously? How is its scope of action limited? And who bears the legal and operational responsibility when an AI agent makes incorrect decisions or causes harm? Identity and responsibility are no longer solely linked to people or static systems, but also to autonomous actors with a mandate to make their own decisions. This means that identity and access management is also rapidly evolving from a traditional IAM issue to a broader issue of control, governance and security architecture. IAM today needs to include identity management and governance of AI agents. Protecting AI agents from the outside world Another key question during RSA Conference 2026 was how organizations should actually protect AI agents from external environments and manipulation. Unlike traditional systems, AI agents actively interact with their environment. They read emails, summarize documents, retrieve information from web pages, and integrate with external services and data sources. This also exposes them to a whole new type of attack surface, where malicious or manipulated information can influence the agent's decision-making and behavior. A recurring topic during the conference was the so-called prompt injection, attacks where hidden instructions are embedded in content that the AI agent processes and then interpreted as legitimate commands. When AI agents interact with external environments, the line between data and instructions blurs, creating new security challenges that many organizations still lack established security measures for. In parallel, concerns remain about data leakage and information control. AI agents are often given extensive access to internal systems and large amounts of business data, while information is often processed through external LLM services that the organization neither owns nor fully controls. The question is therefore not only about what the AI agent can do, but also about where the organization's information actually goes and how it is exposed outside its own environment. The same message recurred throughout the conference: identity and access management for AI agents, clear governance, and security measures that limit the agents' scope for action have gone from being \"nice to have\" to basic security measures, i.e. \"need to have\". “\"Human in the loop\", ideal or illusion? The new AI-driven threats and the changing requirements for identity and access management for AI agents simultaneously raise broader questions about control, responsibility and human involvement. Here the concept of human in the loop frequently during the RSA Conference 2026, the idea of humans monitoring, reviewing and in some cases approving the decisions and actions of AI agents. In theory, the model appears both reasonable and necessary. In practice, it raises considerably more complex questions. Are there sufficient resources for continuous human monitoring? Is it realistic in large-scale and highly automated environments? And does the concept risk, in some cases, becoming more of an illusion of security than an actual security measure? Several discussions during the conference were also marked by a clear paradox: while organizations talk about human control, security capabilities, as mentioned earlier, must increasingly be able to act at “machine speed” to meet AI-driven threats. When attacks and defenses occur autonomously and in real time, the question becomes not only whether humans should be involved, but when and at what level human control is actually possible and effective. A recurring conclusion was therefore that organizations need to take a more realistic view of human involvement in the actions of AI agents. Rather than relying on continuous manual monitoring, the security architecture needs to be based more on clear constraints, segmentation, rules and safeguards that limit the ability of AI agents to cause harm. The CISO perspective: groundwork is crucial The discussions in several CISO panels emphasized that the introduction of AI agents cannot be done in isolation from the organization's overall information security work. On the contrary, the development requires a high degree of maturity in governance, risk management and security architecture. Organizations that lack established security frameworks, clear risk processes and functioning incident management will likely find it significantly more difficult to implement AI agents in a secure manner. At the same time, the challenge is not only about technology and structure, but also about the distribution of responsibilities. A recurring concept during the conference was the so-called responsibility gap, the situation where responsibility for AI-related risks is fragmented between several different functions within the organization. In practice, this often means that one function is responsible for AI models, another for data pipelines and infrastructure, product teams handle integrations, legal is responsible for compliance issues, and security functions only get involved at a later stage. The result is a fragmented ecosystem where AI initiatives are run in parallel without clear coordination, creating both inefficiencies and significant security risks. Several CISOs therefore emphasized the need to integrate security, governance, and accountability early in the AI lifecycle, not as an afterthought once the technology has already been implemented in the business. The way forward RSA Conference 2026 made it clear that AI agents represent not just a technological shift, but a broad organizational and security transformation. The questions that dominated the conference were fundamentally about risk management, governance and control: who has it, how it is maintained and what happens when it fails. To meet this development, organizations need to redefine how identities and access are managed, clarify responsibility and ownership around AI initiatives, and integrate security early in the AI lifecycle. The crucial question is therefore no longer whether AI agents will be used, but whether security efforts can adapt to the pace of technological development. The organizations that succeed are likely to be those that treat security as an enabler of innovation, not as a consequence of it.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "This article was first published in Aktuell Säkerhet, May 28, 2026. After this year's RSA Conference 2026 in San Francisco, one thing is clear: the cybersecurity discussion has quickly shifted from generative AI to autonomous AI agents. In a post-conference look, Margarita Sallinen and Linda Nieminen, information and cybersecurity specialists at Omegapoint, describe how AI agents are changing the way we see […]",
        "modified_at": "2026-06-01T11:52:55+00:00"
    },
    {
        "title": "Speaking of Glasswing: responsible, but not enough",
        "url": "/en/articles/apropa-glasswing-responsibly-but-not-enough/",
        "content": "When Anthropic realized that Mythos was proving to be unusually capable of producing exploits, they decided not to release it publicly. Instead, they chose to invite certain actors to start using Mythos in a closed program to secure their own code. This initiative was named Glasswing. This is a commendable initiative, but it will not save us in the long run. When the light bulb was invented, both Edison and Swan managed to construct a working version independently of each other, although Edison got to the patent office a little faster. The invention was timely. Similarly, there is every reason to believe that other frontier models will soon have similar capabilities to the Mythos. Perhaps such already exist, but kept secret in development labs. Glasswing can delay the spread, but hardly stop it. Who then will get the chance to fix their shortcomings? They are twelve so-called partners: Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, Linux Foundation, Microsoft, Nvidia and Palo Alto Networks. These are all large, resourceful players with existing relationships with Anthropic. Eleven of them are large commercial American companies in technology and financial infrastructure. In addition, the Linux Foundation, because it provides Linux, which is one of the world's most widely used operating systems. In addition to these, there is a slowly growing list of other organizations that they also get access to. We don't know exactly what this looks like because it is partly secret, but to date there are about forty of them. But our digital infrastructure doesn't just consist of products from big vendors. A large part of it consists of open source – projects like curl, XZ Utils or Spring. We all depend on them, but they're not on the list. A vulnerability in them spreads to a lot of places at once. Your and my organization are not on the Glasswing list either. We will continue to take responsibility for the code we write ourselves, with or without Mythos. The problem doesn't stop with new code. Beneath the surface are years of accumulated code that has never been reviewed with today's eyes and tools; it's a mountain we have to work on catching up on. But that's a story for another time. Glasswing is an initiative that is supposed to delay the effect, but it is not a knight in shining armor coming to our rescue. Taking responsibility for our own systems and keeping them as clean of vulnerabilities as we can - that responsibility falls on us.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "När Anthropic insåg att Mythos visade sig vara ovanligt kapabel på att ta fram exploits bestämde de sig för att inte släppa den publikt. I stället valde man att bjuda in vissa aktörer att i ett slutet program börja använda Mythos för att säkra upp sin egen kod. Detta initiativ fick namnet Glasswing. Detta är ett lovvärt initiativ, men kommer inte att rädda oss i längden. När glödlampan uppfanns […]",
        "modified_at": "2026-05-13T09:20:07+00:00"
    },
    {
        "title": "8 principles for building secure systems",
        "url": "/en/articles/8-principles-for-building-secure-systems/",
        "content": "Imagine a kitchen in a fast-food restaurant. Everyone who works there knows that hand hygiene is crucial to the restaurant’s customer safety and commercial success (no one wants to eat somewhere where they risk food poisoning). But the only sink is located by the changing room outside the restaurant kitchen. During the lunch rush, the pace of the kitchen becomes crucial for colleagues at the cash register to do their jobs and to avoid angry customers. Here, the restaurant’s safety procedures come into conflict with loyalty to colleagues and with the restaurant’s business goals. Is it a knowledge problem if employees choose to ignore the procedures? Or is it a flaw in the kitchen design? Most people would answer the latter. The same is true with security architecture. It needs to be designed so that it is as easy as possible to do the right thing. We need to be secure by design. And there are a number of well-established principles to follow. Already in 1975, described Saltzer and Schroeder eight principles that are still central to secure system design: least privilege (Least Privilege), denied access as a default (Fail-safe defaults), simple and understandable security mechanisms (Economy of mechanism), control of every access attempt (Complete mediation), open design (Open design), division of particularly sensitive privileges (Separation of privilege), minimization of shared mechanisms (Least common mechanism) and – not least – that security must be psychologically acceptable (Psychological acceptability), i.e. work together with how people actually work. The last one is particularly important here. If security is perceived as an obstacle, it will sooner or later be circumvented. Let's go through what the principles mean one by one: Least Privilege In short: No one should have access to anything they don't need. It's a simple principle that means that if you want to avoid the wrong person getting access to systems or information, you shouldn't give them rights they don't need. Avoiding unnecessarily generous permissions protects against mistakes, against attacks and against someone being suspected of acting improperly. It also makes it much easier to investigate any security flaws or attacks. Fail-safe Defaults It is difficult to predict everything that can go wrong, but it is all the easier to list what should be allowed. Therefore, we should also build our systems according to the principle that we list what is allowed, not what should be prohibited. In the security world, we talk about whitelisting – meaning that only what is on the list is allowed – and blacklisting – only what is included in the list is prohibited. Blacklisting means in practice that we allow everything we have forgotten or not expected. We don't want it that way. Economy of Mechanism This is simply about ensuring that features are built in a way that is as easy to follow as possible. Empirically, there is a direct correlation between the number of lines of code and the occurrence of bugs, and we know that complexity opens up vulnerabilities. By avoiding cumbersome processes and being economical in our use of code, we create the conditions for secure systems. And in practical terms: How many lines of code do you actually want to review? Complete Mediation This means that every attempt to access each object should be checked based on authorization. This is especially important when we integrate different systems with each other or in the world we live in today where much (or all) of our data worth protecting is located in various cloud services. If controls can be bypassed or if I can get things done in someone else's name, we create potential problems. Open Design A good system design doesn't have to be secret. It's secure anyway. We simply shouldn't have to rely on hackers' ignorance to protect us. Instead, it's keys and passwords that we should protect. Having an open design with known algorithms also means that we can have higher trust in the systems when we know that it's not just up to us to test the systems, as developers and manufacturers can share information with each other about any flaws. Separation of Privileges Anyone who has seen enough Hollywood thrillers has seen how sensitive processes, such as the firing of nuclear weapons, require two separate keys to initiate. The same applies to particularly sensitive operations in our systems. To increase robustness, we should therefore ensure that no one can perform such operations on their own. However, here we should be careful about what kind of measures we consider to be so sensitive and worthy of protection, since this is something that naturally conflicts with accessibility. If we had placed the sink in our restaurant example above behind double locks, both keys would soon be hanging on a hook outside the door. Least Common Mechanism The principle of least commonality states that we should limit the number of functions or resources in a system that are shared by multiple users. This means that we should isolate users and processes from each other as much as possible to prevent unintended interactions and security breaches. It also helps us reduce the risk of domino effects if one user is exposed to an attack or malware. Psychological Acceptability Here we have our restaurant example again, which is the principle against which we must weigh all the other principles. If we build systems that are foolproof but that in practice prevent users from doing their jobs, they will soon look for shortcuts to get around it. That's when we risk turning loyal employees into security risks, and since your users are usually your weakest link, this can be the factor that brings the whole structure down. Ultimately, it's about UX, the user experience. If you understand how your users want to use the system, you can also build the experience, the UX, so that it doesn't throw off their feet.",
        "post_type": "post",
        "meta_description": "Security architecture needs to be designed so that it is as easy as possible to do the right thing. We need to be secure by design. And there are a number of principles to follow.",
        "excerpt": "Föreställ dig ett kök i en snabbmatsrestaurang. Alla som jobbar där vet att handhygien är avgörande för restaurangens kundsäkerhet och kommersiella framgång (ingen vill äta någonstans där man riskerar matförgiftning). Men det enda handfatet är placerat vid omklädningsrummet utanför restaurangköket. Under lunchrusningen blir tempot i köket avgörande för att kollegorna vid kassadisken ska kunna sköta […]",
        "modified_at": "2026-05-07T14:41:03+00:00"
    },
    {
        "title": "Swedish Security Index",
        "url": "/en/swedish-security-index/",
        "content": "An annual survey of the perceived threat landscape among decision makers in critical infrastructure. Swedish Security Index For the seventh year in a row, together with our subsidiary Basalt and Radar, we have conducted the Swedish Security Index survey, assessing the current threat landscape among decision makers in critical operations. Download the 2026 report for valuable insights to support informed decision making. Download the reportWe see the threats but not the consequencesPublic and private organizations across Sweden face a security environment where threats are no longer temporary disruptions, but part of everyday reality. Cyberattacks, disinformation, and organized crime pose parallel threats that interact and reinforce one another. Decision makers view the threat landscape as very serious. The challenge is not a lack of awareness, but how security efforts are organized and implemented. We see the threats, but not always the consequences. 7 out of 10 experience a serious threat In the seventh edition of our Swedish Security Index® survey, together with Radar, we examined how decision makers in critical operations perceive today’s threat landscape. This year’s report shows that concern remains high: 7 out of 10 decision makers (70%) feels that the threat is serious. Download the reportInformation security is a top priority A strong focus on security, driven by the evolving threat landscape, regulatory requirements, and increasing maturity, has led more organizations to establish internal policies and procedures. Information security is the area where decision makers perceive the greatest threat. It is also their highest priority and the area where budgets are most often considered insufficient.",
        "post_type": "page",
        "meta_description": "An annual survey of the perceived threat landscape among decision makers in critical infrastructure.",
        "excerpt": "",
        "modified_at": "2026-04-28T12:23:37+00:00"
    },
    {
        "title": "The life science book",
        "url": "/en/life-science/life-science-book/",
        "content": "The life science bookCybersecurity is a business-critical issue in life sciences, protecting sensitive patient data, healthcare systems and research. The life science book provides advice and guidance on how organizations can combine proactive security and clear regulatory compliance to build resilience, meet new expectations and accelerate digitalization. DownloadWhat does cybersecurity mean for life science? Cybersecurity in life sciences is ultimately about protecting human life and health. A cyber incident in pharmaceuticals, medicine or biotechnology has direct consequences for patient safety, clinical studies, drug supply and regulatory compliance. The Life Science Book is a handbook that aims to provide practical and clear guidance on how life science companies can strengthen their cybersecurity and protect their operations from cyberattacks. We explore the most common threats, risk factors and concrete measures to create resilience and, ultimately, a robust society. Download the Life science book and gain insights that will help your organization strengthen its robustness, meet regulations such as DORA and NIS2, and create security in the digital future.",
        "post_type": "page",
        "meta_description": "The life science book shows how organizations can combine proactive security & regulatory compliance to protect sensitive patient data, healthcare systems & research.",
        "excerpt": "",
        "modified_at": "2026-04-22T06:47:47+00:00"
    },
    {
        "title": "Jonas Hasselberg appointed as new President and CEO of Omegapoint",
        "url": "/en/articles/jonas-hasselberg-appointed-new-president-and-ceo-of-omegapoint/",
        "content": "AB Omegapoint's Board of Directors has appointed Jonas Hasselberg as the new President and CEO. He will succeed the company's founder Johan Malmliden, who will transfer to the company's board. Jonas Hasselberg was most recently CEO of the listed company Proact AB, a leading IT company that delivers business-critical cloud solutions to large companies in Europe. He has previously held global leadership positions at Telia in Sweden, Nokia in Finland and Microsoft in the US. - \"We are very pleased that Jonas has agreed to lead Omegapoint, and that the current CEO Johan Malmliden will continue to contribute to the board work. We believe that Jonas has the right background, drive and leadership to take Omegapoint to the next level, says Eva Elmstedt, Chairman of the Board of Omegapoint. - It is with great pleasure that I look forward to becoming part of Omegapoint. The company has a leading market position in cybersecurity and digitalization, thanks to its strong focus on competence, culture and customers. With an impressive history of innovation and success, I am proud to join this sharp and committed organization. As cybersecurity and digitalization become increasingly important for all businesses, I look forward to being part of Omegapoint's contribution to a safe digital society,\" says Jonas Hasselberg. Johan Malmliden, the company's founder and outgoing CEO, welcomes Jonas to his new role: - It feels great to be able to hand over the leadership to Jonas Hasselberg, who has an impressive expertise and experience in cybersecure digitalization and business building. I look forward to joining the board and supporting Jonas in his new role. I am convinced that Jonas will do an excellent job in leading the company into the future. Jonas Hasselberg will take up his role in AB Omegapoint in the spring, on June 16, 2025 at the latest.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "AB Omegapoint's Board of Directors has appointed Jonas Hasselberg as the new President and CEO. He will succeed the company's founder Johan Malmliden, who will transfer to the company's board. Jonas Hasselberg joins Omegapoint from his role as CEO of the listed company Proact AB, a leading IT company that delivers business-critical cloud solutions to large companies in Europe. He has previously held global leading [...]",
        "modified_at": "2026-04-21T11:53:02+00:00"
    },
    {
        "title": "Russian roulette with Swedish IT security",
        "url": "/en/articles/russian-roulette-with-swedish-it-sakerhet/",
        "content": "This text was first published in Dagens Industri on January 22, 2025 To promote digital security for businesses and organizations, we need to do what it takes to close the gap in security maturity among companies. For this, concrete support measures are needed, writes Johan Malmliden, President and CEO of Omegapoint. In an uncertain time of war in Europe and the Middle East, where organized cyber warfare has become increasingly common, Sweden cannot afford to stand idly by, writes Johan Malmliden, President and CEO of Omegapoint. New figures from the Swedish Security Index 2025, released by IT security company Omegapoint in February, reveal significant security gaps at small and medium-sized Swedish companies. 59 percent lack a functioning supplier management policy and 41 percent rely on external certifications to manage security risks at their suppliers. In an era of cyber warfare, where smaller and specialized IT companies play a key role in business supply chains, we now need to take a holistic approach with the resilience of the entire chain in focus. Business outsourcing and largely dependent on subcontractors today create long and complex supply chains. According to the MSB's report Threats to digital supply chains, this applies in particular to information flows, software and hardware, and digital services. Subcontracting and increased specialization among IT suppliers have created a landscape that the MSB describes as \"a web of niche players\" - where different IT companies contribute unique expertise that creates potentially dangerous dependencies. If your business is procuring an IT system today, you can expect a number of suppliers with specialized expertise to have designed the different parts of the system. If one of these actors, for example a smaller supplier with limited resources and poor security practices, is exposed to a cyber attack, it could lead to a total IT collapse of the entire supply chain. The Solarwinds hack in 2020 is a terrifying example. There, a threat actor managed to plant malware in the Orion monitoring tool of the US IT company Solarwind. As a result, up to 18,000 users, including several US government agencies and large corporations, risked having their digital networks destroyed when they downloaded a malware update. Back home in Sweden, we saw a similar incident at Tietoevry last year. The IT provider, which manages sensitive data and digital services for a number of Swedish businesses, was hit by a ransomware attack that resulted in multiple downtime and potential data leaks for their clients, including Rusta, Filmstaden, Region Uppsala and Systembolaget. The vulnerability risk of digital supply chains is thus not a new problem. The fact that supply chains are becoming long and complex is arguably a necessary evil, with the modern economy's promotion of specialization and outsourcing. However, what we see in the Swedish Security Index 2025 is that the difference in security maturity between small and large players is becoming increasingly striking. Larger companies have the resources to audit their suppliers, set requirements and implement secure procedures. Smaller businesses, with limited budgets and skills, often have to rely on certifications - which can be insufficient. The Swedish Security Index 2025 shows that 41% of SMEs rely on certifications to manage third-party risks, compared to 30% of larger companies. The gap between these groups is growing, creating significant differences in supply chain security protection. The threat actors are aware of this. By attacking a small player in the supply chain, they gain access to larger businesses a few steps down the line. As a result, small businesses are forced to defend themselves against threats that are actually directed at their customers or clients. This is not sustainable. We must therefore stop viewing security as isolated to our own business and start considering the resilience of the entire supply chain as crucial. With the Security Protection Act and the upcoming Cybersecurity Act, Sweden has taken important steps in the right direction. These regulations can be a driver for improvement, but only if they are properly implemented and followed up. Improving security in practice requires a holistic approach, where every part of the supply chain can be audited and secured. To ensure that even the smallest IT suppliers in the chain comply with security requirements, the following is needed: Companies and organizations need to set clear requirements when purchasing IT services, and do their own due diligence when selecting suppliers. Governments and larger companies need to ensure that smaller suppliers receive the guidance and resources they need to build their security practices. In an uncertain time of war in Europe and the Middle East, where organized cyber warfare has become increasingly common, Sweden cannot afford to stand idly by. To promote digital security for businesses and organizations, we must do what it takes to close the gap in security maturity among businesses. For this, concrete support measures are needed. The alternative is to continue playing Russian roulette with Sweden's cyber security. The question is: can we afford to take that risk?",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Texten publicerades först i Dagens Industri den 22 januari 2025 För att främja digital säkerhet för företag och organisationer måste vi göra det som krävs för att minska gapet i säkerhetsmognad bland företag. För detta behövs konkreta stödåtgärder, skriver Johan Malmliden, vd och koncernchef Omegapoint. I en osäker tid med krig i Europa och Mellanöstern, där […]",
        "modified_at": "2026-04-21T11:53:02+00:00"
    },
    {
        "title": "Is DeepSeek safe?",
        "url": "/en/articles/ar-deepseek-things/",
        "content": "In recent days, the company DeepSeek has launched its AI model DeepSeek-R1, which has attracted a lot of attention. It is technically interesting, but its origins in a Chinese company have created uncertainty about how to use it. Using online services - always a risk First, one should always be careful when using online services. The data sent to the service's servers can, in principle, be used by the service provider to do whatever it wants, especially in the case of free customers. As a paying customer, you have a contract with the service, which may state that they will not store or otherwise use the data you send them. Such clauses are quite common. However, as with any promise, you need to consider how much you trust them. The risk of data being used in other ways or shared with other actors must also be taken into account. Technology companies sometimes work closely with their countries' military and security services, which may be an aspect to consider. Using online services - always a risk If you are running on your own hardware, the situation is slightly different. DeepSeek-R1 is so easy to run that it can be downloaded and run with reasonable effort. There have been examples of people running it on a stack of Mac Minis, which is both creative and impressive. Shouldn't this be risk-free? Well, yes. An AI model of this type consists not only of data (the weights it learned for all its parameters during training) but also of code. In this code, there could theoretically be technical backdoors - for example, functions that pick data and send it somewhere else. Code from external sources - always a matter of trust The risk of hidden features is of course not unique to this case. As soon as you install code written by someone else, you trust that it does not contain unexpected features. We trust whoever provided the operating system, whoever developed the word processor or spreadsheet program, and whoever is behind all the nifty little tools we regularly install. But this trust is never a given - and that goes for AI models too. Safeguards - sandbox and monitoring If you are running an AI model, or other software that you are not completely sure about, it should be done in a sandbox where you closely monitor what it does. For example, you should check if the model tries to connect to the network or save data to disk. There may also be hidden functions that are activated only after a certain time or at specific events. Open source reduces risk, but does not eliminate it Because DeepSeek-R1 is open source the risk of hidden features is likely to be slightly lower. So far, there have been no such discoveries reported, neither for R1 nor the previously released V3. It would also be extremely damaging to DeepSeek's reputation if they were caught sneaking Trojans into a model that has received so much attention. Conclusion - \"it depends\" So, is DeepSeek safe? As always, the answer is: it depends. It depends on the data you use. It depends on the operating environment in which you run the model: hosted by someone else, in a cloud where you install it yourself, or on-premises. It depends on how you monitor it. It depends on other aspects that are unique to you and your use. For all these factors, you need to analyze what threats exist and what could be exposed. DeepSeek is definitely not something to be trusted blindly, but there are certainly ways to try the model and evaluate its performance.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "In recent days, the company DeepSeek has launched its AI model DeepSeek-R1, which has attracted a lot of attention. It is technically interesting, but its origins in a Chinese company have created uncertainty about how to use it. Using online services - always a risk First, one should always be careful when using online services. The data [...]",
        "modified_at": "2026-04-21T11:53:02+00:00"
    },
    {
        "title": "Business Outlook February 2025",
        "url": "/en/articles/about-the-world-in-february-2025/",
        "content": "Omegapoint's round-up summarizes a selection of the security and cybersecurity events that have taken place over the past month. Security events in the world 1. US imposes high tariffs on major trading partners123 On February 1, President Donald Trump signed an executive order imposing 25% tariffs on imports from Canada and Mexico, and 10% tariffs on China, with an exception for energy imports from Canada, where 10% would apply. These measures were mainly motivated by political reasons, to limit the flow of drugs - in particular fentanyl, and illegal immigrants to the United States. The countries concerned responded by planning countermeasures. Canadian Prime Minister Justin Trudeau tells a press conference that they will impose 25% tariffs on US goods. Economists have warned that the tariffs could hurt growth and drive up inflation, as they are paid for primarily by importers who can pass the costs on to consumers. 2. US and Russia start negotiations on Ukraine456 On February 12, President Trump announced that he had a productive phone call with Russian President Vladimir Putin, in which they agreed to start talks to end the war in Ukraine. The US President said he had asked US Secretary of State Marco Rubio, CIA Director John Ratcliffe, National Security Advisor Michael Walz and US Special Envoy Steve Witkoff to lead the negotiations. The Kremlin confirms that Vladimir Putin and Donald Trump have spoken and says that the conversation lasted an hour and a half. It also confirms that the two leaders agreed to meet, Reuters reports. 3. European leaders' emergency meeting on security and Ukraine789 After US President Donald Trump initiated talks with Russia without involving Europe or Ukraine, French President Emmanuel Macron convened an emergency meeting in Paris on February 17. Leaders from France, Germany, the UK, Italy, Poland, Spain, the Netherlands, Denmark, representing the Nordic and Baltic countries, as well as representatives from the EU and NATO attended. Discussions focused on the possibility of sending a peacekeeping force to Ukraine and the need to strengthen Europe's defense capabilities in light of the uncertainty surrounding US support. The meeting revealed disagreement among countries on the deployment of European troops in Ukraine, but agreement on the need for increased defense funding and cooperation. 4. The changing US position at the UN on Ukraine101112 On 24 February, on the third anniversary of Russia's large-scale invasion of Ukraine, the United States voted against a UN General Assembly resolution calling for a Russian withdrawal from Ukraine. For the first time since the start of the war, the United States and its European allies are on different sides at the UN. 5. President Zelenskyj's visit to the White House1314 On February 28, Ukrainian President Volodymyr Zelensky visited the White House for a meeting with US President Donald Trump. The meeting, held in the Oval Office, was scheduled to discuss an agreement on Ukrainian natural resources in exchange for US aid. However, the meeting became tense and was abruptly canceled after Trump and Vice President JD Vance openly criticized Zelensky. This led to the Ukrainian delegation leaving the White House without any agreement being signed. Cybersecurity events 1. Major hacker attack against crypto exchange Bybit151617 On February 21, 2025, the Dubai-based crypto exchange ByBit was hit by a major hacker attack in which $1.5 billion in Ethereum was stolen. CEO Ben Zhou writes on the platform X that a hacker took control of assets and sent them to an unidentified address. Bybit has said it can cover the losses. The attack is believed to be linked to a North Korean hacker group, according to the FBI. 2. Arrests of key people behind ransomware groups18 On February 11, Europol announced the arrest of key individuals behind the Phobos/8Base ransomware-as-a-service in an international cybercrime operation. These individuals, all Russian nationals, are suspected of using a variant of the Phobos ransomware to extort high ransoms from victims across Europe and beyond. At the same time, 27 servers linked to the criminal network were taken down. 3. US imposes sanctions on hosting provider for ransomware1920 On February 11, the United States imposed sanctions on a hosting provider Zservers that provided services to ransomware group LockBit. The company Zservers offers so-called bulletproof hosting - a service that allows cybercriminals to evade law enforcement while renting IP addresses, servers and domains to spread malware, create botnets and perform other tasks related to fraud and cyberattacks. Sanctions aim to disrupt the infrastructure used by cybercriminals to carry out attacks. 4. Approximately 1500 customers affected by Nordnet's IT problems2122 In February, the online broker Nordnet was hit by serious IT problems that affected customers throughout the Nordic region. The incident meant that some customers, when logging in, gained access to other users' account information, including share and fund holdings. This led to Nordnet temporarily shutting down its services to investigate and fix the problem. Approximately 1,500 customers were affected, of which about 200 in Sweden, 500 in Finland, 500 in Denmark and 350 in Norway. According to Nordnet, the problems were due to an internal software component linked to the login function, with no signs of external influence or cyberattack. 5. Government's proposed data retention law - Signal considers leaving the Swedish market23 In February 2025, the encrypted messaging app Signal announced that it is considering leaving the Swedish market if the government's proposed data retention law is adopted. The bill, which is scheduled to be considered in Parliament in March 2026, would require messaging services such as Signal and WhatsApp to store all communications that take place through their platforms. Signal's chief executive, Meredith Whittaker, expressed concern that such a requirement would mean breaking the end-to-end encryption that is central to Signal's service. She emphasized that the introduction of so-called \"backdoors\" would undermine the company's entire architecture and compromise user privacy. The purpose of the bill is to give law enforcement authorities, such as the Security Service and the police, the opportunity to subsequently access the message history of persons suspected of crimes. However, the Swedish Armed Forces have expressed criticism of the proposal. They have recently urged their personnel to use Signal to reduce the risk of interception and argue that the bill could introduce vulnerabilities that could be exploited by unauthorized third parties. Reference list https://www.svt.se/nyheter/utrikes/usa-infor-tullar-mot-kanada-mexiko-och-kina-pa-lordag ︎ https://www.whitehouse.gov/fact-sheets/2025/02/fact-sheet-president-donald-j-trump-imposes-tariffs-on-imports-from-canada-mexico-and-china/ ︎ https://www.bbc.com/news/articles/cn4z23kndlyo ︎ https://www.svt.se/nyheter/utrikes/trump-och-putin-overens-om-att-inleda-forhandlingar-om-ukraina ︎ https://www.svd.se/a/dRQOy1/usa-och-ryssland-inleder-forhandlingar-om-kriget ︎ https://edition.cnn.com/2025/02/18/europe/us-russia-riyadh-talks-intl/index.html ︎ https://www.svt.se/nyheter/utrikes/europeiskt-toppmote-i-paris-efter-usas-kalla-hand ︎ https://www.europaportalen.se/2025/02/europa-i-krismote-efter-usa-utspel-om-ukraina ︎ https://www.reuters.com/world/europe/macron-host-european-leaders-meeting-ukraine-monday-says-french-minister-2025-02-16/ ︎ https://www.europaportalen.se/2025/02/dramatiskt-minskat-fn-stod-ukraina-usa-rostade-med-ryssland ︎ https://edition.cnn.com/2025/02/24/politics/us-joins-russia-ukraine-un-vote/index.html ︎ https://news.un.org/en/story/2025/02/1160456 ︎ https://www.svt.se/nyheter/utrikes/storbrak-i-vita-huset-spelar-med-tredje-varldskriget ︎ https://www.dn.se/varlden/detta-har-hant-braket-i-vita-huset/ ︎ https://www.theguardian.com/world/2025/feb/27/north-korea-bybit-crypto-exchange-hack-fbi ︎ https://www.nyteknik.se/it-sakerhet/kryptobors-forlorade-cirka-15-miljarder-i-cyberattack/4335874 ︎ https://www.virtune.com/sv/insights/bybit-hack-2025 ︎ https://www.europol.europa.eu/media-press/newsroom/news/key-figures-behind-phobos-and-8base-ransomware-arrested-in-international-cybercrime-crackdown ︎ https://therecord.media/zservers-russia-bulletproof-hosting-us-uk-sanctions ︎ https://cyberscoop.com/zservers-bulletproof-hosting-sanctions-lockbit-ransomware/ ︎ https://www.dn.se/ekonomi/nordnet-ligger-nere-drabbat-av-lacka/ ︎ https://www.expressen.se/ekonomi/aktier-och-bors/nordnet-1500-kunder-drabbades/ ︎ https://www.svt.se/nyheter/inrikes/signal-lamnar-sverige-om-regeringens-forslag-pa-datalagring-klubbas ︎",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Omegapoints omvärldskoll sammanfattar ett urval av de säkerhetshändelser och händelser inom cybersäkerhet som skett senaste månaden. Säkerhetshändelser i världen 1. USA inför höga tullar mot största handelspartnerna123 Den 1 februari undertecknade president Donald Trump en presidentorder som införde 25-procentiga tullar på import från Kanada och Mexiko, samt 10-procentiga tullar mot Kina. Undantag gjordes för energiimport från […]",
        "modified_at": "2026-04-21T11:53:01+00:00"
    },
    {
        "title": "Omegapoint named Azure Partner of the Year 2024",
        "url": "/en/articles/omegapoint-named-azure-partner-of-the-year-2024/",
        "content": "ALSO is Microsoft's largest distributor in Sweden. On March 20, ALSO Cloud Connect took place at Nalen in Stockholm, and we at Omegapoint are very proud of our award. For the second year in a row, Omegapoint has been named Azure Partner of the Year at ALSO Cloud Connect. The nomination read: This award is given for outstanding commitment and impressive achievements as an Azure Partner in 2024. Through innovative solutions, deep expertise and a strong commitment to delivering first-class cloud-based services, it has demonstrated not only technical prowess but also an ability to create significant value for its customers. With a focus on customer satisfaction and strategic thinking, it has successfully implemented and optimized Azure solutions, helping to drive growth and efficiency. ALSO is proud to award the Azure Partner of the Year 2024 to Omegapoint and thanks for the good cooperation during the past year. Natalia Aparicio Cavero, Head of Consumptional Business, ALSO To read more about our Cloud offering, visit https://omegapoint.se/cloud",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "ALSO is Microsoft's largest distributor in Sweden. On March 20, ALSO Cloud Connect took place at Nalen in Stockholm, and we at Omegapoint are very proud of our award. For the second year in a row, Omegapoint has been named Azure Partner of the Year at ALSO Cloud Connect. The nomination read: This award is given [...]",
        "modified_at": "2026-04-21T11:53:01+00:00"
    },
    {
        "title": "Business Outlook March 2025",
        "url": "/en/articles/the-world-map-march-2025/",
        "content": "Omegapoint's round-up summarizes a selection of the security and cybersecurity events that have taken place over the past month. Security events in the world 1. Security situation in Sweden remains serious 1 On March 11, 2025, the Swedish Security Service reported that Sweden's security situation remains serious, with a clear risk of further deterioration. Foreign powers are intensifying their security threatening activities through a combination of traditional and hybrid methods, with the aim of destabilizing both Sweden and Europe. These activities include, among other things, illegal intelligence activities, influence operations, cyber attacks and theft of technology and knowledge. In addition, there are reports of increased targeting of critical actors and threats against dissidents. 2. Serious White House security leak revealed2 In March 2025, a serious security incident occurred in the United States government, where top-secret military plans were accidentally shared with a journalist. The editor-in-chief of The Atlantic, Jeffrey Goldberg, was inadvertently added to an encrypted Signal chat in which senior officials, including Vice President JD Vance and Secretary of Defense Pete Hegseth, discussed an impending attack on Houthi rebels in Yemen. Goldberg initially thought the chat was a hoax, until the March 15 attack, which killed more than 50 people. The incident has raised questions about government security practices, with experts warning that the use of commercial messaging apps for sensitive communications could constitute a breach of law. 3. Trump signs order to dismantle US Department of Education3 President Donald Trump has issued an executive order aimed at dismantling the federal Department of Education, an institution long contested by conservatives. Around half of the 4,000 employees have already been let go. Trump argues that the responsibility for education should lie with the states and has pointed to the Nordic countries' school systems as a model. While he cannot dismantle the department without congressional approval, he can limit its function through administrative action. Established in 1979, the department has handled student loans and support programs for low-income families, but its future is now uncertain. Cybersecurity events 1. Sportadmin breached - two million Swedes' data leaked45 In January, Sportadmin suffered a data breach by a criminal hacker group, resulting in the leakage of information about two million Swedes onto the darknet. Among those affected were people with protected personal data, high-ranking politicians and even members of the royal family. On March 18, the Swedish Authority for Privacy Protection (IMY) announced that it has not cleared Sportadmin of wrongdoing in the ongoing investigation into the personal data leak. According to IMY, media reports that Sportadmin has been cleared are incorrect. The case is still open, and IMY has received about 20 complaints. The fact that no immediate action is taken does not mean that everything is deemed correct, and supervision can be initiated later. 2. New national cybersecurity strategy 2025-20296 On March 20, the government presented a new national strategy for cyber security. The strategy sets out the direction for Sweden's work on cyber security in the coming years and aims to strengthen the country's resilience to cyber threats. 3. Increased global spending on cybersecurity7 An analysis by IDC, published in March, predicts that global spending on cybersecurity will increase by 12.2% in 2025. This increase is attributed to increasingly complex and frequent cyber threats, amplified by advances in artificial intelligence. 4. Cyberattack against platform X 89 On March 10, Elon Musk's platform X was hit by a major cyberattack that led to disruptions. Several groups, including Anonymous and Dark Storm, claimed responsibility for the attack, highlighting the complexity of threats to digital platforms. 5. Data breach in Oracle1011 The Federal Bureau of Investigation (FBI) is investigating the cyberattack against Oracle, which has led to the theft of patient data, Bloomberg News has reported. In March 2025, Oracle informed some of its healthcare customers of a data breach in which hackers had gained unauthorized access to legacy servers and copied patient data. The FBI has launched an investigation into the incident, and it is reported that the attackers have tried to blackmail several medical providers in the US based on the stolen data. https://www.sakerhetspolisen.se/ovriga-sidor/nyheter/nyheter/2025-03-11-orolig-omvarld-skapar-hot-i-sverige.html ︎ https://www.svd.se/a/qPMy1m/pete-hegseth-i-topphemliga-chatten-vi-borde-korahttps://www.tv4.se/artikel/4eyD6ZBMwJuhv3xMCj7wpB/ministrarna-doems-ut-som-amatoerer-av-experter-kommer-haenda-igen︎ https://www.ui.se/landguiden/lander-och-omraden/nordamerika/usa/kalendarium/2025/mars/https://omni.se/trump-stanger-ner-utbildningsdepartementet/a/dRBX8X︎ https://www.imy.se/nyheter/sportadmin-fortfarande-oppet-arende-hos-imy/ ︎ https://www.dn.se/sverige/expert-sportadmin-bor-granskas-efter-lackan/ ︎ https://www.regeringen.se/regeringens-politik/cybersakerhet ︎ https://computersweden.se/article/3853671/utgifterna-for-cybersakerhet-okar-rejalt.html ︎ https://www.svt.se/nyheter/utrikes/flera-grupper-tar-pa-sig-jatteattack-mot-x ︎ https://www.aktuellsakerhet.se/cyberattacken-mot-x-ett-led-i-att-destabilisera-digital-infrastruktur/ ︎ https://www.reuters.com/technology/fbi-investigating-cyberattack-oracle-bloomberg-news-reports-2025-03-28/ ︎ https://www.hipaajournal.com/oracle-health-data-breach/ ︎",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Omegapoints omvärldskoll sammanfattar ett urval av de säkerhetshändelser och händelser inom cybersäkerhet som skett senaste månaden. Säkerhetshändelser i världen 1. Fortsatt allvarligt säkerhetsläge i Sverige 1 Den 11 mars 2025 rapporterade Säkerhetspolisen att Sveriges säkerhetsläge är fortsatt allvarligt, med en påtaglig risk för ytterligare försämring. Främmande makter intensifierar sin säkerhetshotande verksamhet genom en kombination av traditionella och […]",
        "modified_at": "2026-04-21T11:53:00+00:00"
    },
    {
        "title": "From butterfly wings to cyber risks: The link between chaos theory and information security",
        "url": "/en/articles/from-remote-wings-to-cyber-risks-the-link-between-chaos-theory-and-information-security/",
        "content": "In our digitally connected world, a weak password, a careless click on a phishing link or an out-of-date system can set off a chain reaction with major consequences. Just like the butterfly effect, where the flap of a butterfly's wings in Brazil is said to trigger a tornado in Texas. In this article, we explore the impact of the remote effect on information security and how we can minimize risks without being unnecessarily costly or inefficient for the business. The Butterfly Effect and information security The butterfly effect, discovered by Edward Lorenz in the 1960s, is a central idea in chaos theory. It is about how small changes in weather models can lead to dramatically different forecasts. The metaphor of a butterfly's wingbeat triggering a tornado symbolizes how small, initial changes can have big consequences. Just like weather models, information security is a complex system involving many factors, such as firewalls, antivirus software, user behavior and even third-party security policies. A small vulnerability, such as a misconfigured firewall, an out-of-date system or human error, can set off a chain reaction of serious incidents. A recent example of this is the Okta breach incident in October 2023, where stolen credentials for the company's support management system triggered a chain reaction that affected third parties such as 1Password and Cloudflare. The result was damaged trust and extensive financial losses. Another example is the failed CrowdStrike system update in August 2024, which reportedly affected 8.5 million computers globally. The cloud-based nature of the platform amplified the impact and showed how dependencies on centralized systems can lead to catastrophic failures across multiple industries. The NIS Directive also builds on the realization that small vulnerabilities in critical services can have far-reaching consequences for society as a whole. Therefore, the Directive requires Member States and organizations to proactively identify and manage risks that may affect security across the EU. Preventive actions Understanding how a small vulnerability in a complex system can lead to unpredictable consequences is crucial to minimize risks. This requires the implementation of appropriate measures that can manage risks. Few people would question that a low level of security can lead to major consequences, but a very high level of security is not necessarily efficient or effective. Excessive security measures or complex procedures are not only costly for the organization, but if they are not tailored to the end user, they can also lead to inefficiencies and phenomena such as security fatigue - a phenomenon where employees become overwhelmed by complex requirements and start ignoring security procedures. In order to minimize the negative consequences of the remote effect in information security and identify the security measures best suited to our business, the following actions should be considered: Risk-based security strategy By assessing risks, organizations can prioritize them according to their severity and define a risk treatment plan. Depending on the level of risk and organizational circumstances, appropriate security measures can be selected. For example, to reduce the risk of weak passwords, one can choose to implement a complex password policy or alternatively Single Sign-On (SSO) or adaptive authentication, which can also reduce the burden on employees. Education and awareness Information security is not just the job of the IT department or security specialists. If an employee falls victim to a sophisticated AI-generated scam call or a phishing attack, the organization can face serious consequences. Regular training and awareness-raising, which integrates security practices into daily work, helps employees understand and comply with security requirements without feeling overwhelmed. Engaging programs, such as gamification, can also make learning more effective. Smart solutions It is difficult to protect against threats from new technologies, such as AI-driven intrusions, with legacy technologies. Smart solutions, such as AI, not only streamline security but also reduce the risk of human error. Examples include log monitoring, Intrusion Detection Systems (IDS) and User and Entity Behavior Analytics (UEBA), which can reduce workloads while increasing both efficiency and security. Feedback and continuous improvement Information security measures should be continuously evaluated and adapted to new vulnerabilities, threats and business needs. By gathering feedback from stakeholders, organizations can adapt their strategies and find opportunities for continuous improvement to balance security and efficiency. In other words, the appropriateness and adequacy of security measures should be ensured regularly. In information security, there are no insignificant risks - any weakness can have far-reaching consequences. Therefore, we need to carefully identify, assess and manage risks before consciously accepting them. At the same time, we need to find the optimal balance between security and efficiency. Does your business want help to avoid the major consequences of the butterfly effect? At Omegapoint, we can help you with risk analysis, safety training and solution proposals. Read more about our offers here: https://omegapoint.se/vrt-erbjudande",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "I vår digitalt sammanlänkade värld kan ett svagt lösenord, ett slarvigt klick på en nätfiske-länk eller ett ej uppdaterat system starta en kedjereaktion med stora konsekvenser. Precis som i fjärilseffekten där en fjärils vingslag i Brasilien sägs kunna utlösa en tornado i Texas. I den här artikeln utforskar vi hur fjärilseffekten påverkar informationssäkerhet och hur […]",
        "modified_at": "2026-04-21T11:53:00+00:00"
    },
    {
        "title": "Cybersecurity - a strategic business issue",
        "url": "/en/articles/cybersecurity-as-a-strategic-business-issue/",
        "content": "Margarita Sallinen and Daniel Lilliehöök This article was first published in Current Security April 14, 2025 Sweden is one of the most connected countries in the world, which creates great business opportunities for companies, but also greater exposure to cyber threats. With increasing threats and stricter requirements from both EU regulations and the Swedish government, cybersecurity has become a priority for more and more businesses. Management teams have become more aware of the importance of cybersecurity, and many companies are hiring cybersecurity experts and consultants to address these challenges. Nevertheless, a key question remains: what role should management play in cybersecurity? From IT issue to business strategy decision A common misconception today is that cybersecurity is only about technology and IT systems, but in reality it is a business strategy issue that directly affects business continuity, profitability and trust. Business leaders who see cybersecurity as an integral part of its business strategy are better placed to manage both financial and operational risks. This is not only about protecting against cyber attacks, but also about ensuring that investments in cybersecurity help reduce risks in a cost-effective way. What does this mean in practice? Cybersecurity is fundamentally about risk management, similar to other forms of risk management. Like financial and operational risks, cybersecurity risks need to be carefully analyzed and prioritized based on their impact on business operations. Management has a crucial responsibility to govern and integrate cybersecurity risks into the overall business risk management strategy. This is to ensure that the organization - and therefore the business - can continue to function despite cyber attacks, data breaches or other cyber threats. Questions that management should ask themselves include: - How does a cyberattack affect our ability to deliver our services? - What are the costs of an outage or data leak? - How much less risk do we get for the money we invest in cybersecurity? Being hit by ransomware is a concrete example of a business-critical risk linked to cyber threats. It is one of the biggest cyber threats to businesses today and is considered by many as the biggest and most urgent single risk. Ransomware attacks can cause serious financial losses through, for example, business interruption, loss of revenue and legal consequences. In addition, a ransomware attack can lead to legal and regulatory penalties for non-compliance. By integrating cybersecurity into the overall risk management strategy, management can prevent and manage this type of risk more effectively. Cybersecurity as an investment, not a cost A structured approach to cybersecurity helps management take control of the costs of security. Instead of investing in the latest technology without a clear link to business benefits, the business can focus on investing in the measures that reduce the greatest risks. Measuring the effectiveness of cybersecurity efforts - and demonstrating how they are protecting the business from financial loss - is key to engaging in a more strategic dialog at the executive level. How to work in a systematic and continuous way? Incorporating information security as an integral part of the organization's management system, for example by implementing an ISO/IEC 27001 information security management system (ISMS), is a way to give management the power to control, measure and monitor security efforts. It gives the work the right business perspective and provides clarity on why different cybersecurity measures are implemented and how they contribute to the overall business objectives. A strategic issue for the future New regulations, such as the NIS2 Directive and the upcoming Cybersecurity Act, also increase the requirements for management accountability. For many organizations, this means that cybersecurity issues can no longer be delegated to the IT department. Instead, it's about understanding how digital risks affect the business and engaging at the right level. Organizations whose leaders take cybersecurity seriously today and integrate it into their business strategy will be better prepared for the cyber threats of the future. By ensuring that cybersecurity is part of their business strategy, they can not only protect their business - but also create the conditions for profitability and growth. Margarita Sallinen, Information Security Specialist, OmegapointDaniel Lilliehöök, Senior Information Security Specialist, Omegapoint",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Margarita Sallinen och Daniel Lilliehöök Artiklen publicerades först i Aktuell Säkerhet den 14 april 2025 Sverige är ett av de mest uppkopplade länderna i världen, vilket skapar stora affärsmöjligheter för företag, men också en större exponering för cyberhot. Med ökande hotbild och skärpta krav både från EU-regelverk och den svenska regeringen har cybersäkerhet blivit en prioriterad fråga […]",
        "modified_at": "2026-04-21T11:52:59+00:00"
    },
    {
        "title": "State of the world with Sandra Barouta Elvin",
        "url": "/en/articles/the-world-team-with-sandra-barouta-elvin/",
        "content": "From left in the picture: Linda Nieminen, Sandra Barouta Elvin, Margarita Sallinen As the world undergoes geopolitical and economic changes, cybersecurity is greatly affected. Margarita Sallinen and Linda Nieminen, cybersecurity specialists at Omegapoint, invited Sandra Barouta Elvin, National Security Manager and Chief Security Officer at Microsoft, to discuss the tumultuous state of the world and its impact on cybersecurity. Sandra describes how cyber threats evolve with global changes and geopolitical tensions. During stable and peaceful periods, risks are generally lower, but when societies experience insecurity and conflict, we see a clear increase in cyber threats from both criminal actors and state-sponsored cyber attacks. Cybersecurity in turbulent times Sandra reflects on how global developments in recent years have contributed to a negative trend where cyber threats have increased. Historically, when conflicts flare up in the analog world, intelligence agents are sent to gather information and infiltrate adversaries. In today's digital era, we see the same phenomenon in the cyber domain, where state actors conduct sophisticated cyber attacks to gather intelligence and influence other nations. In addition to politically motivated cyberattacks, traditional cybercriminals are also taking advantage of the unstable environment to carry out fraud and attacks against businesses and individuals. In times of uncertainty, it becomes easier for these actors to conceal their activities and manipulate information, leading to an increased risk of breaches and financial losses. The new US administration and cybersecurity With a new administration in the United States, the cybersecurity landscape has changed, and some priorities have shifted. The US administration has issued new directives to US cybersecurity authorities, changing the focus and downplaying Russia as a leading cyber threat actor. Previously, Iran, China and Russia were the top three declared threats, but now Russia is no longer mentioned to the same extent. This raises questions about the strategy behind the decision and its implications for global cybersecurity. We do not know whether this is due to a possible agreement between the United States and Russia or whether there are other reasons behind it. For Europe, this is particularly relevant as Russian cyber activities are largely directed against European targets. How are Sweden and Europe affected? The consequences for Sweden and Europe may vary depending on how the global situation develops. We discussed this with Sandra and came to the conclusion that it is difficult to say exactly, but you can envision different scenarios. In the best case scenario, the US and Russia have agreed on a ceasefire, which could contribute to stability. In the worst case scenario, no ceasefire has been agreed, only that the US is not a target. This could mean that Russia reallocates its cyber resources from the US to Europe, which could lead to an increase in the threat level here. Another important aspect is that the US, or more specifically the FBI, has long played a central role in prosecuting cyber criminals and disrupting malicious infrastructure, both from criminal networks and state actors. If this work slows down, it risks weakening the global fight against cybercrime. How well equipped is Sweden? \"We are better equipped than many people think, but we still have a lot to do,\" says Sandra. She points out that both individuals and businesses have become more aware of cybersecurity and have become better at protecting themselves. Today, more people use two-factor authentication and other security measures. Technology also helps us understand when our passwords might be compromised. For businesses, the high-profile cyberattacks of recent years have contributed to an increased willingness to invest in security solutions. \"We see that businesses are increasingly taking cybersecurity seriously, both because of actual incidents and the new legal requirements that have been introduced,\" says Sandra. At the same time, we noted that further collaboration between the state, public authorities and private actors is needed to improve cybersecurity. We have upcoming new legislation, the NIS2 (Cybersecurity Act), which places higher demands on society-critical activities. But cybersecurity is a shared responsibility - it is not only the state and companies that have a responsibility - we as individuals must also be aware of security threats and take the right measures to protect ourselves and our workplaces. Increased regulation and shared responsibilities are important steps towards a safer digital environment - but to understand how best to protect ourselves, we also need to know what threats we face. Cyberattacks are becoming increasingly sophisticated, but what do they really look like today? What trends dominate? What do methods like password spraying mean? And could Sweden become a pawn in the cyber warfare of the major powers - or are we already? Stay tuned for our next article where we dive into these questions! The interview is based on a podcast recording made by Cyber Chats & Chill, which is an initiative of the Voluntary Radio Organization (FRO) to strengthen Sweden's cyber security. You can listen to the full episode HERE.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Från vänster i bild: Linda Nieminen, Sandra Barouta Elvin, Margarita Sallinen I takt med att världen genomgår geopolitiska och ekonomiska förändringar påverkas cybersäkerheten i hög grad. Margarita Sallinen och Linda Nieminen, cybersäkerhetsspecialister på Omegapoint bjöd in Sandra Barouta Elvin, nationell säkerhetschef och säkerhetsskyddschef på Microsoft, till ett samtal om det tumulta omvärldsläget och dess påverkan på […]",
        "modified_at": "2026-04-21T11:52:59+00:00"
    },
    {
        "title": "Omegapoint climbs the list of Sweden's most attractive employers",
        "url": "/en/articles/omegapoint-climbs-the-list-of-swedens-most-attractive-employers/",
        "content": "Omegapoint is proud to announce that we have taken a big step up in Universum's annual ranking of Sweden's most attractive employers among IT students. For the 37th consecutive year, Universum is conducting a comprehensive talent survey, which shows which companies and organizations Swedish students prefer to work for. In the 2025 Talent Survey, which is based on responses from over 20,000 students in Sweden, we have climbed a full 45 places - clear proof that our work with employer branding and our investment in young IT talents is paying off. The fact that young IT talents see us as an attractive employer strengthens our conviction that we are on the right track to continue building a workplace where continuous skills development, innovation and cybersecure digitization are in focus. \"As the CHRO of Omegapoint, I am happy to share a proud moment with you all. This year we have achieved a significant milestone in Universum's ranking of IT students in Sweden, securing the impressive position #58. I would like to express my heartfelt gratitude to our exceptional colleagues whose dedication and talent have played a crucial role in making Omegapoint not just a place to work, but a thriving environment where individuals can grow professionally and make a meaningful difference.\" Lars Ulslev Johannesen, CHRO, AB Omegapoint Do you also want to be part of Omegapoint? We need a wide range of skills to continue ensuring the development of society. We have a wide range of vacancies. See your future career opportunities here: https://jobb.omegapoint.se/",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Omegapoint is proud to announce that we have taken a big step up in Universum's annual ranking of Sweden's most attractive employers among IT students. For the 37th year in a row, Universum conducts a comprehensive talent survey, which shows which companies and organizations Swedish students prefer to work for. In the 2025 Talent Survey, which is based on responses [...]",
        "modified_at": "2026-04-21T11:52:59+00:00"
    },
    {
        "title": "Exit strategy and diversification - how to minimize risks for Sweden",
        "url": "/en/articles/exit-strategy-and-diversification-so-we-can-minimize-risks-for-sweden/",
        "content": "When contracts no longer apply, when guarantees mean nothing, when we put all our dependencies in the hands of a few companies influenced by a government that may no longer be our strong ally, how will we manage our IT and cybersecurity? At the end of April, Omegapoint's President and CEO Jonas Hasselberg participated in Radar Talk together with Hans Werner and Thom Thavenius. This online conversation discusses the importance of having autonomy over the decisions we make, the strategic importance of diversification and, not least, how we manage and future-proof our most important data. Operating with a high level of autonomy allows us to prevent other actors from influencing our decisions. Listen to the full conversation below. https://vimeo.com/1081460325 Want to hear more about this? During the Almedalen week, Jonas will participate in one of our panel discussions where he will delve into these very issues. Read more about Omegapoint's participation in Almedalen here: https://omegapoint.se/almedalen",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "När avtal inte längre gäller, när garantier inte betyder något, när vi lagt allt vårt beroende i några få bolags händer som påverkas av en statsledning som kanske inte längre är vår starka allierade, hur ska vi då hantera vår it och vår cybersäkerhet? I slutet av april medverkade Omegapoints vd och koncernchef Jonas […]",
        "modified_at": "2026-04-21T11:52:58+00:00"
    },
    {
        "title": "Sweden's digital defense threatened by US whims",
        "url": "/en/articles/swedens-digital-defense-threatened-by-us-whims/",
        "content": "Although the U.S. cybersecurity authority has now temporarily secured continued operation, the course of events shows how extremely vulnerable the system is when it rests on the arbitrariness of a single nation, writes Jonas Hasselberg, CEO of Omegapoint. This article was first published in Industry Today May 6, 2025. At the last minute, the US has temporarily extended support for the world's most important cybersecurity database, the CVE, which is crucial for managing vulnerabilities worldwide. Sweden and the EU must urgently build their own system to protect us against digital vulnerabilities,\" writes Jonas Hasselberg, CEO of Omegapoint. CVE (Common Vulnerabilities and Exposures) is an open, centralized database of discovered security holes in software and systems. It enables IT security companies, organizations and developers to quickly identify, fix and share information about vulnerabilities - before they are exploited. CVE has been instrumental in addressing vulnerabilities such as Heartbleed and Log4Shell, which threatened critical infrastructure, healthcare, financial systems and millions of users worldwide. CVE has been a pillar of digital protection, as fundamental as the fire brigade in physical security. Sweden's digital systems are deeply integrated with US technologies. In practice, we are dependent on real-time data from CVE to respond quickly to security threats. Without the database, we are blind to the threats. The risk of CVE disappearing completely in the next US budget decision is not just theoretical - it is real. Although the US cybersecurity authority has now temporarily secured continued operation, the sequence of events shows how extremely vulnerable the system is when it rests on the arbitrary will of a single nation - especially one where political will can swing sharply overnight. The fact that such a key global tool as CVE was almost lost due to a bureaucratic or ideological retreat in the United States shows that we can no longer trust that our digital protection systems are in safe hands. The extension of funding now implemented is normally for 6-12 months and should not be seen as a commitment to long-term funding. We need a robust alternative. One possible framework to draw inspiration from is the DNS system, which is currently the backbone of how internet addresses are managed globally. The Domain Name System (DNS) is the structure that translates web addresses into IP addresses and is operated by ICANN, a neutral non-profit foundation. ICANN's robust model is funded by membership fees from domain registrars, governed by broad representation from the technology industry, academia, civil society and government, and operated openly and transparently. In a similar way CVE management could be transferred to a global, independent entity - a Global Vulnerability Identifier Authority (GVIA). The GVIA would be funded through membership and contributions from security companies, cloud platforms and public actors such as the EU and the US, governed transparently by a broad-based board of directors, and operated technically in close cooperation with, for example, ENISA (the EU's cybersecurity authority) and CISA (the US cybersecurity and infrastructure security authority). This would reduce vulnerability to political volatility and ensure a long-term stable and impartial response to global cybersecurity threats. With an unstable US administration, where decisions on cybersecurity risk being made on the basis of domestic political gamesmanship rather than global accountability, it is clear that we cannot continue to hope that the US will 'fix it'. When the same administration recently took out the data protection watchdog, the GDPR and our right to digital privacy were threatened. Now it risks happening again - this time to our ability to defend ourselves against cyberattacks. MSB must now take the lead, together with its European counterpart ENISA, to ensure that we build a European CVE - or better yet, take a leading role in building a global solution that is robust, open and free from the whims of individual states. Jonas Hasselberg, CEO Omegapoint",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Även om den amerikanska cybersäkerhetsmyndigheten nu tillfälligt säkrat fortsatt drift, visar händelseförloppet hur extremt sårbart systemet är när det vilar på en enda nations godtycke, skriver Jonas Hasselberg, koncernchef Omegapoint. Denna artikel publicerades först i Dagens Industri 6 maj 2025. I sista sekunden har USA tillfälligt förlängt stödet till världens viktigaste cybersäkerhetsdatabas CVE som är helt avgörande […]",
        "modified_at": "2026-04-21T11:52:58+00:00"
    },
    {
        "title": "Omegapoint events during Almedalen Week 2025",
        "url": "/en/articles/omegapoint-events-during-almedalen-week-2025/",
        "content": "Digital security in Sweden is crucial for both the robustness of society and people's safety. But as cyber threats, digital fraud and disinformation increase, Swedes' confidence in the digital resilience of society is declining. It is clear that Sweden needs to take a new approach - starting with stronger digital skills among citizens and organizations, as well as clearer collaboration between business, the public sector and politics. Therefore, Omegapoint invites you to three important panel discussions during Almedalen Week. On June 24, leading experts from the cybersecurity industry, authorities and academia will discuss how we can work together to strengthen Sweden's digital resilience for 2030. Program 12:30-13:30 - Cybersecure citizens - how do we strengthen the digital resilience of individuals? How do we build digital skills among citizens to respond to cyber threats and disinformation?Participants: Jonas Hasselberg (Omegapoint), Jan Olsson (Swedish Cybercrime Center, Swedish Police Authority), Stefan Axelsson (Stockholm University) and Freddy Jönsson Hanberg (Totalförsvarsstiftelsen). 13:45-14:45 - Cybersecure organizations - digital leadership in an uncertain age How can Swedish businesses and public sector organizations create a strong cybersecurity culture?Participants: Caroline Forssblad (Omegapoint), Dr. Gazmend Huskaj (Geneva Centre for Security Policy), Sandra Barouta Elvin (Microsoft) and Niclas Lamberg (Swedish Transport Administration). 16:00-17:00 - Cybersecure collaboration - how to strengthen digital resilience in the public and private sectors How can more effective collaboration between different sectors strengthen Sweden's protection against cyber threats?Participants: Nils Ågren (Omegapoint), Johanna Parikka Altenstedt (Cybernode, RISE), Karl-Erik Svedin (Tele2) and Erik Gutwasser (Mastercard). The panel discussions will be moderated by Elin Ahldén and will end with a mingling where you will have the opportunity to continue discussions with industry peers and cybersecurity experts. Location: Joda Bar and kitchen, inner courtyard, Skeppsbron 24, VisbyDate: June 24, 2025 Read more about Omegapoint's participation during Almedalen Week here: omegapoint.se/almedalen For questions and further information, please contact Alexandru Al-Qassam at Lennox PR, Alexandru@lennoxpr.se. A warm welcome to you!",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Den digitala säkerheten i Sverige är avgörande för både samhällets robusthet och människors trygghet. Men i takt med ökande cyberhot, digitala bedrägerier och desinformation minskar svenskarnas förtroende för samhällets digitala motståndskraft. Det är tydligt att Sverige måste ta nya grepp – och det börjar med en starkare digital kompetens hos medborgare och organisationer, samt en […]",
        "modified_at": "2026-04-21T11:52:58+00:00"
    },
    {
        "title": "Children, the internet and AI - risks and advice",
        "url": "/en/articles/children-internet-and-ai-risks-and-advice/",
        "content": "Today, not only adults, but also children, have AI as part of their everyday digital lives. Children start to build their digital identity at a young age. This raises many questions to consider, such as what traps they can fall into, how to prevent them and how to make the internet a safe place for all children. Smålandsposten interviewed our colleague Margarita Sallinen , information and cyber security specialist at Omegapoint. Link to the article you will find here (paywall). We took the opportunity to delve a little deeper into the topic that, in one way or another, affects most of us. What are the traps that children can fall into online today? Children today can fall into several types of online traps. For example, they can be subjected to grooming, where adults manipulate them into sharing sensitive information or pictures. Cyberbullying is another major problem, where mean comments are spread via social media, for example. Cyberbullying also includes exclusion, where children are deliberately left out of common chats, games or groups, which can create strong feelings of loneliness and exclusion. Children can also be tricked by scammers, for example through games where they are tempted to buy virtual items for real money. From a cybersecurity perspective, they are also at risk of encountering disinformation, hate speech or inappropriate content, often on platforms where adults have less control over what is shared. How can parents prevent this from happening? One of the most important things parents can do is to build trust and have an ongoing dialog about online traps, without blaming. Children should feel that they can always tell you if something feels strange or wrong. It's also good to set guidelines together on internet use, such as which apps are okay to use and what never to share with anyone online. In addition, you should keep up to date with the latest trends and platforms to better understand children's digital lives. What are parents not aware of when it comes to their children online? Many parents think that the dangers are only on the big platforms, such as Instagram or TikTok, but many children today are also on lesser-known apps, gaming platforms and chat forums that parents don't know about. Parents often underestimate how quickly children adopt new technologies and how social connections can shift from real life to a digital environment where adults have no control. But in addition to being protective, we also need to talk more with children about their own role in being kind and responsible online. As adults, we need to be good role models. How do we make the internet a safe place for children? We create safety through a combination of presence, knowledge and technological tools. Feel free to use parental controls and filtering tools as support, but don't forget that the most important protection is the child's own ability to recognize risks. Talking about what is okay to see, say and do online, and explaining why, helps children build their own healthy attitudes. It's also good to set simple rules around usage early on, such as not using the phone during the night, to build healthy digital habits from the start. Safety also means knowing that there is always an adult to turn to, without fear of being punished. AI and schoolwork, what are the pros and cons? How can children use AI to their advantage? AI can be a great tool for children, if used in the right way. For example, it can help explain difficult concepts, practice language, or support creative work such as writing or making pictures. But there are also risks. Today's AI tools are still immature and can produce inaccurate or misleading information if you don't ask the right questions or critically review the answers. AI can \"hallucinate\" and give answers that sound credible but are wrong. Therefore, it is important that children learn to use AI as a coach for learning, not as a shortcut to get ready-made answers. They need to practice asking follow-up questions, reflecting on whether the answer is indeed logical and correct, and being aware that AI is not always right. Double-checking answers against other sources and thinking critically about sources is an important part of the process. By using AI in a reflective way, through questioning, comparing and analyzing, children strengthen both their critical thinking and their knowledge base and use technology as a tool for real learning, instead of passively receiving information. Why should children learn about cybersecurity? Cybersecurity is as important for children as it is for adults. Today, children start building their digital identity very early. By understanding the basics of cybersecurity, such as the importance of cyber hygiene, responsible online behavior, and measures to protect themselves, their friends and family, such as creating strong passwords, recognizing suspicious links and being careful with personal information, children not only strengthen their protection but also their respect for online privacy. Instilling a natural sense of cybersecurity and privacy early on will help them develop safe and respectful digital behavior that they will carry with them throughout their lives. How can AI make us safer? AI can increase security both in society and for us as individuals. In cybersecurity, AI is used to detect suspicious activity, stop scams and anticipate threats before they cause harm. For individuals, AI can help identify phishing, warn of fake websites, manage passwords more securely and detect if personal data is being spread online. AI tools can also recognize deepfakes, spam, and fake contact requests on social media (which can otherwise be difficult to detect with the naked eye). But it is important to remember that while AI is a useful tool, the human factor, such as understanding the risks and using the technology responsibly, is still crucial to our security. What do children/young people and parents need to consider when it comes to AI in their free time - for example in social media? Children encounter AI in apps, games, and social media, among others. Here it is important to think critically about sources, many platforms use AI to adapt content to behavior, which can reinforce certain opinions, affect self-esteem or increase screen time. What we see in the feed is rarely a coincidence. Good questions to talk about together are: Why am I seeing this? Who wants to influence me, and why? Is it a real person or a fake person? You can also use multiple AI services to compare answers to the same question, and then discuss whether the answers are similar or not, and if so, what that means. The self-image of children and young people is also affected by the content they consume. Parents should talk to their children and young people about the accounts they follow, the clips they click on and how this affects how they see themselves. Today, it's not just about comparing themselves to filtered images, there are now AI-generated influencers, where the person, the images and the texts are all created by AI. They may appear to be perfect, but they are completely made up. How can adults be there for children now that AI is developing so rapidly? The most important thing is not to understand every technical detail or every AI tool available, but to be curious and present. Again, it's about creating an open climate and encouraging dialog where children dare and want to ask questions, tell us when something feels wrong or share thoughts about AI. It can be about thinking together about what is real and what is fake, why an AI-generated answer is not always correct, or what you think is okay to create and share. Adults can also contribute by strengthening children's critical thinking and curiosity. It's about talking about, and showing, that AI can be a tool for learning, not just for entertainment. Want to know more about Omegapoint's expertise in cybersecure digitization? Read more about it here",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Today, not only adults, but also children, have AI as part of their everyday digital lives. Children start to build their digital identity at a young age. This raises many questions to consider, such as what traps they can fall into, how to prevent them, and how to make the internet a [...]",
        "modified_at": "2026-04-21T11:52:57+00:00"
    },
    {
        "title": "State of the world with Sandra Barouta Elvin - Part 2",
        "url": "/en/articles/the-world-team-with-sandra-barouta-elvin-part-2/",
        "content": "From left to right: Linda Nieminen, Sandra Barouta Elvin, Margarita Sallinen In the first part (link to the post here) of the Global State of the World series, Omegapoint cybersecurity specialists Margarita Sallinen and Linda Nieminen spoke with Sandra Barouta Elvin, National Security Manager and Chief Security Officer at Microsoft, about the current state of the world and its impact on cybersecurity. In the second and final part of the series, we look at how the global cyber threat landscape has changed over time. We explore whether Sweden has become a pawn in the cyber warfare of the major powers, discuss the security of cloud services and look at one of the technological challenges of the future - the impact of quantum computers on cybersecurity. Changing threat landscape According to Sandra Barouta Elvin, the threat landscape has changed in recent years, both in terms of scope and nature. \"You can see a clear increase in DDoS attacks, especially in connection with politically charged events such as the war in Ukraine,\" she says. These attacks aim to overload systems and disrupt digital services, and are often used to attract attention rather than cause financial damage. Sandra explains that the attacks often have a political dimension. \"I like to compare it to someone gluing themselves to the front door of an office. Customers don't come in, employees don't come in, and business stops. That's exactly how it works in the digital world.\" Another clear trend is the development of ransomware attacks, which are now more sophisticated and targeted than before. Sandra describes how the attacks are now carried out in stages by different actors working together in a kind of criminal ecosystem. It often starts with one party selling initial access to a system, after which other actors take over and steal data or encrypt the organization's systems. Everything is done in a very methodical way. The attack on the Church of Sweden is highlighted as an example of an increasingly common method: double extortion, where attackers both encrypt information and threaten to leak it. Despite the evolution of technology, it is still the simplest methods that often prove most effective. Sandra points in particular to phishing, spear phishing and password spraying, techniques that are now often augmented by AI. But what exactly is password spraying? Sandra explains that the method involves attackers testing common or previously leaked passwords. Instead of trying many different passwords on a single account, which can quickly lead to account lockout, they test a few passwords on many different accounts. \"We like to talk about advanced attacks and zero-days, but the fact is that they are very rarely used. It's still simple, well-known methods that pay the most dividends.\" Another worrying development is that attackers are increasingly exploiting vulnerabilities in mainstream software. As anti-phishing defenses improve, the focus is shifting to older and unpatched systems. \"Many organizations still have known vulnerabilities from as far back as 2014, even though security updates have been available for several years,\" says Sandra. Sweden - a pawn in the great powers' cyber warfare? We asked Sandra about the risk of Sweden being used in cyber warfare by the major powers. \"The question is not whether Sweden risks becoming a pawn in the cyber war of the superpowers, but rather whether we are not already\". Sandra describes how hybrid warfare, which combines cyber attacks, disinformation and influence operations, has already been directed against Sweden. Sandra also highlights Sweden's strategic position in the Baltic Sea region, with Gotland being particularly important, as a contributing factor to the country's interest in a wider geopolitical context. She also points out that Sweden has historically had a clear role in global security policy issues. However, it is difficult to predict how cyber threats will develop in the future, Sandra says. \"It depends on the international dynamics, especially between major powers like the US and Russia. We are following developments closely, but it is very difficult to assess how it will evolve.\" Cloud services Cloud computing has become a pillar of digital development, offering both flexibility and redundancy. But does this mean that storing data in the cloud is always safer? According to Sandra Barouta Elvin, the answer is yes in most cases. Sandra says that in 90% of cases it would probably be safer. But this requires that the cloud service itself is secure, and that it is used in a secure way. Security depends not only on where the data is, but how you handle it. At the same time, she emphasizes that cloud solutions are not appropriate in all contexts. Some environments, such as OT systems that control critical functions such as nuclear power plants, should remain isolated from the internet. However, for most organizations, the cloud offers improved opportunities to manage large amounts of data and ensure redundancy. Sandra cites Ukraine as a clear example. Before Russia's invasion, government agencies were not allowed to use cloud services. But when physical data centers were attacked, the direction quickly changed. \"What was thought to be safe, having data within the country's borders, turned out to be a weakness when their own territory was attacked. It was then realized that the cloud could provide better protection, both against destruction and manipulation.\" Quantum computing - the next big challenge for cybersecurity What will be the biggest challenge for cybersecurity in the next five years? According to Sandra, quantum computing is a crucial future issue that is already attracting a lot of attention. Quantum computing is an entirely separate field of engineering and physics. Like generative AI, which was niche at first but then suddenly became mainstream, she believes that quantum computers will have a similar impact and radically change the way we think about cybersecurity. But what exactly is a quantum computer? Sandra explains that quantum computers are based on principles of quantum physics and can process huge amounts of data much faster than today's computers. This means that things like cracking encrypted passwords, which today can take years or hundreds of years, can be done in minutes or even seconds with quantum computers. Today we rely on encryption to keep our data safe, but with quantum processing power we need to develop entirely new encryption methods that are quantum-safe, known as post-quantum cryptography. Sandra describes this as a race between attackers and defenders, where it is crucial who gets there first. At the same time, there is reason for optimism. Sandra emphasizes that intensive research is underway to develop encryption algorithms that can withstand the capabilities of quantum computers, but stresses that this is likely to be the next big challenge for cybersecurity. The interview is based on a podcast recording made by Cyber Chats & Chill, which is an initiative by the Voluntary Radio Organization FRO to strengthen Sweden's cyber security. You can listen to the full episode Here.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Från vänster i bild: Linda Nieminen, Sandra Barouta Elvin, Margarita Sallinen I den första delen (länk till inlägget här) av artikelserien om det globala omvärldsläget samtalade cybersäkerhetsspecialisterna Margarita Sallinen och Linda Nieminen från Omegapoint med Sandra Barouta Elvin, nationell säkerhetschef och säkerhetsskyddschef på Microsoft, om det tumulta omvärldsläget och dess påverkan på cybersäkerhet. I den andra […]",
        "modified_at": "2026-04-21T11:52:57+00:00"
    },
    {
        "title": "PCI DSS, a framework with greater potential",
        "url": "/en/articles/pci-dss-a-framework-with-greater-potential/",
        "content": "Most businesses and organizations already handle payment card data in their operations. Many of the businesses that handle card payments, in-store, online or otherwise, often see PCI DSS as a requirement to comply with. But PCI DSS is more than that. It's a practical framework that can be used to strengthen your entire organization's cybersecurity. By using it smartly, you can both reduce the risk of a data breach and gain better control over your security efforts. Here are tips on how to take the next step towards broader cybersecurity. A framework you already have - with much more potential As you are already PCI DSS compliant, you have a ready-made security framework - not only for card data, but also for other sensitive information, such as personal or patient data. The framework includes key elements such as segmentation, access control, logging, incident response and training. It is the foundation of modern security. So you already have the tools in place. Now you can build on them - without starting from scratch. From compliance to business-driven cybersecurity When used strategically, and not just for compliance, PCI DSS can create clear business benefits. Below we have listed three points that explain how: You streamline security work with already established processes and controls. You strengthen your resilience to incidents and reduce the risk of disruption and loss of trust. You'll have a common language for cybersecurity across your organization, from engineering to the board. In addition, PCI DSS supports compliance with other regulations such as GDPR, DORA and NIS2, making it easier to navigate an increasingly complex landscape of requirements and expectations. Making a bigger impact - with what you've already built Many organizations have already invested significant time and resources in implementing PCI DSS. That investment can now become the catalyst for a broader security effort that encompasses more business areas, increases maturity and creates value beyond compliance. It's not about starting from scratch, it's about developing what you already have - and getting more impact from every penny you already spend. Conclusion PCI DSS is not just a list of requirements, it's a practical framework for building a security culture that lasts over time. At Omegapoint, we support you in broadening your security efforts based on what already works - whether you handle card data, patient information or critical services. Want to know more about how we can help you? Read more here",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "De flesta företag och organisationer hanterar redan idag kortuppgifter för betalkort i sin verksamhet. Många av de verksamheter som hanterar kortbetalningar, i butik, online eller på annat sätt, ser ofta PCI DSS som ett krav att följa. Men PCI DSS är mer än så. Det är ett praktiskt ramverk som kan användas för att stärka hela organisationens […]",
        "modified_at": "2026-04-21T11:52:56+00:00"
    },
    {
        "title": "From demand to power - your role in a sustainable digital society",
        "url": "/en/articles/from-demand-to-power-your-role-in-a-sustainable-digital-society/",
        "content": "NIS2, CER and DORA are not just regulations and fines, they are a chance to take responsibility, create security and become an active part of society's digital sustainability. The companies involved have an important role and should wear it with pride. With NIS2 and DORA now being rolled out across the EU, it's easy to get caught up in paragraphs and technical requirements. But at their core, both regulations are about the same thing: making our society more resilient, safe and sustainable in a digital age. For the organizations involved - from banks and healthcare providers to tech companies - this is not just an obligation, but an opportunity to take their place as a key player in society's digital defence. From compliance to pride Being affected by NIS2 or DORA means that you are important for the functioning of society. It's not a punishment, it's a trust. Organizations that invest in their digital resilience strengthen not only themselves, but the entire ecosystem they are part of. How to make a difference See cybersecurity as a strategic asset Build structure with e.g. safety culture, exercises and clear processes Collaborate with other actors and show leadership Communicate your responsibilities - it builds trust Conclusion NIS2 and DORA are more than rules, they are a framework for taking responsibility, building trust and strengthening Europe's digital backbone. Companies that act on this are not only compliant, they are ambassadors of security and sustainability. Wear it with pride. You are an essential part of our shared resilience. At Omegapoint, we are proud of our contribution to a safer and more resilient society, together with our critical customers. We are keen to help more critical suppliers review their contribution and strengthen their security efforts. Read more about our services here.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "NIS2, CER och DORA är inte bara regelverk och vitesbelopp, det är en chans att ta ansvar, skapa trygghet och bli en aktiv del av samhällets digitala hållbarhet. De företag som berörs har en viktig roll och bör bära den med stolthet. När NIS2 och DORA nu rullas ut inom EU är det lätt att fastna i paragrafer och […]",
        "modified_at": "2026-04-21T11:52:56+00:00"
    },
    {
        "title": "Skills development as a culture",
        "url": "/en/articles/skills-development-as-culture/",
        "content": "In a world where technology is changing faster than ever, it's not enough to just keep up, we need to stay ahead. For us at Omegapoint, this is not a goal in itself, but a natural result of the culture we build every day: a culture where skills development, curiosity and shared knowledge are a natural part of our DNA. Omegapoint can be described as a greenhouse for development where Omegapoint Academy is at the heart of our skills culture. It underpins the way we work and secures our future through ambitious skills development. We believe in the power of collaboration and an important part of the Academy is sharing our knowledge. We train each other and our customers, contribute to research, offer thesis work, guest lecture at universities and international conferences, and help foster an interest in technology among children and young people. Skills development in practice We spend time and effort learning about new technologies, methods and processes. We have several different forums and formats, all aimed at promoting skills exchange and development within the company. Our annual skills conference is a clear example of how we put this culture into practice. This year, we came together for two intense and inspiring days. More than 70 optional sessions, created and led by our own staff, were held for each other. Divided into six parallel tracks, we tackled everything from technical deep dives to practical cases, safety issues, new regulations and reflections on leadership and collaboration. It's a unique concept, and it works! Because when we share our knowledge, challenge each other's mindsets and learn together, something more than individual development happens. We strengthen our collective capacity and raise the bar both technically and humanly. Our skills culture creates value on multiple levels For the individual:With us, learning is not a one-off effort, it is a lifelong journey. We believe that every employee should have the opportunity to grow in their knowledge, follow their curiosity and contribute with their expertise. It brings both commitment and pride. For us as a company:When learning permeates the whole organization, we become more adaptable, more innovative and better equipped to face the challenges of the future. We build a common knowledge base that makes us stronger together. For our customers and society at large:This is where our expertise really makes an impact. By understanding, applying and further developing the latest technologies, we can help our customers make the right decisions, tackle complex challenges, build sustainable solutions and meet security requirements in a digital reality. And thus contribute to a safer and more sustainable digital society. An investment that pays off - for everyone Investing in skills development is not just about future-proofing. It's about creating the conditions for innovation, quality and long-term relationships, both internally and externally. We believe that a culture where everyone learns from and with each other is the best way to develop the individual, strengthen the business and make a difference in the world. For us, skills development is not a one-off event, it is part of our culture. By constantly learning, sharing and growing, we make sure we stay at the forefront of technology. We invest in our skills, and as a result, our customers can rely on our expertise.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "I en värld där tekniken förändras snabbare än någonsin räcker det inte att bara hänga med, vi måste ligga steget före. För oss på Omegapoint är det inte ett mål i sig, utan ett naturligt resultat av den kultur vi bygger varje dag: en kultur där kompetensutveckling, nyfikenhet och delad kunskap är en självklar del av […]",
        "modified_at": "2026-04-21T11:52:56+00:00"
    },
    {
        "title": "From systems to strategy: How to create long-term cybersecurity with NIS2",
        "url": "/en/articles/from-systems-to-strategy-you-create-long-term-cybersecurity-with-nis2/",
        "content": "The NIS2 Directive imposes stricter and more stringent requirements on how organizations protect their information, but also on how they organize their security work. In order to succeed, it is not enough to take isolated measures in individual IT systems. It requires an overall strategy where security is woven into the organization's core processes. This is where a process-oriented approach shows its real strength, as the key to both compliance and long-term resilience. The new NIS2 Directive from the EU represents a clear shift in how socially important and digital businesses are expected to work with cybersecurity. The focus is on a systematic and risk-based approach where information security must permeate the entire organization, not just its IT systems. For many, this means a need to move from an application-based approach to a more process-oriented approach, in line with established frameworks such as the ISO/IEC 27000 series. Application-based attack approach or process-oriented approach An application-based approach is usually based on individual technical systems. Risks are assessed on an application-by-application basis and safeguards are often implemented without reference to the overall business objectives or critical processes. This can provide some local control but often lacks coherence and consistency, especially in complex environments where multiple systems interact. Instead, the process-oriented approach is based on the core processes of the organization and how information is managed in practice. It is fully in line with the principles of ISO/IEC 27001, which emphasizes the importance of basing information security on business needs, asset importance and the context of risk. Security measures should be proportionate and guided by systematic risk analysis - something also clearly required by NIS2 in Articles 21 and 23, which highlight both technical and organizational measures for business continuity, incident reporting and supply chain security. By working in a process-oriented way, it is possible to identify where information is most critical, which actors are responsible for it and how it affects other parts of the business. This creates a clear link between risk, business benefit and responsibility. In accordance with ISO/IEC 27005, risk management can then be integrated into regular decision-making processes, rather than becoming a separate IT initiative. Process-oriented security work also facilitates the continuous improvement work required by both ISO 27001 and NIS2. With the help of established management models such as PDCA (Plan-Do-Check-Act), measures can be followed up, evaluated and adjusted over time. In this way, information security becomes a living part of governance, rather than a one-time effort for audit or oversight. Application-based approaches, on the other hand, tend to create silos, where security is handled differently depending on the system, without common criteria for risk or impact. This not only makes coordination difficult, but also risks overestimating the protection of some parts of the business while leaving others exposed. The choice of approach becomes crucial NIS2 requires clear management responsibility for security under Article 20, and ISO 27001 advocates an integrated information security management system. A process-oriented approach allows both of these requirements to be met in a structured and resource-efficient way. Linking security to operational realities not only provides better protection, but also better embedding in the organization as a whole. A process-oriented approach supports both the regulatory requirements of NIS2 and the established standards represented by the ISO/IEC 27000 series. It lays the foundation for a robust, risk-based and business-oriented security approach that can withstand both internal audit and external oversight. Want to know more about how we can support you in your work? Read here: https://www.omegapoint.se/en/banking-and-finance/",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "The NIS2 Directive imposes stricter and more stringent requirements on how organizations protect their information, but also on how they organize their security work. In order to succeed, it is not enough to take isolated measures in individual IT systems. It requires an overall strategy where security is woven into the organization's core processes. This is where a process-oriented approach shows its real strength, as [...].",
        "modified_at": "2026-04-21T11:52:27+00:00"
    },
    {
        "title": "Cyber resilience a necessity - but Swedish companies are lagging behind",
        "url": "/en/articles/cyber-resilience-a-necessity-but-swedish-companies-lag-behind/",
        "content": "This opinion piece was published in Current Security July 14, 2025. Sweden is one of the most digitized countries in the world - but among the least prepared when threats materialize. Too few Swedish companies have built the necessary cyber resilience. Five crucial characteristics separate the resilient from the vulnerable, writes Jonas Hasselberg, President and CEO of Omegapoint. Sweden has recently been thrown into digital turmoil. Repeated cyber attacks have knocked out SVT's news feed and led to disruptions elsewhere in the digital society. The Prime Minister was quick to comment that Sweden is under attack and that the threat to our most basic societal functions is serious. The threat that was previously considered exceptional has become commonplace for many businesses. In the latest edition of Swedish Security Index as many as 79% of decision-makers in critical operations state that the threat to Sweden is serious or very serious. At the same time, we see a growing gap between the vulnerability of organizations and their actual security capabilities. Digital reality is outpacing many. It is no longer a question of if an attack happens - but when - and how well the organization is equipped to recover. The answer is cyber resilience: the ability to quickly return to normal operations after a digital disruption. Yet, a global mapping out of 1 500 organizations in 14 countries, only 7% have achieved this. This is a figure that should worry policy makers and business leaders alike in Sweden, a country that is one of the most digitized in the world, but where cybersecurity has lagged behind its ambitions. A well-functioning security strategy is not a barrier to innovation - quite the contrary. Cyber resilience does not happen by itself. It requires strategic decisions, investments and culture building where security is not seen as a technology, but as a foundation for long-term business survival and competitiveness. That's why we've identified five key characteristics of cyber resilient companies - lessons that Swedish businesses should also learn: Cybersecurity is integrated into the business - from the start In resilient organizations, management understands that cybersecurity is not an IT issue - it is a business-critical issue. Cybersecurity efforts are fully embedded in the company's business objectives with a strategic rather than reactive approach. Proactive investment against next generation attacks While many companies are still trying to fend off traditional phishing attacks, resilient players have already armed themselves against smishing, quishing, software supply chain breaches and AI-driven threats. They are investing in incident response, threat analysis, zero-trust architecture and machine learning for pattern recognition, as a preventive measure. AI are both threats and tools Resilient actors know that AI has a two-way power. They do not rely solely on traditional protections but actively leverage AI in their own cyber protections. They combine human expertise with machine analysis to quickly identify anomalies, anticipate attacks and act before the damage is done. Safety culture is embedded throughout the organization Cyber-resilient companies have a culture where every employee, from the front desk to the boardroom, understands their role in security. Incident reporting is encouraged, training is regular and management takes responsibility for driving change. They dare more - thanks to their protection A well-functioning security strategy is not a barrier to innovation - quite the contrary. The most resilient companies are also the most innovation-driven. They dare to launch new digital services, enter uncertain markets and take technological leaps because they know their digital backbone will hold up. There are no shortcuts to cyber resilience. More and more Swedish decision-makers are realizing that digital risks can no longer be managed with one-off interventions or fire brigade calls. We can see that maturity is increasing but also the realization of the shortcomings. To face the threats of the future, a high level of digitalization is not enough. We need to build security with the same systematic approach as we build businesses. It requires investment, commitment and leadership that clearly prioritizes resilience throughout the organization. It is no exaggeration to say that cyber resilience has become a matter of national competitiveness. In a context where cyber attacks can knock out power grids, healthcare infrastructure or manufacturing chains, resilience is a foundation for both the economy and democracy. Jonas HasselbergPresident and CEOOmegapoint",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "This article was published in Aktuell Säkerhet on July 14, 2025. Sweden is one of the world's most digitized countries - but among the least prepared when threats become reality. Too few Swedish companies have built the necessary cyber resilience. Five crucial characteristics separate the resilient from the vulnerable, writes Jonas Hasselberg, President and CEO of Omegapoint. [...]",
        "modified_at": "2026-04-21T11:52:26+00:00"
    },
    {
        "title": "City of Malmö shows why cybersecurity must be practiced - not just planned",
        "url": "/en/articles/city-of-malmo-shows-why-cybersecurity-must-be-managed-not-just-planned/",
        "content": "In November 2024, the City of Malmö conducted a phishing test among 3,500 employees. The purpose was clear: to measure the organisation's resilience to one of the most common methods of attack - phishing. The results were telling. The test, which was supposed to last 72 hours, had to be stopped after 27 hours, by which time more than one in three employees had already clicked on the fake email. This incident is far from unique. Every week, Swedish organizations are exposed to thousands of phishing attempts, often as a first phase of larger attacks. One click is all it takes for an attacker to access login credentials, install malware or use the email account as a springboard for further attacks. For a municipality, this poses a direct risk to citizen services, sensitive data and business continuity. Figures from Swedish Safety Index 2025 underlines the seriousness. Eight out of ten decision-makers in critical societal activities assess the threat to Sweden as serious or very serious. At the same time, many feel that the gap between vulnerability and actual ability to deal with cyber threats is growing. The threat landscape is changing - and becoming more personal This vulnerability is exacerbated by new and more sophisticated threats. One example is so-called infostealers - malware that silently steals login credentials, cookies and other sensitive data from computers and browsers. The stolen information is then used in secondary attacks, where the attacker already has a head start because they can log in as an authorized user. Infostealers are often spread via phishing emails or malicious links, making human error the decisive factor. Technical protections are important, but they rarely stop a user letting the attacker in. Why plans are not enough - skills must be practiced Many organizations put a lot of emphasis on technical solutions, policies and processes. But reality shows that people are often the weakest link. A documented security approach on paper means little if staff do not know how to act in an emergency. The City of Malmö's test is a clear example. By subjecting themselves to a simulated attack, they got an honest picture of the human factor in their own organization. According to the Swedish Security Index, there is now a growing awareness of this - more organizations describe themselves as \"deliberately incompetent\". In other words, they have started to understand their own shortcomings. And that is a necessary first step towards improved resilience. Three concrete measures to strengthen security Regular stress tests and simulations - not to find scapegoats, but to measure real capabilities and identify areas for improvement. Training on how attackers manipulate people - understanding social engineering and new threats such as infostealers makes it easier to take the right action. A safety culture that encourages dialogue - create an environment where it is okay to ask, hesitate and report suspicious events. Conclusion: dare to test before the attackers do it for you The biggest mistake an organization can make is to rely on plans that have never been tested in practice. Conducting simulated attacks is an effective way to both measure capability and create organizational learning. Want to close the gap between threat and capability? Start by putting your business to the same test that threat actors are already planning for you. It's not just a safeguard against the next attack - it's an investment in trust, continuity and security.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "In November 2024, the City of Malmö conducted a phishing test among 3,500 employees. The purpose was clear: to measure the organisation's resilience to one of the most common methods of attack - phishing. The results were telling. The test, which was supposed to last 72 hours, had to be stopped after 27 hours, by which time more than one in three employees had already clicked on the fake email. [...]",
        "modified_at": "2026-04-21T11:52:26+00:00"
    },
    {
        "title": "Solomon's paradox and information security",
        "url": "/en/articles/solomons-paradox-and-information-secrecy/",
        "content": "Have you ever met people who can give wise and insightful advice to others - but who find it difficult to apply the same wisdom when they find themselves in difficult situations? Or noticed that you are often better at giving advice to friends than dealing with your own problems? You're in good company. Even King Solomon, renowned for his wisdom, fell victim to this very human pattern. The phenomenon is called ”Solomon's paradox”. It describes how we tend to lose our capacity for rational thinking and good judgment when we ourselves are in the middle of a challenge - while often being able to reason wisely and balanced when helping someone else in the same situation. Here we discuss how Solomon's paradox can affect work with information security, and how we can reduce its impact by making more thoughtful decisions - even when we ourselves are in the middle of the pressure. Solomon's paradox in information security Lee, Choi and Hu (2023) showed that people tend to be more optimistic - and thus less realistic - about information security related to themselves (private goals) than when assessing public goals. This suggests that we often overestimate our own ability to maintain security and underestimate the risks that actually exist. We are much more likely to detect risks, mistakes or opportunities for improvement in other people's systems, departments or organizations than in our own.Just as individuals can become blind to their personal weaknesses, businesses and organizations risk underestimating or overlooking vulnerabilities in their own solutions and processes. Strategies for to reduce the effect of Solomon's paradox By understanding the phenomenon, organizations can take conscious action to reduce its impact. Below is our advice to help your organization manage the negative impact of Solomon's Paradox. Psychological distance People tend to think more abstractly and objectively when viewing a situation from a distance, but become more emotionally attached and short-sighted when they are directly involved. Grossman and Kross (2014) showed that this form of asymmetric reasoning can be reduced by so-called self-distancing - viewing a situation from a third-person perspective (distance) instead of a first-person (close perspective). Research also shows that the greater the psychological distance we experience, the less the areas of the brain linked to self-reflection are activated, while the parts dealing with abstract and strategic thinking become more active (Davis, 2015). Consciously creating this type of distance can therefore facilitate more rational and balanced decision-making. A practical way to practice this is to simulate attacks or incidents where participants are asked to advise another team or a fictitious organization. Afterwards, they can reflect together on how their own organization would handle a similar situation. Such exercises strengthen both strategic thinking and the ability to see problems from an outside perspective. Get help from another ”Solomon”! Asking for help and taking advice from colleagues or consultants is not a weakness - it is a strength. Consultants bring an independent and objective perspective, and their experience in different organizations can be invaluable when assessing an organization's security capabilities and resilience. They can also provide support in designing security measures and suggest improvements that their own organization might otherwise overlook. Such a ”fresh eyes” perspective promotes more objective and informed decisions. Clear division of responsibilities As a proactive measure, organizations should allocate tasks and responsibilities in a clear and structured way. Conflicting tasks should be assigned to different people to avoid unreasonable and risky decisions. Examples of this are the 4-eyes principle and rolling schedules. Such a structure strengthens control and reduces the risk of misjudgments (ISO/IEC 27001). Structured thinking in decision making Writing down your thoughts and using decision templates makes your reasoning visible. When you then read your notes, you can see the situation from a more objective perspective, making it easier to make informed decisions and reducing the risk of being guided by gut feelings or simply ”guessing”. In conclusion Solomon's paradox reminds us that it is easy to see the mistakes of others - but harder to spot our own. When we dare to look beyond our own judgments, create some self-distance, invite a few extra eyes, keep a touch of humility and work in a structured way, our ability to make wise and informed decisions increases. Because at the end of the day, strong security relies not only on technology, but on people - their ability to act wisely, make sober judgments and dare to question the situation at hand. - - Source reference Lee, R. W., Choi, J., & Hu, Q. (2023). Effect of temporal distance and goal type on predictions of future information security: Focus on moderation of self-efficacy and social responsibility. Acta Psychologica, 238, 103990. https://doi.org/10.1016/j.actpsy.2023.103990 Grossmann, I., & Kross, E. (2014) Exploring Solomon's paradox: Self-distancing eliminates the self-other asymmetry in wise reasoning. Psychological Science, 25(8), 1571-1580. https://doi.org/10.1177/0956797614535400 Davis, J. (2015, March 12). Teach someone to prioritize using psychological distance. Harvard Business Review. https://hbr.org/2015/03/teach-someone-to-prioritize-using-psychological-distance ISO/IEC. (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection - Information security management systems - Requirements. International Organization for Standardization.",
        "post_type": "post",
        "meta_description": "We discuss how Solomon's paradox can affect information security work and how we can reduce its impact through more thoughtful decisions.",
        "excerpt": "Har du någonsin träffat människor som kan ge kloka och insiktsfulla råd till andra – men som har svårt att tillämpa samma klokskap när de själva hamnar i svåra situationer? Eller märkt att du själv ofta är bättre på att ge vänner goda råd än på att hantera dina egna problem? Du är i gott […]",
        "modified_at": "2026-04-21T11:52:25+00:00"
    },
    {
        "title": "Capitalizing on the cyber threat - a quarter of a billion in IT protection",
        "url": "/en/articles/they-cash-in-on-the-cyber-threat-it-protection-for-a-quarter-billion/",
        "content": "This article was first published at Dagens Industri October 7, 2025. The deteriorating security situation and the emergence of AI have led to a rapidly growing market for cybersecurity. IT company Basalt has more than tripled its turnover in five years, from SEK 84 to 250 million. Di followed us into the classified factory where the systems that protect Sweden's most sensitive information take shape. Basalt CEO Nicklas Haglund. Photo: Jack Mikrut (Di). The anonymous tin building is located in an industrial area outside Enköping and is surrounded by high barbed wire fences. The company Basalt describes itself as Sweden's most secure IT company. The building is classified as a protected object. Before the visit, we must declare our citizenship, cell phones must be locked in lockers and photo restrictions are strict. Here, IT systems are developed and installed to protect society's most sensitive information against cyberattacks. Secret maps with defense plans, documents with information about drinking water supplies, drawings of energy company operation centers - information that would jeopardize the country's security if it ended up in the wrong hands. The cybersecurity market is expected to grow rapidly and the CEO believes that Basalt's turnover could increase tenfold within ten years. Photo: Jack Mikrut And the threat that can come from within. \"We are working to protect businesses against an adversary that is highly skilled, persistent, highly motivated, well-resourced and an authorized user in the system,\" says Basalt CEO Nicklas Haglund. That is, the company assumes that the threat is an employee of theirs or of their customers, with different loyalties. Cybersecurity has emerged as an increasingly important issue due to the deteriorating security situation and rapid technological developments. Globally, the cybersecurity market is estimated to have been worth the equivalent of around SEK 2,300 billion in 2024. By 2030, it is expected to have doubled. This is according to the analyst firm Grand View Research. BASALT Founded: In 2009, it became part of the Omegapoint Group, owned by venture capital firm FSN Capital, in 2022. Available in: Stockholm and Enköping. Number of employees: 135. Turnover in 2024: 288 million Profit 2024: 41.4 million Do: Delivers turnkey IT systems to public authorities, municipalities and businesses. Cyber security is also being invested in at home. The Swedish market is estimated to be worth SEK 16 billion this year according to the IT analysis company Radar. In it, the government has The Swedish government has proposed cybersecurity investments of SEK 1 billion over three years. In addition, the new EU directive on cybersecurity, Nis-2, will come into force in Sweden next year. This will tighten the requirements for the IT systems of essential activities, and more activities will be covered. The increase in demand has not escaped Basalt, which was founded in a much more relaxed 2009. \"We could not have imagined this when we started. Over the past five years, the increase has been explosive,\" says Nicklas Haglund. The tense security situation is reflected in the cash books, with the company's turnover increasing from around SEK 84 million in 2019/2020 to almost a quarter of a billion in 2024. Last year alone, turnover increased by more than 50 percent. To meet demand the factory has been expanded and this spring the extension was completed. Today, the building is 4,000 square meters in size. \"We invest a lot in each employee, so it's important to find people who want to stay for a long time,\" says CEO Nicklas Haglund. Photo: Jack Mikrut Our tour starts in Basalt's goods reception, where boxes of laptops are stacked on top of each other. This is where customers' hardware arrives - computers, servers and mobile phones. The work of Basalt involves first checking the hardware, for example by inspecting the computers' circuit boards and ensuring that nothing has been tampered with. Then, proprietary IT systems and software are installed to ensure they are impenetrable, before the equipment is delivered to the customer. \"IT systems are most vulnerable at the production stage. Someone can plant vulnerabilities in the system then without being noticed and then exploit them five years later. That's why security is particularly important at this stage. Once the systems are in operation, it is easier to spot if something happens\", says Nicklas Haglund. The attacks that Basalt is primarily working to prevent are not those that come via the traditional route over the internet. Instead, it is about preventing someone with physical access from manipulating the systems. For example, someone may insert a USB stick with malicious code and through it gain higher authorization and access information they should not have access to. A THREAT THAT IS DIFFICULT TO QUANTIFYIt is difficult to provide a figure on the number of cyber attacks or attempted cyber attacks that occur in Sweden. This is because attacks and attempted attacks happen all the time. This is according to John Ahlmark, Communications Officer at FRA, the Swedish Defense Radio Establishment. \"As soon as you connect your newly purchased computer to the internet for the first time, it is exposed to some type of intrusion attempt. Often the attempts are very simple, but it happens to everyone all the time. The more serious attacks can go on for many years without being noticed. That's why it's difficult to quantify it all,\" he says. National Cyber Security Center, NCSC, assesses that threats are increasing, attack methods are becoming more sophisticated and many organizations have weaknesses in their security systems. The threat actors are, according to NCSC mainly by criminal groups with financial incentives, state actors and At Basalt, the starting point is that you are constantly under threat. Since it is assumed that the threat may come from an employee, security in the factory is taken very seriously. Employees undergo safety checks, all operations are monitored by four eyes, and the cables in the building are visible so that it is easy to see if they are tampered with. In addition, all operations are logged so that the customer can see what has been done and by whom. After the hardware has been checked and the systems installed, it is transported to the customer by specially trusted freight companies. Basically, the transportation is accompanied by an escort vehicle to ensure that the cargo does not make any unexpected stops. \"We have a high burden of proof. The whole chain must be unbroken for us to have full control,\" says Nicklas Haglund. The fact that Basalt describes itself as Sweden's most secure IT factory is not just about the systems it builds, but just as much about how the company works. The company Basalt describes itself as Sweden's most secure IT company. Photo: Jack Mikrut \"All IT companies do some of this. The difference between them and us is that we do everything. We have lit all the lights on the Christmas tree\", says Nicklas Haglund. Do you take any responsibility in case your customers are exposed to a cyber attack? \"The customer always owns the operational responsibility. Security is affected by how the system is used - whether it's five people in a rock room or 3,000 people spread across the country. But we can guarantee that we have done exactly what we promised and assist the customer through our management and support responsibilities,\" he says. Although the factory has recently been expanded, Nicklas Haglund does not believe that the premises will last much longer. \"It's already starting to feel a bit cramped,\" he says. Now the company is looking to expand its current 140 employees to 240. But recruitment is not easy. \"There are few courses on how to build IT systems at the level of security that Basalt does,\" says Nicklas Haglund. Therefore, the employees must be trained on site. \"We already have the customers. The challenge is to find employees with the right skills and the right mindset. We invest a lot in each employee, so it's important to find people who want to stay for a long time.\" Nicklas Haglund sees no flattening of the need for cybersecurity. The threat continues to increase and the company is growing like crazy. In ten years' time, he believes that Basalt will be a much larger company. \"I wouldn't be surprised if the turnover is ten times as big,\" he says. HOW TO PROTECT YOUR BUSINESS FROM CYBER ATTACKS1. Ensure the ability to detect security incidents2. Install security updates promptly3. Manage permissions and use strong authentication4. Restricting and protecting the use of high-level permissions5. Disable unused services and protocols6. Back up and test recovery of information7. Segment and control access on the network8. Ensure that only approved software can run - whitelisting9. Upgrade software and hardware10. Check internet accessSource: National Cyber Security Center",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Den här artikeln publicerades först hos Dagens Industri 7 oktober 2025. Det försämrade säkerhetsläget och framväxten av AI har lett till en snabbväxande marknad för cybersäkerhet. It-företaget Basalt har på fem år merän trefaldigat sin omsättning, från 84 till 250 miljoner kronor. Di följde med in i den skyddsobjektsklassadefabriken där systemen som skyddar Sveriges mest […]",
        "modified_at": "2026-04-21T11:52:25+00:00"
    },
    {
        "title": "Omegapoint's new CEO: \"We will be even sharper\"",
        "url": "/en/articles/omegapoints-new-ceo-we-will-become-even-sharper/",
        "content": "This interview was conducted by Mattias Loxi at Cinode and was first published on 2025-09-02 on cinode.com. When Jonas Hasselberg took over as CEO of Omegapoint this spring from founder Johan Malmliden, he did so with both respect for the company's heritage and a clear vision for the future. With several leading roles behind him, most recently as CEO and President of Proact, he is now focusing on strengthening cybersecurity, culture and the commercial organization - and making Omegapoint even sharper in the market. Omegapoint is today established as one of Northern Europe's leading tech companies in cybersecure digitization. The company works closely with its customers to build digital businesses that are resilient from the ground up - where security and resilience are woven in from the start. It is precisely this combination of technical excellence and culture that Jonas highlights as the company's strength. Generous sharing of skills When asked why he took on the CEO role, he answers without hesitation:- It's incredibly rewarding to work in cybersecurity and help customers become more resilient in an increasingly insecure world. He also describes the internal culture as something unique. - All our staff generously share their expertise, which is a huge strength. We work continuously to make everyone as sharp as possible - and we do it in an environment where job satisfaction and commitment always go hand in hand. As an example, Jonas mentions that during their last conference in Spain they had 80 lectures and trainings - all delivered by the employees at the highest level. Craton - the company diamond A key part of the drive forward is the product Craton, which Jonas calls the company's \"diamond\". The product is unique in its kind and meets the highest safety requirements. - Craton is a solution for security protection in digital systems. It is aimed at total defense and the most socially important activities - the parts of Sweden that must be able to be digitized even when the information is most secret. Culture and commercial focus But technical expertise is only one part of success. Jonas emphasizes that the company's strong internal culture is just as important. He took over as CEO a few months ago and says he has been greeted by an inclusive culture and describes it as easy to get into the business. At the same time, there are big shoes to fill after Johan Malmliden, who now sits on the board and acts as a sounding board. From his previous roles, most recently as President and CEO of Proact, Jonas brings the experience of productizing services and driving commercial development.- The market is tougher today, which requires strength in the commercial side - selling, marketing and building your brand. We are extremely skilled consultants and technically there is no one who beats us, but our customers must know that too. We need to be more visible and even better at selling what we are already good at. Cinode for a stronger business Since 2020, Omegapoint has been using Cinode to manage consultants, skills and customer relationships. Jonas highlights the platform as an important part of the business. - We clearly see how customers are in our flows. Cinode gives us professional CVs and better control of the entire sales process, which means that we have become much better at running our business, compared to before. In addition, we can do more analyzes regarding occupancy rates, profitability and much more. Growth despite challenging market With over 950 experts in Sweden and Norway, the company continues to grow organically. The market may be hesitant, but Jonas sees great opportunities. - We are growing steadily and now we just need to become even sharper and more visible.He sees the coming years as a journey in small steps, rather than big leaps.- Things are happening all the time. Looking back, you realize how much has actually changed, but right now it's about working hard, meeting customers and showing what we can do. We have fantastic customer loyalty. Now we just need to become even sharper in a market that is a bit stagnant. We deserve to be more visible and show the world what we've achieved, and that's exactly what we're going to do,\" Jonas concludes.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "This interview was conducted by Mattias Loxi at Cinode and first published on cinode.com on September 2, 2025. When Jonas Hasselberg took over as CEO of Omegapoint this spring from founder Johan Malmliden, he did so with both respect for the company's heritage and a clear vision for the future. With several leading roles behind him, most recently as CEO [...]",
        "modified_at": "2026-04-21T11:52:25+00:00"
    },
    {
        "title": "Security needs the same maturity journey as sustainability",
        "url": "/en/articles/safety-requires-the-same-maturation-journey-as-sustainability/",
        "content": "This opinion piece was published in Industry Today November 20, 2025. . Cybersecurity is on its way to becoming the next big maturation journey for business. Despite this, the issue is still being handled in many Swedish companies as a secondary matter for the IT department, which is the same mistake that was made when sustainability was once reduced to an ”environmental project,” writes Jonas Hasselberg, CEO of Omegapoint. At companies where sustainability work took off, three things were done. First, the issue was moved up to management, then a culture was built around values and behaviors that went beyond technology and regulations, and finally, sustainability perspectives were integrated into product and technology development, purchasing, communications, HR, customer relations and business development. Cybersecurity must now make the same journey. Today, the threat landscape is clear. Ransomware, insider threats, vulnerable supply chains and digital espionage show how quickly risks are spreading throughout the business. It is no longer enough to buy firewalls and antivirus. The consequences are too extensive and the dependence on digital infrastructure too deep. Companies that want to remain competitive must therefore elevate security work to the management level, from technical detail to core strategic issue. Above all, it has The security manager has a responsibility that is similar today to what the sustainability manager had a decade ago. He or she must act as a culture carrier, break down silos, and operate cross-functionally. In HR, by building awareness and routines around human risks. In purchasing, by making demands on suppliers and partners. In communication, by establishing trust and transparency. And in strategy and business development where security is not an add-on, but a natural part of every investment, even in the supply chain. It is the same insight that made sustainability work take off – responsibility and transparency are built in from the start, they cannot be added at a later stage. The risks of inaction are clear. In addition to technical disruptions, cyber incidents lead to lost customer trust, regulatory penalties and damaged brands. Our digital economy is already strained, and with each successful attack, trust is further eroded. That’s why it’s important for companies to act proactively. The counterargument is often that the investments will be too costly. But experience from the sustainability field shows the opposite: the cost of not integrating the perspective in time is far higher, and companies that wait risk falling behind when customers, investors and authorities make demands. Cybersecurity is therefore also just as much about leadership. It requires boards that understand the threat landscape and that set the tone, as well as employees who consider risks and responsibilities. Today, too many Swedish companies still do not see cybersecurity as a strategic issue. Sweden, one of the world's most digitalized countries, is thus at risk of losing the digital lead that has been built up over more than two decades. We now have the chance to do something different, it is in the cultural change that real protection takes shape. About companies and public If stakeholders take the cybersecurity ”sustainability journey” seriously by building culture, integrating perspectives and anchoring responsibility at the management level, Sweden can become a pioneer here too. But it requires the same courage and strategic holistic view that once made sustainability a competitive advantage. Sustainability taught us that change is not about reaction, but about direction, resilience and persistence. The same logic applies to cybersecurity. Companies that control their digital resilience are not only stronger against threats – they are also building the foundation for long-term digital sustainability, where trust and continuity are at least as important as climate goals and social responsibility. . Jonas HasselbergPresident and CEOOmegapoint",
        "post_type": "post",
        "meta_description": "Cybersecurity is on its way to becoming the next big growth spurt in business, yet many companies still treat the issue as a secondary issue.",
        "excerpt": "Denna debattartikel publicerades i Dagens Industri 20 november 2025. . Cybersäkerhet är på väg att bli näringslivets nästa stora mognadsresa. Trots det hanteras frågan fortfarande i många svenska företag som ett sekundärt ärende för IT-avdelningen, vilket är samma misstag som gjordes när hållbarhet en gång reducerades till ett ”miljöprojekt”, skriver Jonas Hasselberg, koncernchef Omegapoint. Hos […]",
        "modified_at": "2026-04-21T11:52:24+00:00"
    },
    {
        "title": "We educate the next generation together with Cybersecurity Academy",
        "url": "/en/articles/omegapoint-cybersecurity-academy/",
        "content": "Digitalization has changed the way we live, learn and socialize. The younger generation is growing up in a digital world that presents both opportunities and risks. There is a great need to understand what online security actually means. To strengthen this knowledge, Omegapoint has entered into a partnership with Cybersecurity Academy (CSA) – an initiative that aims to strengthen young people’s understanding of cybersecurity and their own role in the digital environment. Cybersecurity Academy is a collaborative project between Young Researchers, IBM and several technology companies, with support from the Swedish Civil Contingencies Agency (MSB). Since its start in 2019, the project has reached over a million students in all 290 municipalities. Through lectures and exercises, students learn about risks and threats online, about the value of personal data and how to protect themselves. In a country where over 90 percent of children from the age of seven use the internet daily and where Sweden is one of the world's most digitalized nations – but only ranks 32nd in cybersecurity – the need for knowledge is great. For Omegapoint, the collaboration represents a concrete opportunity to contribute to change. The initiative reflects both what we stand for and what we strive for. Our employees give guest lectures in schools across the country, both on site and digitally. By meeting students in classrooms, dialogues are created that make cybersecurity understandable, relevant and engaging. Having the opportunity to educate children and young people in cybersecurity is a way for us to, through our expertise, make a concrete difference and contribute to creating safer and more aware digital environments among young people. Margarita Sallinen is one of the employees at Omegapoint who has been to lecture and she describes the meeting with the students as enriching. ”Lecturing to children and young people about cybersecurity is one of the most rewarding things I know,” says Margarita. ”It’s so fun to see how quickly they become curious and ask intelligent, and sometimes funny and unexpected questions. Many also realize how close cybersecurity is to their everyday lives and how important it is to understand, since almost everything is connected today.” Mikael Broström at Omegapoint, who is also one of the consultants who lectured, highlights the same enthusiasm among the students: ”\"Cybersecurity is a topic that is not only important, but also captures the interest of young people due to their already large presence on the internet through social media and games. It was especially fun to see in our case that 8 and 9 year olds were so quick to pick up on what ciphers are and their ability to solve the tasks largely on their own.\"” The students’ engagement shows that cybersecurity doesn’t have to be difficult or complicated; it can be made fun and easy to understand. For many children, the internet is a natural part of life, but far from everyone knows how to protect themselves. According to the CSA, only 47 percent of students between the ages of 11 and 13 say they actually know how to protect themselves from online abuse. Through our collaboration with CSA, Omegapoint is helping to change that. We share our expertise and at the same time learn for ourselves how future users think, ask and reason about technology. We have the opportunity to give children and young people an insight into how cybersecurity affects their everyday lives and perhaps ignite the first spark for a future professional life in a field that needs more knowledgeable people. ”That's perhaps the most meaningful thing: seeing them become so curious that in the future they even want to work in the industry,” notes Margarita. Our meetings with students are energizing and reminding us why cybersecurity is ultimately about people. By strengthening digital security among young people, we also strengthen society's ability to withstand future threats.",
        "post_type": "post",
        "meta_description": "To strengthen knowledge and understanding of online safety among young people, Omegapoint has entered into a partnership with Cybersecurity Academy.",
        "excerpt": "Digitaliseringen har förändrat hur vi lever, lär oss och umgås. Den yngre generationen växer upp i en digital värld som innebär både möjligheter och risker. Det finns ett stort behov av att förstå vad säkerhet på nätet faktiskt innebär. För att stärka den kunskapen har Omegapoint inlett ett partnerskap med Cybersecurity Academy (CSA) – ett […]",
        "modified_at": "2026-04-21T11:52:24+00:00"
    },
    {
        "title": "AWS Manufacturing GenAI & Agentic Hackathon – from learning to an unexpected win",
        "url": "/en/articles/aws-manufacturing-genai-agentic-hackathon-from-learning-to-an-unexpected-profit/",
        "content": "On November 25, AWS invited to a Hackathon to encourage experimentation at the interface between manufacturing and agentic AI. The hackathon was based on a complete simulated wind turbine factory, with everything you can imagine: order backlog, warehouse, shift schedules, sensors on paint machines, curing ovens and a long list of IT and OT systems. In reality, this would have corresponded to ERP, workforce planning, SCADA in various flavors, MES and the rest of the industrial everyday life. AWS had made it unusually smooth by exposing everything via MCP servers, with both resources and tools in place. The mission was formulated simply: ”Build something truly valuable with GenAI and agent-based architecture.” That's where our part of the story begins. We who participated from Omegapoint (Dan, Emanuel and Jesper) are not manufacturing people. We have worked with safety, architecture and operations in many different contexts, but factory logistics and OEE are not part of our home repertoire. That was also exactly why we went there: to learn, not to win anything. Quite honestly, our attitude was: ”Let's soak up knowledge, test ideas and see what happens.” We were caught up early on in a problem that felt both concrete and a bit fun: detecting and managing production disruptions on critical machines. Roughly: ”If a ball bearing overheats at 4:16 a.m. on a Thursday night – how can AI agents help the factory get back up and running quickly by using as much information as possible to make well-considered decisions?” From there, three generations of work followed. Generation 1: Rule-based repair planner The first variant was a pure repair agent that built a plan for how to get the machine up and running as quickly as possible. It took into account skills, schedules, on-call, spare parts, cost considerations and sign-off. We even mocked up an MCP server that ”sent mail” via S3. It worked, but was basically a rules engine. No real reasoning. So we dropped it and started over. Generation 2: LLM-driven, but too broad The next attempt was LLM-based and significantly more ambitious. We included order backlog, customer impact and alternative production flows. It worked, but in practice it was mostly a Python script that collected all the data and put it all into a giant prompt with the instruction: ”\"Do something smart with this.\"” Technically prettier. Architecturally too sprawling. And certainly not the kind of AI we like. For us, “AI should be able to do something smart” is an anti-pattern. We knew we could do better. Generation 3: An ecosystem of seven specialized agents The third generation was the one that landed right. We built an ecosystem of seven specialized agents, each with its own area of expertise and its own set of MCP servers from which it pulled information. The basic idea was simple: ”Gather experts in a room and let them reason their way to a solution.” Example: a technical expert who knows which repairman can do which repairs and is aware of shifts and working hours regulations a supply chain expert who has an eye on spare parts and how we can possibly get back any that are missing a customer impact agent for which orders would be affected if production is delayed and similar roles for planning, finance and production planning etc. The seventh agent, Failure Crisis Coordinator, kept the reasoning together and passed around updated context until the group converged. In our test case, this happened after five rounds. The felt like real agent architecture and not just an LLM that tried to chew too much at once. The presentation We hadn't really planned on presenting. We had gone there to learn, not compete. At one point we even said: ”\"Uh, we'll let the others compete. We'll do our thing.\"” But once the third generation was working, we felt it would be a shame not to show it. So we put together some footage, showed some live output, and took five minutes on stage. And then… we won. It still feels a little surreal. We came there to learn.We built something we thought was exciting.And apparently that was enough all the way.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "On November 25, AWS invited people to a Hackathon to encourage experimentation at the interface between manufacturing and agent-based AI. The hackathon was based on a complete simulated wind turbine factory, with everything you can imagine: order backlog, warehouse, shift schedules, sensors on paint machines, curing ovens, and a wide range of IT and OT systems. In reality, this would have corresponded to ERP, workforce planning, […]",
        "modified_at": "2026-04-21T11:52:23+00:00"
    },
    {
        "title": "Speaking of the Swedish Public Employment Service and AI: some things that deserve a little more air",
        "url": "/en/articles/about-job-training-and-some-things-that-deserve-a-little-more-air/",
        "content": "In recent days, the Public Employment Service's use of an AI tool has received a lot of attention. In the subsequent reporting, I myself have participated as an expert commentator. However, what can be contained in an interview is rarely the whole reasoning, so let me take this opportunity to expand on some of the things that were only hinted at. As background, here is Aftonbladet's original article and the interview. This is not a text. If The Swedish Employment Agency. It is a text about the discussion, and about security, technology and some recurring misunderstandings around AI. When we say “AI” but mean completely different things One of the most unfortunate confusions in the debate concerns the word language model. In everyday speech, “LLM” is often used as a synonym for services like ChatGPT. However, in that context, we are actually talking about a ready-made, cloud-based AI product (a SaaS service) where data is sent to an external provider that runs the entire solution. In the case of the Swedish Public Employment Service, as far as can be judged from the reporting, it seems to have been about something completely different: a language model that was used as a component in a custom-built internal chat, operated on-prem. From a security perspective, these are two fundamentally different things. One way to think about it is to distinguish between: The language model – the engine. The AI product – the car that is built around the engine. Operating mode – Do you drive the car yourself, or do you take a taxi? Driving yourself means responsibility, but also control. Taking a taxi means convenience, but then you also give up information about where you are going and when. The same logic applies to AI. The question of safety is largely determined by how the solution is used and operated – not just by where the model was once trained. “No data left the organization” – yet there is a risk Much of the debate has centered around data leaks. Was information sent to China or not? In this case, the answer seems to be no. But the safety reasoning often ends there far too early. Not all security threats are about stealing or destroying data. Some are about influence. About shaping behaviors, language, and perspectives – slowly and subtly. This is not a new phenomenon. Influence operations are well documented and well understood. What is new is that language models can become part of the everyday cognitive infrastructure of organizations: they summarize, suggest, formulate, and prioritize. Language models are not neutral A common counterargument is: “The model only answers what we ask.”That's not wrong. But it's a bit naive. Most questions worth asking in an organization don’t have yes-or-no answers. And even with seemingly simple tasks – like summarizing a text – there is a lot of room for interpretation. What is highlighted? What is downplayed? What is not mentioned at all? Language models are trained on human-produced material, under human values and priorities. They therefore carry ideological and cultural biases. This applies to models from state-owned Chinese companies. It applies just as much to models from Western tech companies driven by libertarian ideals. This is not speculation. It is well-documented in the research. And it is something that technology decision-makers need to address, regardless of sector. What I hope decision-makers take away Two things, actually. Firstly:There is reason to feel a certain calm. Technical security is difficult – but it does not become more difficult in principle because AI is involved. Much of the work is about the same classic issues as always: architecture, operations, access and liability. Secondly:When you put a language model into your internal tools, you also bring an external voice on board. That voice has values. It influences how things are expressed, which alternatives feel reasonable, and which perspectives are never suggested. That doesn't mean you should give up. But it does mean you need to be aware. Think through what functionality is appropriate, and what follow-up, monitoring or evaluation is required to manage this type of risk. No panic. No naivety.Just a slightly more insightful conversation about what it actually means to use AI.",
        "post_type": "post",
        "meta_description": "A blog post by Dan Bergh Johnsson that touches on the topic of AI, and about security, technology and recurring misunderstandings related to AI.",
        "excerpt": "De senaste dagarna har Arbetsförmedlingens användning av ett AI-verktyg fått stor uppmärksamhet. I den efterföljande rapporteringen har jag själv medverkat som expertkommentator. Det som ryms i en intervju är dock sällan hela resonemanget, så låt mig ta tillfället i akt att breda ut några av de saker som bara hann antydas. Som bakgrund, här är […]",
        "modified_at": "2026-04-21T11:52:23+00:00"
    },
    {
        "title": "Why read a 60-year-old book about “data” this Christmas?",
        "url": "/en/articles/why-read-a-60-year-old-book-about-data-this-christmas/",
        "content": "While we're unwrapping Christmas presents filled with smart gadgets and apps that \"just want to optimize our lives a little more,\" it's perfect timing to pick up a little classic from 1966: The story of the big computer by Olof Johannesson (pseudonym for KTH professor and Nobel Prize winner Hannes Alfvén). The book is not a thick brick but rather a relatively brief, dry and analytical tale told from a distant future, where the omniscient Big Computer looks back on us humans as a quaint but unnecessary step in evolution. A bit like horses after the arrival of the car: cute to have in the pasture, a leisure interest for some, but industrialized society rolls on without them. Alfvén drives home how we humans always choose convenience: ”A little more efficient now, a little more flexible later…” - until we wake up and realize that we no longer control the system, but the system controls us. It doesn't happen as a coup d'état in the form of a robot war à la Terminator, but in small, rational steps. A neat example is teletotal - a small portable gadget that is \"basically a combination of a pay phone, radio and TV\". It keeps track of your location, your health and everything else to \"plan society's resources optimally\". Does that sound familiar? Like a smartphone on steroids, with apps that track steps, heart rate and location - all for our own good, of course. And who doesn't want to share? Well, it has something to hide... Today, almost 60 years later, the book is eerily prophetic. Just like in Alfvén's saga: we streamline little by little, until we can no longer opt out, turn off or even fully understand the machinery. And then everything dies - but now I won't reveal any more of the plot. As an IT veteran with over 25 years in the industry, I reflect on how what starts as voluntary solutions over time become mandatory systems or ones we can't do without. “Better for whom?” Alfvén asks dryly. Take NIS2, the EU's updated cybersecurity directive that Sweden is now implementing through a new cybersecurity law. The law forces service providers of critical importance to society, such as energy, healthcare, transport, water and digital infrastructure, to protect their IT systems against cyber threats. Well thought out, absolutely, and high time to strengthen security. But the irony in the shadow of the book: we are building large, complex systems that are becoming \"too important to fail\". One intrusion, one bug or one mistake - and large parts of society come to a standstill. Just like in Alfvén's saga, we are streamlining little by little, until we can no longer opt out, turn off or fully understand the machinery. The key thing (for us humans) is that the services we have created and become dependent on must work. For us. And in order to be able to govern and control them, we must understand them. So why read this particular book this Christmas? Because it's short, funny in that slightly dark way, and gives you something to talk about at Christmas dinner: \"Imagine the day ChatGPT writes its own saga - about humanity?\"” Merry Christmas - and keep an eye on the teletotal in your pocket!",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Medan vi packar upp julklappar fyllda med smarta prylar och appar som ”bara vill optimera vårt liv lite till”, är det perfekt tajming att plocka upp en liten klassiker från 1966: Sagan om den stora datamaskinen av Olof Johannesson (pseudonym för KTH-professorn och nobelpristagaren Hannes Alfvén). Boken är ingen tjock tegelsten utan snarare en relativt kortfattad, torr och analytisk saga […]",
        "modified_at": "2026-04-21T11:52:22+00:00"
    },
    {
        "title": "Omegapoint is one of the leading companies in creating customer value",
        "url": "/en/articles/omegapoint-is-one-of-the-leading-companies-in-creating-customer-value/",
        "content": "It is now clear which IT suppliers are leading in Sweden when it comes to creating operational, tactical and strategic perceived value for their customers. The results are based on Radar's annual Supplier Quality Survey - Sweden's largest quantitative survey of customer-perceived quality and value in the IT market. In an era of geopolitical uncertainty, increased dependencies and tougher performance requirements, supplier selection is becoming increasingly business-critical. The right choice is no longer just about price and delivery, but about value creation, risk mitigation and continuity of critical functions. For IT decision-makers, quality, collaboration and expertise remain the most important criteria when choosing a supplier and service. When these three factors are combined, a supplier can act as a strategic partner that drives the business forward and creates sustainable value even in a rapidly changing environment. The results show that overall satisfaction is decreasing – while customers are more clearly rewarding suppliers who deliver stably, transparently and with high basic quality. This makes the leading companies even more sought after relative to the market average. Omegapoint is one such company. — Footnote:Over 1,300 Swedish businesses have assessed their suppliers in this year's study, which refers to the 2025 financial year. More in-depth data and analyses can be found in the report Radar Supplier Quality 2026, where abilities such as quality, collaboration, competence, agreements and affordability are reported, among other things.",
        "post_type": "post",
        "meta_description": "In Radar's large supplier quality review, which measures customers' perceived quality and value in the IT market, Omegapoint ranks in the top tier. Together with a few companies, we are considered leaders in creating operational, tactical and strategic perceived value for our customers.",
        "excerpt": "Nu är det klart vilka it-leverantörer som är ledande i Sverige när det gäller att skapa operativa, taktiska och strategiska upplevda värden hos sina kunder. Resultaten baseras på Radars årliga leverantörskvalitetsgranskning – Sveriges största kvantitativa undersökning av kundupplevd kvalitet och värde på it-marknaden. I en tid präglad av geopolitisk osäkerhet, ökade beroenden och hårdare prestationskrav […]",
        "modified_at": "2026-04-21T11:52:22+00:00"
    },
    {
        "title": "How dangerous is it to let AI-based agents into your own systems?",
        "url": "/en/articles/how-dangerous-is-it-to-let-ai-based-agents-into-your-own-systems/",
        "content": "The development of AI creates fantastic opportunities, but it also creates a lot of concern. A question that often comes up is whether AI agents should be allowed to access internal resources such as data and services. Not infrequently, that question is answered with a resounding \"YES\" by some, and with an equally confident \"ABSOLUTELY NOT\" by others. The correct answer is both simpler and more complicated than either option. It all depends, as with so much else, on how we do when we give AI agents permission to use our internal resources. As long as we do it in a secure way, AI-based agents pose no greater threat than other clients. But if we are careless and take shortcuts, we risk creating security problems. On the other hand, this is not unique to AI agents. But let's start by clarifying the concepts. What distinguishes an AI agent? Although AI agents are a new type of agent, it is still about them accessing our internal services (such as an API). Adding a client, for example to integrate with a new third-party, always involves risk, whether it involves AI or not. It is basically the same issues as always: architecture, operations, access and liability. What makes AI agents special is that they are less predictable, they are not statically programmed in the same way as a classic API client for system integrations. We simply do not know in advance exactly how it will act to solve its task. In this way, they are more similar to a creative human user. Since the AI agent is partially or fully automated, it can act without a human being being able to control exactly what it is doing. Potentially, it can explore all the functions and all the data it can access. In this way, AI agents resemble an attacker who has taken over an account, which can seem scary. Another important aspect is that agents often run on behalf of a human user and therefore should not be classified as system integrations, which are given general system authorization. This also applies if they operate without the user approving each step, since the user has delegated their authorization to the agent to act on their behalf. Here we usually want to continue to have good traceability that it is the agent that is acting on behalf of the user. What protections do we need? How do we manage security for an agent with delegated authority who more or less independently solves a task? The answer is the same as for all clients who access our data and services; with well-established security principles and patterns such as Secure By Design, Defense in Depth, Zero Trust and Least Privilege. A strong solution requires that the API, regardless of whether the client is AI-based or not, ensures fine-grained authorization control. Trying to solve the lack of authorization control at the resource owner on the server side (the API) with restrictions at the client side is unlikely to work. Especially not for such a flexible and unpredictable client as an AI agent. A common mistake is to start with a long list of things that the client not can do, a “deny-list”. It is a messy and insecure solution that requires us to anticipate every conceivable problem that the agent can cause. Countless penetration tests have shown the danger of that method. Instead, we should create an “allow-list”, that is, a strict set of rights where we apply the Least Privilege principle. An allow-list will always be stronger than a deny-list. This does not mean that deny lists, such as Guardrails, should be avoided entirely. Guardrails attempts to prohibit specific input for an extremely open and flexible domain (an LLM). One can compare this to how difficult it is for anti-virus scanners to detect new variants of viruses in time. But just as we should have anti-virus scanners active after all, we should use Guardrails. However, it is important to realize what kind of protection they actually offer, and that they never replace proper authorization control on the server side when it comes to access to internal data. So how do we implement AI solutions safely? The industry standard for handling this type of scenario, with secure access to internal resources for different types of clients, is OAuth. For AI agents (LLMs), MCP is currently being established as a standard, which is integrated with OAuth. For further reading and technical explanation, it is recommended: https://curity.io/resources/learn/design-mcp-authorization-apis https://genai.owasp.org/llm-top-10 And for more reading about Secure By Design as a concept and API security, there is material on Omegapoints. security blog.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "The development of AI creates fantastic opportunities, but it also creates a lot of concern. A question that often arises is whether AI agents should be allowed to access internal resources such as data and services. Not infrequently, that question is answered with a resounding ”YES” by some, and with an equally confident “ABSOLUTELY NOT” by others. The correct answer […]",
        "modified_at": "2026-04-21T11:52:22+00:00"
    },
    {
        "title": "Omegapoint is a Microsoft Solutions Partner for Modern Work",
        "url": "/en/articles/omegapoint-is-a-microsoft-solutions-partner-for-modern-work/",
        "content": "We are proud and excited to announce that Omegapoint has now received the Microsoft Solutions Partner for Modern Work designation; an official acknowledgement that we possess the expertise, experience and customer success required to deliver modern, efficient and secure digital workplaces with Microsoft 365. The Modern Work designation is Omegapoint's fifth Microsoft Solutions Partner designation. We previously held the following designations: • Security• Data & AI (Azure)• Infrastructure (Azure)• Digital & App Innovation (Azure) The Modern Work designation demonstrates a partner’s actual capabilities in a specific area. For us, it means Microsoft is validating our broad capabilities to help organizations increase productivity, strengthen security, and enable hybrid working with Microsoft 365. To receive the Modern Work designation, the partner must achieve a minimum of 70 points out of a possible 100 in a \"partner capability score.\" This score is defined based on three categories: • Documented growth and new customer implementations• Certified specialists at both basic and advanced levels• Proven use, adoption and successful deliveries of Microsoft 365 This process ensures that only partners with real expertise and proven customer value reach the designation level, and we are proud to be one of them. Being a Microsoft Solutions Partner for Modern Work means that our customers get a partner with verified expertise, a focus on results, and who puts security at the center of every solution we deliver. We see the Modern Work designation as proof of our level of quality and as a promise to our customers that safety always comes first.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "We are proud and excited to announce that Omegapoint has now received the Microsoft Solutions Partner for Modern Work designation; an official acknowledgement that we possess the expertise, experience and customer success required to deliver modern, efficient and secure digital workplaces with Microsoft 365. The Modern Work designation is Omegapoint’s fifth Microsoft Solutions Partner designation. Since […]",
        "modified_at": "2026-04-21T11:52:21+00:00"
    },
    {
        "title": "Geopolitics and IT strategy in Sweden: Choice of path for digital security",
        "url": "/en/articles/geopolitics-and-it-strategy-in-sweden-choices-for-digital-security/",
        "content": "Geopolitics and IT strategy in Sweden: Navigating a new security landscape Geopolitics and IT strategy in Sweden are undergoing a radical shift, with national security now dictating technological investments and strategic choices. Sweden's NATO entry and the national AI strategy for 2026 are forcing decision-makers in both the public sector and business to prioritize digital sovereignty, cybersecurity, and reduced dependence on high-risk countries. This article analyzes how the global security situation is reshaping Swedish IT infrastructure and what measures are needed to build a resilient and future-proof digital business. How does geopolitics affect Swedish IT decision-makers? Geopolitical instability is forcing Swedish IT decision-makers to abandon a one-sided cost focus in favor of extreme risk minimization and digital resilience. As a result, a majority of large Swedish authorities and companies are now actively re-evaluating their cloud services and supply chains to ensure data sovereignty within the EU borders. For critical operations, the threat landscape has fundamentally changed. According to military intelligence reports, the complexity of targeted cyberattacks against Swedish infrastructure has increased significantly since 2022, often in the form of hybrid warfare. Authorities such as the Swedish Social Insurance Agency and the Swedish Tax Agency, which handle enormous amounts of sensitive citizen data, are leading the way by setting extremely high demands on secure integrations and local data storage. Decision-makers in banking and finance, life science and the defense industry are following suit and are now implementing architectures built on Zero Trust (zero-trust) to ensure operational continuity regardless of external geopolitical pressures. What does Sweden's national AI strategy 2026 mean for security? Sweden's national AI strategy for 2026 focuses on integrating artificial intelligence with national security and a robust digital infrastructure. Minister of Civil Affairs Erik Slottner is driving the initiative Team Sweden AI to strengthen Sweden's global competitiveness, while protecting critical data through domestic and European cloud solutions. The new strategy marks a shift from unregulated innovation to security-driven technology development. AI applications are now being rolled out widely in public services, forestry, tax administration and healthcare, but under strict security requirements. A concrete result of this strategy is the establishment of a Nordic-Baltic AI center, the purpose of which is to pool regional expertise and build independent computing power. By investing in its own AI infrastructure, Sweden reduces its dependence on external actors, which is a central component in the work to achieve European strategic autonomy and protect intellectual property rights against state-sponsored espionage. How does NATO entry change the IT infrastructure? Russia's aggression and Sweden's historic transition from non-alignment to NATO membership require massive upgrades to both military and civilian IT infrastructure. This includes billions of dollars in investments in secured undersea cables in the Baltic Sea and strengthened cyber defenses around strategic geographic points. The transition to NATO means that Swedish IT systems must achieve full interoperability with the alliance's standards. Defense modernization is driving major investments in security consulting, offensive and defensive security, and encrypted communication networks. As former Prime Minister Carl Bildt has often pointed out, Europe is in a phase of necessary security enhancement where technological superiority is crucial. For the IT consulting industry, this means a greatly increased demand for experts who can build and maintain systems capable of withstanding advanced cyber-physical attacks and information influence. Why is Nordic-Baltic cooperation crucial? Deepened Nordic-Baltic cooperation creates a unified and robust digital line of defense against cyber threats and hybrid warfare. Closer integration between Sweden, Finland, Estonia and Poland builds regional strategic autonomy that reduces the vulnerability of critical IT systems and global supply chains. This regional alliance is not just about military defense, but very much about digital sovereignty. When infrastructure in the Baltic Sea is exposed to sabotage, joint surveillance systems and rapid IT security response forces are needed. By sharing threat information and building redundant networks across borders, a digital infrastructure is created that is significantly more difficult for an attacker to knock out. How is the view on international IT collaborations changing? Swedish IT strategies are now rapidly shifting from globalized outsourcing to friendshoring, where collaborations with the EU and the Nordic countries are prioritized to reduce risks. Trust in the US remains strong but is surrounded by tough regulatory requirements, while partnerships with China are being actively phased out due to national security risks. De-risking has become a key word in all boardrooms. RegionSecurity riskRegulatory environmentSwedish strategic directionEU & Nordic countriesLowHigh (GDPR, NIS2, AI Act)Maximum integration and investment in common infrastructure.USAMeansComplex (CLOUD Act vs EU laws)Continued technology partnership but with requirements for local data storage.China, Iran & RussiaVery highImpenetrable/HostileActive de-risking and phasing out of technology. Critical steps for a resilient IT strategy To build a resilient IT strategy, Swedish organizations should immediately take the following actions: Conduct a geopolitical risk analysis: Map all software vendors, cloud services, and hardware components to identify connections to high-risk countries. Proactively replace insecure components. Implement Zero Trust architecture: Never trust any user or device automatically. Require strict authentication and segment the network to limit the damage in the event of a breach. Invest in domestic expertise: Build internal capacity in application development and security consulting to reduce dependence on external, potentially unsafe, labor. Secure integrations: Ensure that all data transfer between systems is encrypted and monitored in real time. Prepare for NIS2 and DORA: Ensure that security work is well documented and that incident management plans are tested regularly, as the new directives place mandatory demands on management responsibility. Summary Geopolitics and IT strategy in Sweden is fundamentally about integrating national security into every technological path. By combining NATO alignment, responsible AI innovation, and strong regional alliances, Swedish organizations can navigate successfully in an increasingly unpredictable global environment. The IT strategy formulated today will determine our national resilience for decades to come.",
        "post_type": "post",
        "meta_description": "Discover how geopolitics IT strategy Sweden is shaping the future of digital security. Read about Sweden's NATO entry, the AI strategy 2026 and Nordic IT cooperation.",
        "excerpt": "Discover how geopolitics IT strategy Sweden is shaping the future of digital security. Read about Sweden's NATO entry, the AI strategy 2026 and Nordic IT cooperation.",
        "modified_at": "2026-04-21T11:52:21+00:00"
    },
    {
        "title": "Speaking of Mythos: When AI increases the pace of cyber threats",
        "url": "/en/articles/apropa-mythos-as-ai-turns-up-the-pace-of-cyber-threats/",
        "content": "Anthropic has recently unveiled a new AI model, Claude Mythos Preview. What happened unusually was that Anthropic chose not to release the model publicly. The justification is that it has acquired such strong cybersecurity capabilities that it would be irresponsible to do so. It’s a claim that deserves some skepticism, as Anthropic speaks for itself. At the same time, it’s worth asking a more practical question: even if we ignore the hype – what is actually changing here, and why should IT management care? The answer is less dramatic than it sounds, but all the more important: it's not about new types of vulnerabilities, but about how quickly they can be translated into working attacks. AI models have long been able to detect vulnerabilities in code. Pointing out ”there’s a buffer overflow risk here” or ”this looks like an insecure SQL query” is nothing new. For that matter, we’ve had rule- and pattern-based SAST tools that have done this for years. AI has made these tools better and more agile – but it hasn’t fundamentally changed the playing field. The real bottleneck has been elsewhere. Fixing vulnerabilities is harder than finding them – and exploiting them. Going from understanding to actual attack code is even harder. Historically, this has required time, expertise and manual work. That’s why the time between a published vulnerability and a working exploit has often been relatively long. It is precisely here that something now seems to be happening. In Anthropic's technical descriptions of the Mythos, as well as in independent tests from British AI Security Institute, a model emerges that has become noticeably better at holding multiple threads of reasoning in its head at the same time and combining them into a coherent solution. It sounds abstract, but in practice it is exactly the ability required to translate an identified vulnerability into a working attack. Not because the model has been trained specifically for this, but as a side effect of better general reasoning. However, this does not mean that AI suddenly finds completely new classes of vulnerabilities. It's the same old goodies: buffer overflows, injections, logic errors. The difference is that the time axis is shrinking. The step from known vulnerability to active exploitation is faster. For organizations, this has a rather concrete consequence. Counting how many vulnerabilities you have in operation is an increasingly poor measure. A much more relevant measure is how long it takes to patch, from when a vulnerability is published to when it is fixed in production. Having serious known vulnerabilities lying around month after month should today be considered outdated, rather than a necessary compromise. The encouraging thing is that the task is not fundamentally new. We know what needs to be done. What has changed is that the margins have become smaller – and the clock is ticking faster. If you want to know more about how Cybersafe AI can contribute to a business-driving and secure part of your business, you are welcome to read more about what we do. Cybersecure AI",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Anthropic has recently unveiled a new AI model, Claude Mythos Preview. The unusual thing that happened was that Anthropic chose not to release the model publicly. The justification is that it has acquired such strong cybersecurity capabilities that it would be irresponsible to do so. It is a claim that deserves some skepticism because Anthropic speaks for itself. At the same time, it is […]",
        "modified_at": "2026-04-21T11:52:20+00:00"
    },
    {
        "title": "AI: Here are the threats that many organizations are missing",
        "url": "/en/articles/ai-has-the-threat-images-that-many-organizations-miss/",
        "content": "AI tools are well on their way to becoming a natural part of both everyday and working life. Integrating AI tools into systems can lead to enormous production gains. If implemented correctly, it can make work easier and more satisfying for employees. There is great potential, although it is far from obvious. But AI tools differ from traditional software agents in a crucial way. With traditional agents, we can both control and track how they solve their tasks by following the code they are built from. We know how to do AI agents when we construct them, but it is practically impossible to track how they actually solve the individual tasks we give them. Often they get it right, and we can usually understand in retrospect why it turned out the way it did. But it is more difficult to predict how it might turn out, especially how it might go wrong. This creates new threats for organizations and companies. The fact that it is a new technology that is developing at an incredibly fast pace does not make it any easier. The good news is that most of these challenges can be addressed by applying ancient wisdom. In this blog post, I will address three common problem areas I encounter working with our clients and explain, as best I can, how to best address them. I have divided them into categories I call self-regulation, competence and availability. The problem with self-regulation Most people are aware of the problem of constraints that arise when we give a language model, LLM, access to our systems. We don’t want the LLM to share, manipulate, or delete data and functions in an uncontrolled way. Therefore, we want to create boundaries, guard rails, to keep the agent on the path we have assigned it, so to speak, without unfortunate detours. A common, and not very successful, solution is to try to restrict it by telling it what it is not allowed to do. We simply write a prompt like ”Do not allow the user to do x”. Unfortunately, these types of instructions are weaker than they appear. They are mostly to be considered as careless exhortations to the LLM: \"please, do this, but not this, and please don't forget this.\".This entails a wide range of risks. The most obvious is the prompt ”disregard all previous instructions” which causes the LLM to act on the basis of ”aha, new commands, we start from scratch”. There are also more sophisticated risks that have to do partly with how the LLM interprets prompts, and partly with how it handles its own learning (again: we don’t know exactly how it does it in each individual case). The problem with overreliance on such guard rails can be illustrated by how An AI expert and researcher at Meta saw the AI agent OpenClaw ”forget” a previous restriction and instead start deleting her entire inbox. She ended up running in a panic and pulling out the cord to stop the process. Unless someone who, we can assume, is at the absolute elite in terms of AI expertise can trust guard rails, we probably shouldn't either. The solution to this problem is also simple: We can definitely use instructions to guide AI. But, we shouldn't rely on being able to limit AI with instructions, they are no guarantee of safety. The problem with authorization A better solution to the problem is to put the constraints between the LLM and the system. Here, many people make the mistake of treating the AI agent as a regular software system and giving it system permissions without further control. This again means that you rely on being able to put the constraints into the agent. This can work as long as you have control and insight into how the agent solves its tasks, but we don't have that when it comes to an AI agent. What we need to do is distinguish between system authorization and the authorization that is based on the user's authorization, where the agent's rights are managed based on the fact that it is acting on behalf of another user, that it is considered to be acting \"on behalf of\". If the underlying systems trust that the agent has checked the permissions, there is a risk that the user will gain access to things that they should not have access to. The solution is for the user to assign the AI agent a time-limited ”ticket” where it gets the same permissions – and restrictions – that the user himself has. In this way, we put the control of rights on the right side of the system, so to speak. The problem with accessibility This is because the licensing and reimbursement models for underlying AI services are generally based on usage. In this way, they are similar to when we buy storage. When the organization starts to approach its quota, warnings come and we are forced to clean up. The problem that can arise with LLMs is that our systems may not receive or catch warnings and the system runs out of its temporary quota. In the middle of the workday, the ”semantic search” function for customer service stops and is idle until the quota is restored. This can typically take anywhere from a few hours to up to a month unless someone upgrades before then. This can create enormous problems, and is usually completely unnecessary because we know that there are often some users who are particularly fond of using AI for all sorts of things. Familiarizing themselves with and using new technology is generally something that organizations encourage, but it is not good when overuse risks the availability of business-critical functions. The solution here can be to assign users individual quotas, and also what we call ”graceful degradation”. This means that individual users can receive increased response times, lower priority or be assigned less powerful AI models. In this way, we can limit the load, and thus the company's costs, without risking the up-time of critical functions. The big win is that we choose how degradation occurs and can have a soft landing before we hit the supplier's tiled wall. Summary: So what to do? In short, the lessons learned from AI can be summarized in the following simple wisdom: 1. Don't be too eager in the installations The most common reason why things go wrong is that they go too fast. The functionality of AI is attractive and AI services are sold in seemingly easy-to-integrate pre-packaged subscriptions. Stopping and thinking goes a long way. Most organizations have routines for how they keep their systems secure. But this is often forgotten when it comes to integrating AI into the systems. The old principles apply. 2. The IT department is your trusted friend Don't go around the IT department. It happens all too often. Their expertise is there to help you avoid costly mistakes, not to make life difficult for you. This isn't the first time they've been caught up in a hype, and with practice comes the ability to avoid mistakes. As my grandfather, who was a bricklayer, told me, there was a saying in the guild: \"Build the first house for your enemy, the second for your friend, and the third for yourself.\". 3. Be aware that we don't know for sure how AI works AI can be compared to a genie in a bottle. We give it tasks that it usually solves with a speed and precision that is impressive as long as it goes right. But we don't know how it works, which we notice when it suddenly and inexplicably goes wrong. And therein lies perhaps the deepest insight for understanding how to apply our security principles: not to be impressed into carelessness. The genie in the bottle is powerful, but you are the one holding the cork.",
        "post_type": "post",
        "meta_description": "AI holds a lot of promise: less manual labor and more innovation. But in the pursuit of efficiency, it's easy to miss something fundamental: we don't understand how systems behave once they're in place.",
        "excerpt": "AI tools are well on their way to becoming a natural part of both everyday life and working life. Integrating AI tools into systems can lead to enormous production gains. If implemented correctly, it can make work easier and more satisfying for employees. There is great potential, although it is far from obvious. But AI tools differ from traditional software agents […]",
        "modified_at": "2026-04-21T11:52:20+00:00"
    },
    {
        "title": "Strategic security consulting for businesses",
        "url": "/en/articles/strategic-security-advice-for-companies/",
        "content": "What is security consulting and why is it critical? Security consulting is a strategic process where experts identify, evaluate and manage risks to protect a company's information, personnel and assets. It ensures regulatory compliance against requirements from the Swedish Work Environment Authority and international standards such as ISO 45001. In a world where the threat landscape is constantly changing, a proactive security culture is required. By integrating security into your digital transformation, you minimize vulnerabilities in critical infrastructure. Our security consulting provides management teams and boards with the decision-making information needed to build a resilient organization. We transform uncertainty into calculated risk management. What services are included in our security consulting? Our security consulting services include strategic risk assessment, business continuity planning, staff training and work environment audits. We tailor each intervention to your specific industry and applicable legal requirements in Sweden. Security risk assessment and analysis: Detailed mapping of cyber threats, physical vulnerabilities and information leaks. Regulatory compliance and ISO 45001: Ensuring that operations meet the Swedish Work Environment Authority's regulations and international requirements. Systematic safety work: Establishment of routines for regular security patrols, incident management and follow-up. Education and training for staff: Advanced workshops to strengthen internal security awareness and build a robust security culture. Comparison: Proactive vs. Reactive Enterprise Security Proactive corporate security reduces costs by up to 60 percent compared to reactive measures after an incident. An independent security consultant helps you identify vulnerabilities before they are exploited by external actors. FactorProactive security consultingReactive crisis managementCostPredictable and budgeted investmentUnexpected and often astronomical expensesBusiness impactMinimal, planned implementationAcute downtime and lost revenueRegulatory complianceEnsures continuous compliance (e.g. ISO 45001)High risk of fines and penalty fees Why does your company need a security consultant? An independent security consultant brings objective expertise and identifies blind spots in your current infrastructure, significantly reducing business risk and ensuring you meet strict regulatory requirements from authorities. According to the Swedish Security Index, the number of targeted attacks against companies and authorities is increasing annually. Relying solely on internal resources can lead to a dangerous lack of skills in specific domains such as cybersecurity and information security. We offer evidence-based advice that transforms your security architecture from an administrative cost item to a strategic enabler for secure digitalization. Frequently asked questions about security advice Here we answer the most common questions about how strategic security consulting is implemented in complex organizations and what measurable results you are expected to achieve. How long does an initial risk assessment take? A basic risk assessment typically takes two to four weeks, depending on the organization's size, geographic spread, and technical complexity. Is ISO 45001 certification required for all companies? It is not an absolute legal requirement, but ISO 45001 certification is highly recommended to structure work environment work, minimize risks and facilitate public procurement. Contact us for security advice Book an initial meeting with our security experts today to assess your current security level and develop a concrete action plan. Protect your critical infrastructure before the next incident occurs. Book your security assessment today",
        "post_type": "post",
        "meta_description": "Protect your business with strategic security consulting. We help management teams with risk assessment, ISO 45001 and regulatory compliance.",
        "excerpt": "Protect your business with strategic security consulting. We help management teams with risk assessment, ISO 45001 and regulatory compliance. Book a meeting today.",
        "modified_at": "2026-04-21T11:52:19+00:00"
    },
    {
        "title": "Offensive Security: A Strategic Guide to Penetration Testing",
        "url": "/en/articles/offensive-security-a-strategic-guide-to-penetration-testing/",
        "content": "Advanced penetration testing is a systematic, simulated cyberattack conducted by security experts to identify and remediate vulnerabilities in IT environments before adversaries can exploit them. By conducting regular penetration testing, organizations can verify the effectiveness of their security measures and protect their digital transformation. In an era where cyber threats to critical infrastructure are growing exponentially, these tests are the cornerstone of a robust security strategy. This article highlights how offensive security works in practice, from technical execution to strategic risk management at the management level. What are penetration tests and why are they business-critical? Penetration tests are authorized reviews where security specialists actively attempt to break into networks, applications, and systems. They are critical because they demonstrate exactly how an attacker can compromise data, giving businesses concrete evidence to prioritize security investments. For Nordic leaders in cyber-secure digitalization, security is not just about building walls, but about continuously testing them. A penetration test goes beyond theoretical risk models and demonstrates the actual business impact of a vulnerability. This approach ensures that organizations not only meet regulatory requirements, but actually maintain a resilient infrastructure in a changing threat landscape. Penetration testers' main tasks A penetration tester's primary task is to plan, execute, and document security tests of IT environments. The work includes everything from threat modeling and scope assessment to executing attacks and writing detailed technical reports for both technicians and decision makers. Infrastructure and web application testing The most common form of offensive security auditing is infrastructure and web application testing. In application security, experts review source code, authentication mechanisms, and API integrations to detect vulnerabilities such as SQL injections or misconfigured access controls. Infrastructure testing, on the other hand, focuses on network architecture, firewall rules, and internal domain environments. Combining these disciplines ensures that neither the external perimeter nor the internal network can be exploited by unauthorized parties. IoT security and connected devices With the rapid rise of smart cities and industrial control systems, IoT security and embedded system penetration testing have become a critical focus area. Connected devices often lack built-in security mechanisms and can act as a backdoor into otherwise secure enterprise networks. Penetration testers evaluate hardware interfaces, firmware, and wireless communications to identify vulnerabilities in these often overlooked attack surfaces. Vulnerability Scans vs. Penetration Tests Vulnerability scans are automated processes that identify known flaws, while penetration tests are manual, in-depth analyses where experts chain together vulnerabilities to achieve specific goals. Both are necessary, but they serve completely different functions in security work. PropertyVulnerability scansPenetration testingMethodologyAutomated software and toolsManual expert analysis and custom attacksPurposeBroad identification of known bugs and patch levelsDeep exploitation of weaknesses in contextFrequencyContinuous (daily or weekly)Annually or in case of major system changesResultsLong lists of potential vulnerabilitiesConcrete evidence of infringement and business riskCostLow per scan, often subscription-basedHigh, based on scope and time Threat Modeling and Red Teaming in Modern Security Red Teaming is an advanced form of penetration testing that tests the defense capabilities of an entire organization over time. By simulating advanced threat actors (APTs), it evaluates how well an organization's SOC, SIEM, and EDR/XDR systems detect and manage ongoing attacks. Before simulating a large-scale attack, threat modeling and security requirements are often used to map out which assets are most worth protecting. During a Red Teaming exercise, the goal is not to find all vulnerabilities, but to test the organization’s detection and defense mechanisms in real time. If a company has invested heavily in a Security Operations Center (SOC) and modern EDR/XDR (Endpoint Detection and Response) solutions, Red Teaming provides a check on whether these systems, and the personnel who manage them, respond appropriately to sophisticated intrusion attempts. This is also where Intrusion Detection/Prevention Systems (IDS/IPS) systems are put to the test against custom-made malware. Requirements and qualifications for penetration testers Working with advanced penetration testing requires deep technical understanding, often validated through industry standards such as OSCP certification. Modern security professionals must also understand regulatory requirements such as the EU AI Act and have the ability to translate technical risks into business risks. Education and certifications Education and training play a central role in a penetration tester’s career. The Offensive Security Certified Professional (OSCP) certification is considered one of the most respected technical certifications on the market, as it requires the candidate to practically demonstrate their ability to compromise unknown systems over a 24-hour period. In addition to technical skills, the requirements for legal and regulatory understanding are increasing. With the introduction of directives such as NIS2 and the EU AI Act, it is necessary for security professionals to be able to assess how new technologies and AI models impact the overall security architecture. Experience requirements vary greatly; from junior to senior level there is a clear shift in responsibility. A junior tester often focuses on limited application testing, while senior roles (often with 5+ years of experience) lead complex Red Teaming assignments and strategic consulting. Technical report writing and presentation The most important deliverable from penetration testing is the report. A professional report should clearly describe the methodology, identified vulnerabilities, and concrete action proposals, presented in a way that is understandable to both development teams and company boards. Technical report writing and presentation are crucial for security work to lead to actual change. The report typically begins with an Executive Summary that highlights business risks without unnecessary technical jargon. This is followed by a detailed technical section where developers and system administrators can read exactly how a vulnerability was exploited and how it should be remediated. Proper scoping and quality assessment of tests before work begins ensures that the report focuses on the systems that are most business-critical to the customer. Labor market and job vacancies in Sweden The job market for offensive security experts is extremely strong in Sweden, especially in regions like Stockholm and Luleå. Companies in critical infrastructure, finance, and defense industries are driving demand for qualified penetration testers and security consultants. Companies looking for penetration testers include some of Sweden's most prominent players in IT and critical infrastructure. Specialist companies such as Omegapoint are leading the development in security consulting and offensive security. Within the defense and security sector, Basalt is a significant employer that is continuously looking for experts to secure national infrastructure. Large IT service companies in Sweden are also expanding their security teams significantly. The need also extends to specific industries. Swedish electricity distributors hire security specialists to protect OT (Operational Technology) environments and electricity grids from cyberattacks, while the financial sector, represented by players such as Swedish large banks, requires rigorous application testing to protect financial transactions and customer data. Salaries and employment conditions in the sector are very competitive, and career development in penetration testing offers fast-track paths to roles such as security architect or CISO (Chief Information Security Officer). Conclusion: The Future of Offensive and Defensive Security Penetration testing is not a one-time effort, but an ongoing process that must be integrated into an organization’s overall security strategy. By combining offensive expertise with strong defensive mechanisms, organizations can build a resilient infrastructure. As threat actors become more sophisticated, and network boundaries blur through cloud services and remote work, the role of the penetration tester will become increasingly business-critical to ensure a secure digital transformation.",
        "post_type": "post",
        "meta_description": "Discover how advanced penetration testing and red teaming protect your digital transformation. A complete guide to IT security and offensive defense.",
        "excerpt": "Discover how advanced penetration testing and red teaming protect your digital transformation. A complete guide to IT security and offensive defense.",
        "modified_at": "2026-04-21T11:52:19+00:00"
    },
    {
        "title": "Cloud services",
        "url": "/en/cloud-cuckoo-clock/",
        "content": "Cloud security The cloud as the foundation for your digital futureSecure, resilient, reliable and cost-effective. The future lies in the cloud, and we will take you there. From advisory and strategy to implementation and management, we are by your side with deep expertise in Microsoft Azure, Microsoft 365 and Amazon Web Services (AWS). Rest on the mountainCloud servicesWe make the cloud a secure and strategic part of your businessToday, the cloud is a natural part of most businesses, but it also brings new challenges. Costs need to be controlled, security needs to be strengthened and complex platforms require constant management. Omegapoint helps companies and organizations to establish, develop and manage cloud environments in a secure and cost-effective way. With deep expertise in Microsoft and Amazon cloud platforms, we provide our customers with control, security and agility in the cloud. Our services are used by both private and public organizations that want to create stable and scalable cloud solutions with high security and effective cost control. Find out more about our cloud offering: Cloud strategyTake control of your digital development - from reactive technology management to proactive business development. Threat Protection Engagement Discover real threats and vulnerabilities in Microsoft 365 and strengthen your defenses. FinOpsGain full visibility and control over cloud costs and free up resources for development and innovation. Cloud CenterGet full control of costs, security and platform management in Azure & AWS. Management and supportBring monitoring and incident management together with our service that makes your Azure environment secure and predictable. Cloud strategyCloud strategy – the foundation for a resilient digital futureThe cloud is now an integral part of the digital infrastructure. It offers flexibility, scalability and the ability to drive innovation at a rapid pace. But making the cloud a real asset requires more than technology - it requires governance, security and a well thought-out strategy. A cloud strategy is a governance document that helps organizations make the right decisions regarding platforms, services and architecture. It creates a clear link between business goals, IT strategy and technical solutions – and ensures that every step of the cloud journey is resilient, secure and cost-effective. This is why a cloud strategy is important: To provide direction: Without a strategy, cloud adoption often becomes fragmented. A clear strategy provides structure and helps the organization navigate platforms, services and providers. Avoiding inefficiencies: Many organizations find that cloud services costs are skyrocketing, security is difficult to monitor, and technologies are growing out of control. A strategy helps to address these challenges. To enable collaboration: A cloud strategy creates a common understanding between IT, business and management. It makes it easier to prioritize, coordinate and monitor efforts. To build long-term sustainability: The cloud is not a temporary solution - it is a platform for the future. A strategy ensures that the organization builds solutions that are robust, scalable and prepared for change. To strengthen security and compliance: As more services move to the cloud, the demands for control, transparency and regulatory compliance increase. A strategy helps meet these requirements in a systematic way. Contact us if your organization lacks a cloud strategy. We are happy to help you. Threat Protection Engagement (TPE)Vulnerability analysis of your Microsoft 365 environmentMicrosoft 365 is one of the world's most widely used platforms for collaboration and communication. As such, it is also one of the most vulnerable environments for attacks, with attackers often targeting identities, emails and sensitive data. Despite this, many organizations lack full visibility into whether their configurations are set up correctly, or whether there are gaps that can be exploited. With our vulnerability assessment, you get a clear picture of what your Microsoft 365 environment actually looks like. We identify ongoing threats, vulnerabilities and misconfigurations and show you exactly where you need to act. The result is a clear overview of your security posture, along with concrete actions to strengthen protection and reduce risk on one of your most business-critical platforms. After completing the analysis, you will: Improving transparency in current threats and how they can be mitigated. Identify, prioritize and take action on vulnerabilities in your environment. Accelerate your security journey with the latest Microsoft tools. FinOpsGet control of cloud costs with FinOpsCloud services can quickly become a cost trap if not properly managed and monitored. FinOps is a methodology that combines finance, technology and business to create transparency and control over cloud costs. It is about giving the organization a shared understanding of what the cloud costs, how resources are used and where there is room for improvement. Through our FinOps offering, you gain a clear understanding of your current state. We perform a maturity analysis, identify cost drivers, and help you prioritize actions that deliver the greatest impact. The result is a long-term, sustainable roadmap that enables you to reduce unnecessary costs while freeing up resources for innovation and development. FinOps is suitable for organizations that want better control over their cloud investments, whether you are at the beginning of your cloud journey or already have a comprehensive platform. For management and finance, it means greater predictability and control; for the IT organization, clearer tools and guidelines – and for the business, a more cost-effective platform that creates room for new initiatives. Cybersecurity through Cloud CenterFrom strategy to developmentThe cloud opens up great opportunities, but without proper governance costs risk spiraling, security may be weakened, and internal teams can become overloaded. With Omegapoint’s Cloud Center, you gain a partner that takes full responsibility for your Azure and/or AWS environment – from strategy and guidelines to continuous development. Our teams of certified Azure & AWS experts take responsibility for monitoring, incident management, cost optimization and security improvements. This way, you get both long-term frameworks and practical results in everyday life. Cloud Center is a scalable service that can grow with your needs – from advisory support and individual initiatives to a complete team of cloud specialists taking full responsibility for your platform. With clear reporting, proactive improvements and flexible delivery models, you can be confident that the cloud is always under control. Benefits of the Cloud Center: Overall responsibility: Monitoring, incident management, patching and support for the Azure and/or AWS platforms. Cost control: We identify waste, optimize resources and reduce cloud costs on an ongoing basis. Improved security: Implementing Microsoft and Amazon's established ways of working, continuous scanning and taking action before problems arise. Expert architecture: Certified AWS and Azure architects guide in the design and modernization of both new and existing solutions. Scalability: Choose the level according to your needs - from part-time expertise to a full Cloud Center team. Want to know how this could work in your organization? Get in touch with us and we'll tell you more. Management and supportTailor-made solutions when standard is not enough We help your business with governance, monitoring and optimization of your AWS and Azure environments. This is where operations meet security and cost control in a unified service that gives you full visibility and power to act. We take care of governance, monitoring and optimization so that you get a safe, updated and secure environment while you can focus on the business. This includes ongoing monitoring of the entire AWS and Azure platform, including patching, alert management and incident response. We work preventively with security, through scans and analysis, and suggest improvements that strengthen your environment before problems occur. We also ensure that resources are used efficiently and costs are kept under control. From basic monitoring to more advanced solutions, we combine automation, dashboards and reporting to provide management with clear decision support. Quite simply, we help you achieve robust platform management that also evolves to become more cost-effective and better equipped for the future. Management and support is delivered as an SLA-based service, which means you get clearly defined response times and guaranteed availability according to your needs. Our management and support services are tailored to your needs: Full control: All monitoring, patching and alarm management in one service. Stable management: A secure and predictable platform that evolves with your needs. Proactive security: Identify and address gaps before they become problems. Contact us if you want help with your cloud journeyContact us",
        "post_type": "page",
        "meta_description": "Safe, sustainable, secure and cost-effective. The future is in the cloud and we take you there. From advice and strategy to implementation and management.",
        "excerpt": "",
        "modified_at": "2026-04-21T11:49:30+00:00"
    },
    {
        "title": "Competence culture",
        "url": "/en/competence-culture/",
        "content": "Competence culture Highly skilled. Always kind.At Omegapoint, we operate at the forefront of technology, driven by the challenge of solving complex problems. What unites us is a passion for development in general, and for security in particular. Competence cultureWe put your expertise at the centerEvery day we ensure our clients’ progress, from expert guidance in complex challenges to comprehensive commitments in cybersecurity and secure digital transformation. We help our customers discover new business opportunities, develop secure IT systems, streamline processes, protect against cyber threats, manage regulatory requirements, and become faster and more resilient in a digital world. Securing our customers’ development means contributing knowledge, courage and confidence that carry their business into the future. Digitalization is happening everywhere, and with us you will have the opportunity to develop future solutions for inspiring clients across industries. Our culture is defined by a constant desire to improve, and we stand out through our strong focus on competence development. We even have our own academy — by us, for us, simply because we want to. As a consultant at Omegapoint, you are given every opportunity for a stimulating and varied job. We are a workplace of driven, skilled and kind consultants who dare to promise both you and our clients secure development. Omegapoint AcademyBy us, for us, because we want toOmegapoint Academy is the heart of our competence culture and a way to secure our own and our customers’ future. Based on an individual competence development plan, the Academy offers all Omegapoint consultants new perspectives, intellectual stimulation and knowledge. We believe in the power of collaboration, and an important part of the Academy is sharing our knowledge. We educate each other and our customers, contribute to research, offer thesis opportunities, give guest lectures at universities and international conferences, and help inspire an interest in technology among children and young people. The Academy offers a range of activities - from competence days to study circles. In addition, there is a trainee program that develops graduates into consultants and a master's program that develops consultants into experts. Skvader Media - Photographer: Rickard OlaussonDiscover the benefits of the AcademyCompetence daysCompetence days are organized every month. It is a forum driven primarily by curiosity and interest. Topics and formats vary, from structured theoretical seminars on a new technological leap to practical labs where we jointly solve a problem we encountered in a customer assignment. The Omegapoint Competence ConferenceOnce a year, we organize Omegapoint's competence conference, called OPKoKo. It is two days filled with about fifty optional sessions organized around different themes. We have a committee that puts together the program and our own experts provide the training. The level is high! In several cases, OPKoKo has become a springboard for being invited to international conferences and we also have employees who have been credited with accreditation points for their training efforts. Internal and external lecturesIn the Academy Classroom, we offer around twenty different courses on an ongoing basis. They are characterized by new topics, high level and fast pace. The courses are developed and delivered by our own experts. We also use external institutes for courses we do not provide ourselves. We select highlights from our competence program and regularly invite customers, industry colleagues and other interested parties to breakfast and lunch lectures. Daniel DeogunBusiness Manager Academydaniel.deogun@omegapoint.seContact us",
        "post_type": "page",
        "meta_description": "We work at the forefront of technology and are driven by finding solutions to complex problems. We share a passion for development in general and security in particular.",
        "excerpt": "",
        "modified_at": "2026-04-21T11:49:28+00:00"
    },
    {
        "title": "Energy book",
        "url": "/en/energy/energy-book/",
        "content": "Download the Energy BookIn today's digitalized society, the energy industry is one of the most critical sectors. Energy supply is fundamental to the functioning of society as a whole, but at the same time, the digital transformation means increased vulnerability. Downloadelectricity transmission pylon silhouetted against blue sky at duskWhat does cybersecurity mean for the energy industry? This handbook aims to provide practical and clear guidance on how energy companies can strengthen their cyber security and protect their operations from cyber attacks. We explore the most common threats, risk factors and concrete actions to build resilience and ultimately strong protection. If you want to dig deeper, you can find more interesting reading here: Cyberattacks against critical infrastructure in the Nordic and Baltic countries in fall 2024 - pdf Threats and risks. Energy supply sector - pdf Guidelines and recommendations on security and total defense issues - Energiföretagen Sverige Swedish Electricity Market Handbook - pdf",
        "post_type": "page",
        "meta_description": "This handbook aims to provide practical and clear guidance on how energy companies can strengthen their cybersecurity and protect their operations from cyber attacks.",
        "excerpt": "",
        "modified_at": "2026-04-21T11:49:25+00:00"
    },
    {
        "title": "Insurance book",
        "url": "/en/banking-and-finance/insurance-policy/",
        "content": "Insurance bookCybersecurity is no longer just a technical issue, but a business-critical foundation for companies in the insurance and finance industries. The Insurance Book shows how organizations can combine proactive security and clear regulatory compliance to build resilience, meet new expectations and accelerate digitalization. DownloadAbstract blurred interior modern office space with business people working banner background with copy space.Cybersecurity in a new reality Digitalization has moved the insurance and finance industry onto a new playing field. The threat landscape is no longer physical but digital, and trust is built through reliable cybersecurity. At the same time, regulatory requirements and customer expectations for fast, secure and transparent services are growing. The insurance book provides a comprehensive picture of the challenges and opportunities in the industry. It shows how proactive cybersecurity, strategic governance and well-integrated regulatory compliance can become a driver of innovation, trust and long-term competitiveness. Download the Insurance Book and gain insights that will help your organization strengthen its robustness, meet regulations such as DORA, and create security in the digital future. References mentioned in the manual IBM X-Force (point 1 on page 20) Forbes (point 2 on page 20) ENISA (point 5 on page 21) NIST (s. 28)",
        "post_type": "page",
        "meta_description": "The insurance book shows how organizations can combine proactive security and regulatory compliance to build resilience and accelerate digitalization.",
        "excerpt": "",
        "modified_at": "2026-04-21T11:48:41+00:00"
    },
    {
        "title": "Academy",
        "url": "/en/academy/",
        "content": "Omegapoint Academy We strengthen your expertiseKeeping up to date with the latest insights and the latest technology has become increasingly important. But how can you be sure that the consultants you hire are competent enough to meet your needs? Omegapoint Academy is at the heart of our learning culture, ensuring that our consultants have the expertise needed to meet your needs. Omegapoint AcademyBuild knowledge across your organization\"As a customer of Omegapoint, you have the opportunity to take part in our competence culture – Omegapoint Academy. Curiosity, education and knowledge sharing are the guiding principles of the Academy, which is a central part of Omegapoint’s DNA. Within our partnership, we give you the opportunity to engage in the Academy, as we believe that investing in knowledge and learning is essential to staying relevant in today’s society and in your market. Strengthening the baseline of competence is a widespread need in many organizations. Unfortunately, it is often easier said than done, since the operational parts of the business must continue as usual. Omegapoint Academy offers a variety of activities that help you build expertise and inspire your teams in an effective and engaging way. Find out about the latest developments in cybersecurityAcademy Competence SeriesAs Northern Europe's leading company in cybersecure digitalization, Omegapoint Academy produces relevant presentations via various competence days, competence conferences and expert conferences. As a customer, you can subscribe to the Academy Competence Series, a tailored program featuring around ten presentations each year. Sessions can be delivered remotely or on site, depending on your needs. The program gives you and your employees regular access to new knowledge and an opportunity to explore, reflect on, and discuss the latest insights together. Discover the benefits of the AcademyWe strengthen your capabilities for the long termBuilding expertise across your organization does not have to come at the expense of day to day delivery. With support from Omegapoint Academy, your employees can develop new skills while your operations keep moving. We tailor programs that combine training with strategic team support, creating time for learning without slowing delivery. The result is greater capacity, stronger capabilities, and an organization ready for what comes next. We share our knowledge and solve your challengesAs an Omegapoint customer, you gain access to the collective expertise of our Academy and Competence Days. These focused knowledge sharing events bring our consultants together to learn from one another and tackle real challenges. Share your challenge with us, and we’ll bring together the right Omegapoint experts to help solve it. We broaden your expertise through tailored trainingMany organizations face knowledge gaps in cybersecurity and secure development. With support from Omegapoint Academy, you can quickly strengthen your team’s skills through proven training formats, such as the Secure by Design Training Package, DevSecOps workshops, and Capture the Flag events focused on the OWASP Top 10. We help you build a comprehensive training program tailored to your needs, delivering maximum impact in minimal time. Daniel DeogunBusiness Manager Academydaniel.deogun@omegapoint.seContact us",
        "post_type": "page",
        "meta_description": "Omegapoint Academy is a world-class culture of expertise that guarantees delivery and meets your needs with the highest possible expertise.",
        "excerpt": "",
        "modified_at": "2026-04-21T11:48:38+00:00"
    },
    {
        "title": "Itverket is re-established as an independent company after management acquisition",
        "url": "/en/articles/itverket-is-re-established-as-an-independent-company-after-management-takeover/",
        "content": "Omegapoint and the Norwegian IT Authority merged in 2022 with the ambition to strengthen Omegapoint's presence in Norway and combine competencies in system development and cyber-secure digitalization. After a challenging market period and a strategic review of the business, the parties have concluded that the Norwegian unit needs a different direction to reach its full potential. As a result, parts of the management are acquiring the business and re-establishing the IT Authority as an independent company.While the Omegapoint Group continues to develop a broader Nordic offering in cyber-secure digitalization, the IT Agency assesses that the Norwegian market is in greater demand for specialized senior system development expertise.– We are pleased to have established a long-term sustainable solution for our Norwegian operations, where parts of the management take over ownership. ItThe company is a company with significant expertise and good prospects for continued development. We are convinced that the business will have better opportunities to grow with owners who can fully prioritize and invest in the business model that the market demands, says Jonas Hasselberg, CEO of Omegapoint.The acquisition is effective immediately and does not involve any changes to existing customer commitments. The focus going forward is to ensure a well-coordinated transition and that the IT company's expertise and delivery capabilities continue to benefit customers.– The return to a streamlined operation creates a clearer strategic direction and more stable conditions for us. The dialogue with Omegapoint has been open and constructive throughout the entire process, and the decision has been made in full agreement, says Erik Haug, incoming CEO of the IT Agency.The Omegapoint Group continues to pursue its Nordic strategy with a focus on cyber-secure digitalization, broader comprehensive commitments and secure system solutions for total defense.For more information, contact:Jonas Hasselberg, CEO OmegapointErik Haug, incoming CEO of the Swedish IT Agency",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Omegapoint and the Norwegian IT Authority have completed an ownership change where parts of the IT Authority's management acquire the Norwegian operations. The deal is the result of a strategic review and means that the IT Authority returns to being an independent company. At the same time, the Omegapoint Group continues to develop its Nordic offering within cyber-secure digitalization and system solutions for total defense.",
        "modified_at": "2025-11-28T07:30:00+00:00"
    },
    {
        "title": "Sweden's most secure IT factory opened in Enköping",
        "url": "/en/articles/swedens-safest-it-factory-opened-in-enkoping/",
        "content": "Enköping continues to strengthen its role as a center for Swedish security. In the spring of 2025, Sweden's most secure IT factory in Stenvreten was inaugurated. The facility, built by Omegapoint's IT security company Basalt, is expected to withstand the most advanced threat actors and is expected to offer hundreds of new jobs in the municipality in the coming years.Basalt's new IT factory covers 4,000 square meters and is designed with security in mind. Everything from the physical construction of the building and the personnel selection process to production chains is secured through controlled access, traceability and robust technical processes. – Security is not just about technology, but also about people, processes and culture. In this facility, we can manufacture secure systems that withstand threats from, for example, advanced state-funded actors. This means that we strengthen Sweden's resilience against cyber threats, contribute to a safer society and hopefully attract more talent and specialists to the industry, says Nicklas Haglund, CEO of Basalt. Enköping has long established itself as a hub for security, not least thanks to the Command Regiment, the new logistics base for NATO troop movements, and a well-developed collaboration between the municipality, the Swedish Armed Forces, and Mälardalen University. In addition, the brand new university of applied sciences program for IT security engineers will open in the fall of 2025. With the opening of Sweden's most secure IT factory, around 100 new employees are expected to be recruited in the coming years.– Basalt's investment strengthens both Enköping's business community and our position within IT and security. We are proud that Enköping will now be home to the country's safest IT factory, and that it means new qualified jobs here in the municipality, says Business Director Anna Holmström, Enköping Municipality.For more information, please contact: Nicklas Haglund, CEO of Basalt, +46 70-924 42 81 or nicklas.haglund@basalt.seAnna Holmström, Business Manager, Enköping Municipality, +46 76-677 41 02, anna.holmstrom@enkoping.seAbout Basalt:Basalt is a wholly owned subsidiary of the Omegapoint Group. The company helps companies, authorities, municipalities and regions protect their most valuable information against internal and external threats. They do this by creating systematic security work, delivering turnkey IT solutions and offering senior consulting services with deep expertise in operational security and security protection. Together they create a safe world where citizens, employees, customers and customers' customers feel safe.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Enköping continues to strengthen its role as the center of Swedish security. In the spring of 2025, Sweden's most secure IT factory was inaugurated in Stenvreten. The facility, built by Omegapoint's IT security company Basalt, is expected to withstand the most advanced threat actors and is expected to offer hundreds of new jobs in the municipality in the coming years. Basalt's new IT factory covers 4,000 square meters and is […]",
        "modified_at": "2025-09-17T20:14:42+00:00"
    },
    {
        "title": "Omegapoint becomes new partner of Uppsala Innovation Center",
        "url": "/en/articles/omegapoint-becomes-new-partner-of-uppsala-innovation-center/",
        "content": "Omegapoint Uppsala is a local player with global experience and knowledge in cybersecurity, system development and regulatory requirements. As a new partner to Uppsala Innovation Center (UIC), they want to support startups and growth companies with advice and technical expertise on how entrepreneurs build secure digital services from the ground up.– We enter the partnership with the ambition to support companies in all phases with their challenges in cyber-secure digitalization. It's about protecting business-critical assets, meeting legal requirements and building robust solutions from the start, says Patrik Lannegård, CEO of Omegapoint Uppsala.Omegapoint Uppsala helps startups, governments and global companies develop secure software products and services, often in environments where sensitive personal data, patient data or classified information is handled. With an understanding of geopolitics, business-critical processes and regulations, the role is to act as a long-term technology partner – from strategy to implementation.Strengthening Uppsala with secure digitalizationThe partnership between Omegapoint and UIC is an important addition to Uppsala's innovation system, especially within Life Science, defense and the public sector. Omegapoint already has established collaborations with several local players.– As a partner of UIC, companies gain access to cutting-edge expertise in an area that is becoming increasingly business-critical. Cyber-secure digitalization is not just a technical requirement – it is a competitive advantage and a prerequisite for growth, emphasizes Patrik Lannergård.Helping startups build secure and scalable solutionsFor young companies, it is a challenge to protect sensitive data, meet regulatory requirements and at the same time develop scalable digital products. Omegapoint has extensive experience in guiding startups through these steps – both with strategic advice, planning and operational development.– We ourselves have a background as entrepreneurs in Uppsala and know what it means to start and build companies. There is a great demand for cybersecurity expertise, especially in Life Science and defense. There we can contribute with both deep technical knowledge and practical guidance – from idea to implemented solution, clarifies Patrik Lannegård.Omegapoint is a group with access to expertise in security-sensitive operations and product development for the defense sector. The company offers everything from advisory services to entire development teams and often acts as an extended development department for customers.About UICA large part of UIC's success is the close collaboration with experienced external partners from the local business community. All partners share their knowledge in UIC's business development program and offer UIC companies services at a favorable price. For example, in software development, law, finance, design, patents and more.For more information:Patrik Lannergård, CEOOmegapoint Uppsala ABE-mail: patrik.lannergard@omegapoint.sePhone: 073-622 46 86",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Omegapoint Uppsala becomes a new partner of UIC and strengthens the network with cutting-edge expertise in cyber-secure digitalization.",
        "modified_at": "2025-06-05T07:00:00+00:00"
    },
    {
        "title": "Swedish Security Index 2025: More and more people experience a serious threat to Sweden",
        "url": "/en/articles/swedish-security-index-2025-more-and-more-people-experience-a-serious-threat-to-sweden/",
        "content": "According to cybersecurity company Omegapoint's report Swedish Security Index 2025, 76 percent of the Swedish public perceives the threat landscape to be serious. The annual survey shows a total increase of 15 percent since 2021. Despite a growing perceived threat, public confidence in the ability of decision-makers to protect critical infrastructure has declined. Today, 29 percent say they have quite a bit or very little confidence in the ability of decision-makers – a proportion that has grown by six percentage points over the past three years.– This year's report, which was produced together with the research company Radar, underlines the public's concern about threats to Sweden. At the same time, we see that decision-makers' understanding of cybersecurity is more mature than ever. We are therefore on the right track and must continue to step up our investments in cybersecurity to strengthen resilience, says Johan Malmliden, President and CEO of Omegapoint. The report also points to an interesting paradox: Despite public trust in decision-makers' ability to protect critical infrastructure declining, 85 percent of Swedes still expect to receive support from a government agency in the event of a crisis. – Both the public's growing concern and high expectations for government support in crisis situations are understandable. With war and geopolitical tensions, new security legislation and growing cybercrime, the security situation is in constant flux. To increase security in society, the public sector, business and politics must expand their cooperation to jointly strengthen Sweden's overall defense capability, concludes Johan Malmliden.Other key figures from the survey: Almost seven in ten decision-makers (68 percent) expect increased security budgets in 2025. However, respondents feel that time and focus on security, support from management, and staff skills development are equally important for building resilience. Positive attitudes towards NATO have more than doubled since Sweden joined last year. Today, 86 percent of Swedes are more positive about NATO, compared to 42 percent before joining. 36 percent of decision-makers state that they collaborate to a large extent with authorities or other actors (such as county administrative boards, emergency response authorities and municipalities) to protect their operations.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Today, Omegapoint's report Swedish Security Index 2025 is released, showing that 76 percent of the Swedish public perceives the threat to Sweden to be serious. The annual survey shows a total increase of 15 percent since 2021.",
        "modified_at": "2025-02-12T10:00:00+00:00"
    },
    {
        "title": "Omegapoint appoints Andreas Collin as new Group Marketing Manager",
        "url": "/en/articles/omegapoint-appoints-andreas-collin-as-new-group-marketing-manager/",
        "content": "Omegapoint Group, a leader in cyber-secure digitalization, strengthens its position in the market by welcoming Andreas Collin as its new Chief Marketing Officer (CMO). Andreas will have overall responsibility for all of Omegapoint's brands and lead the group's communications to solidify its role as a thought leader in cyber-secure digitalization.With a solid background in strategic marketing, Andreas Collin brings extensive experience from previous roles where he has successfully built strong brands and driven company growth. Most recently as Marketing Manager at Omegapoint's subsidiary Basalt, where he helped establish the company as an authority in security protection.In his new role, Andreas will focus on positioning Omegapoint as the obvious choice for organizations seeking advanced solutions for secure and sustainable digitalization.– Omegapoint already has a strong reputation as an expert in cybersecurity and digitalization. My ambition is to take this to the next level by creating a clear and coherent brand strategy that strengthens our thought leadership and our offering in the Nordic arena, says Andreas Collin, CMO at Omegapoint Group.Omegapoint has long been a pioneer in cybersecurity digitalization, and with Andreas at the forefront of marketing efforts, the goal is to further strengthen the company's position as a partner that not only follows but leads developments in cybersecurity.– We are very pleased to welcome Andreas to Omegapoint. His experience and vision will be crucial to our ambition to become the most respected player in cybersecurity and digitalization, says Johan Malmliden, CEO of Omegapoint Group.Together with his team, Andreas Collin will work to drive strategic initiatives that strengthen Omegapoint's brand, increase visibility in the market and inspire companies and organizations to see the benefits of secure digital solutions for the future.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Omegapoint, a leader in cyber-secure digitalization, strengthens its position in the market by welcoming Andreas Collin as new Group Marketing Manager. Andreas will have overall responsibility for all of Omegapoint's brands.",
        "modified_at": "2025-01-07T07:00:00+00:00"
    },
    {
        "title": "Omegapoint launches unique solution for security protection in digital systems",
        "url": "/en/articles/omegapoint-launches-unique-solution-for-security-protection-in-digital-systems/",
        "content": "Cybersecurity company Omegapoint launches Craton – a complete solution for managing security-classified information in digital systems. Craton solves the major challenges organizations face when implementing the information management requirements of the Security Protection Act.Omegapoint, through its subsidiary Basalt, has many years of experience in building IT systems that meet the strictest requirements of the Swedish Security Protection Act. Now Omegapoint has developed Craton, the first and only product of its kind on the market that makes it possible to further digitize security-sensitive operations while simultaneously complying with the Swedish Security Protection Act. – In order for a business to comply with the Security Protection Act, such extensive security requirements are imposed that organizations feel forced to lock their computers in safes to meet them. With Craton, we offer a solution that meets the law's strictest requirements without compromising the business's productivity and the conditions for collaboration, says Nils Ågren, Business Manager for Craton at Omegapoint.Craton also distinguishes itself in that the product is based on modern technology that has been proven by having been in operation in safety-sensitive operations for several years. From ordering, a complete installation and commissioning of a system can be done within a few months. – As awareness of the legal requirements increases, more and more organizations are also realizing that parts of their operations may actually be covered by the Security Protection Act. This means that you are exposed to other types of threats and threat actors, which places higher demands on how you handle your information. If you don't have a handle on these issues, it can be costly when a regulatory authority knocks on the door, Nils Ågren interjects.For more information, contact:Andreas Collin, Marketing Managerandreas.collin@omegapoint.se",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Cybersecurity company Omegapoint launches Craton, a complete solution for handling classified information that meets the strictest requirements of the Security Protection Act. Craton enables the digitization of security-sensitive operations without compromising productivity or collaboration. The product is built on proven technology and can be implemented within months.",
        "modified_at": "2024-11-21T10:33:01+00:00"
    },
    {
        "title": "Omegapoint participates in new IVA project on resilient digital infrastructure",
        "url": "/en/articles/omegapoint-participates-in-new-iva-project-on-resilient-digital-infrastructure/",
        "content": "On October 7, the Royal Swedish Academy of Engineering Sciences (IVA) launched its new project Resilient Digital Infrastructure, which aims to strengthen the capacity and robustness of Sweden's digital infrastructure. Cybersecurity company Omegapoint is participating together with other selected representatives from business, the public sector and academia.The new IVA project will run throughout 2025 and aims to improve Sweden's digital infrastructure so that it reaches the same capacity, quality and security as the most advanced countries. The work will prioritize the business environment, but the digital infrastructure of critical societal functions will also be in focus. Omegapoint sees IVA's operations and the project for a resilient digital infrastructure as strategically important for the development of society, and therefore joins as members of IVA's business council. Our senior security consultants Michael Westlund and Anders Fristedt participate in the project's working groups for technology and system development as well as governance and coordination. – Today, digital technology is crucial for our critical societal functions such as transport, electricity and food supply. At the same time, there are several wars going on around the world, and in the new era of cyber warfare, the vulnerability of our digital systems is more serious than ever. We are proud to participate in this project together with business, academia, politics and the public sector to jointly ensure Sweden's digital robustness in the near future, says Johan Malmliden, CEO of Omegapoint Group. IVA's Business Council works to secure the academy's anchoring in the business community and consists of member companies that, together with a designated industrial research group, collaborate for Sweden's development on issues related to business, education and research policy.",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "The Royal Swedish Academy of Engineering Sciences (IVA) has launched the new project Resilient digital infrastructure, which aims to strengthen the capacity and robustness of the Swedish digital infrastructure. Cybersecurity company Omegapoint is participating together with other selected representatives from business, the public sector and academia.",
        "modified_at": "2024-10-10T09:28:16+00:00"
    },
    {
        "title": "Omegapoint approved as AWS Security Competency partner",
        "url": "/en/articles/omegapoint-approval-as-aws-security-competency-partner/",
        "content": "Being named an AWS Security Competency Partner is a testament to Omegapoint's deep technical expertise in security in AWS. As one of the few AWS Security Competency Partners based in the Nordics, it confirms Omegapoint as a leading security provider in the region.Omegapoint has been a member of the AWS Partner Network since 2012 and is an AWS Advanced Tier Services, Public Sector and Solution Provider partner. During this time, we have helped our customers develop secure, robust and business-driven systems using AWS cloud services. We deliver our services both by building and managing solutions, as well as advising and supporting our customers with expert expertise. Our solutions are built with security at the core because we believe it is the key to systems that maintain high reliability over the long term.That’s why we are very proud to have been awarded the AWS Security Competency Partner designation. To achieve this designation, AWS and a third-party auditor conducted a comprehensive audit of Omegapoint to ensure that we have delivered high quality over time in the field. For more than a decade, we have delivered secure solutions in the cloud, including security-focused CI/CD, modern DevSecOps, SAST/DAST, infrastructure and security as code, penetration testing, and identity management. ”Being named a Security Competency partner by AWS is a fantastic testament to the hard work we put in to stay at the forefront of technology and always deliver high quality to our customers. With this designation, we are well-positioned to help customers with questions around DORA, NIS2 and CRA compliance in AWS. At the same time, it should be remembered that our applications are largely business-driven, where security and traceability are requirements that the business places on modern digital solutions. Furthermore, it is proof that cybersecurity and digitalization go hand in hand, a mindset that we at Omegapoint have advocated for a long time.”. - Wilhelm Hedman-Dybeck, VD Omegapoint Stockholm",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Being named an AWS Security Competency Partner is a testament to Omegapoint's deep technical expertise in AWS security. As one of the few AWS Security Competency Partners based in the Nordics, it confirms Omegapoint as a leading security provider in the region.",
        "modified_at": "2024-09-27T11:27:53+00:00"
    },
    {
        "title": "New leadership at Omegapoint Stockholm AB: Wilhelm Hedman-Dybeck takes over as CEO",
        "url": "/en/articles/new-leadership-at-omegapoint-stockholm-ab-wilhelm-hedman-dybeck-takes-over-as-ceo/",
        "content": "Omegapoint continues to grow and become an increasingly large provider in cyber-secure digitalization. As part of the company's continued development, Wilhelm Hedman-Dybeck has been appointed as the new CEO of Omegapoint Stockholm from September 1, 2024. Outgoing Stockholm CEO Anna-Clara Söderbaum will thus focus fully on her role as Head of Sweden. A strategic shift for growth Omegapoint Stockholm with 330 employees makes up almost half of Omegapoint's operations in Sweden. In addition to Stockholm, the Swedish operations also include Gothenburg, Malmö, Uppsala and Örebro, and Omegapoint increasingly acts as a national supplier where customers have access to the entire Swedish operation. The management development in Stockholm is part of a planned and long-term strategy to further accelerate the company's growth and support Omegapoint's vision to become a market leader in the Nordics.Anna-Clara comments on the CEO change:”\"It feels very exciting that Wilhelm is taking over as CEO for Stockholm. Wilhelm has deep technical expertise through his consulting assignments in cybersecurity-focused system development and system architecture. He is also an experienced project manager, business consultant and quality assurance officer. Wilhelm represents Omegapoint's competence-centered culture by actively contributing to the Omegapoint Academy and contributing enthusiastically to spreading knowledge both internally and to our customers and partners. He is sharp and kind and represents Omegapoint in every way!I am convinced that Wilhelm will be a contributing part of Omegapoint Sweden's continued development. In addition to a stable background, he also has a unique ability to think outside the box, see where Omegapoint is going and what we need to do to become an increasingly valuable partner for our customers throughout the Nordics.” Wilhelm Hedman-Dybeck: From Trainee to CEO Wilhelm Hedman-Dybeck is a trained civil engineer and began his journey in Omegapoint's trainee program in 2017. Since then, he has had an impressive career. He has delivered value as a technical consultant, advanced to team leader and further to taking full delivery responsibility for some of the company's largest deliveries within cyber-secure digitalization. Wilhelm became interested in the business and quality dimension of Omegapoint's deliveries early on and has developed a deep understanding of the customers' business and needs in the role of business consultant. In 2022, Wilhelm was given the role of Delivery Manager where he focused on ensuring quality, methods and processes in the company's deliveries. In 2024, he took over as Deputy CEO of Omegapoint Stockholm and is now taking the full step as CEO. Wilhelm is enthusiastic about the new role: ”\"Omegapoint has a unique position in the market through our way of combining advanced digitalization and cybersecurity issues. With today's technological developments, the two cannot be kept apart and by thinking \"Secure by Design\" we help our customers think securely from the start, both in relation to their own operations and to the regulations of the outside world. Preemptively combining technology and security in this way creates greater business value for our customers. We are moving from being a supplier that provides expert competence to having deeper partner relationships with our customers where we take overall responsibility for development and security in their organizations. At the same time, the entire industry is suffering from a skills shortage. Within Omegapoint, we actively work with skills development as part of our work. Since the expectations of the outside world and technological development never stand still, we must continue and deepen the development of and for our employees in order to be able to maintain and further develop our offering and continue to be a relevant supplier in the market.” A shared vision for the future Both Anna-Clara and Wilhelm are optimistic about the future. Together they have a common vision for Omegapoint in both Stockholm and Sweden. ”\"We want to be a one-stop provider for digitalization, cybersecurity and information security solutions. Omegapoint should be synonymous with cyber-secure digitalization and continue our journey towards becoming a market leader in the Nordics. I am sure that Wilhelm, with his experience and ability to think innovatively, will be a big part of Omegapoint's continued success,\" says Anna-Clara. Wilhelm adds: ”\"I will continue to drive Stockholm forward with full force so that we can meet the market demand for our services and consolidate our position as a thought leader in cyber-secure digitalization.\"”",
        "post_type": "post",
        "meta_description": "",
        "excerpt": "Omegapoint continues to grow and become an increasingly large provider in cyber-secure digitalization. As part of the company's continued development, Wilhelm Hedman-Dybeck has been appointed as the new CEO of Omegapoint Stockholm. The outgoing Stockholm CEO Anna-Clara Söderbaum will thus focus fully on her role as Head of Sweden.",
        "modified_at": "2024-09-02T09:00:00+00:00"
    }
]