01
Regulatory and customer requirements
An ISO/IEC 27001 initiative, a NIS2 readiness review or a customer security assessment starts with understanding which security measures are in place, how they work and where gaps remain.
Independent consultant · Denmark
Cybersecurity, risk and compliance consulting
Independent advice. Practical security solutions. Business-focused decisions.
I help organizations identify security weaknesses, respond to compliance requirements and put practical safeguards in place. My work covers technical security assessments, GDPR and data protection, security management, access controls and staff awareness. Where useful, I explain cyber risks in terms of business impact and investment decisions.
Technical security assessmentGovernance and complianceDanish & English
Business needs
Security priorities I can help address
A project often starts with a practical question: Where are we vulnerable, who has access, which requirements apply, and which security improvements should come first?
02
Evidence that security measures work
Policies may be written, but there is not enough evidence that security measures work, responsibilities are unclear or important gaps remain before an internal or external audit.
03
New technology and changing risk
New AI tools, digital services and impersonation fraud call for safeguards matched to the risks, clear responsibilities and a practical response plan.
04
Technical security and access controls
Security weaknesses and inappropriate access rights need a focused review, someone responsible for each action and a realistic plan to fix them.
Services
Security services with clear outcomes
We agree at the outset what will be reviewed, what information is needed and what you will receive. The aim is security improvements your organization can maintain, not paperwork for its own sake.
01
Security risk and compliance advisory
Understand security weaknesses, relevant requirements and which improvements matter most.
I review security processes, technical safeguards, responsibilities and documentation against agreed requirements. These may include ISO/IEC 27001, relevant NIS2 duties, GDPR-related controls or customer security expectations. I identify gaps and practical actions. Where useful for management decisions, I estimate what incidents could cost, how improvements may reduce the risk and what risk would remain. Audit and certification preparation focus on documented gaps, evidence that measures work and steps to address the findings.
- Focused reviews of security and compliance gaps
- Security investment analysis with assumptions and remaining risks clearly stated
- Supporting evidence for audits and certification preparation
- Prioritized improvements and assigned responsibilities
- Overview of security measures and supporting evidence
- Preparation for internal and external audits
02
Security management and access controls (ISMS & IAM)
Put clear security responsibilities and access controls in place.
I help establish or improve an information security management system (ISMS): the policies, responsibilities and routines used to manage security risks. I also support identity and access management (IAM), including account lifecycles, regular access reviews and appropriate permissions.
- ISMS setup, operation and improvement
- Risk registers and clear responsibility for security measures
- Identity and access administration (IAM)
- Account and access-rights reviews
- Staff security awareness and maintenance routines
- Documented access rules and assigned owners
03
AI governance and responsible use
Make AI use accountable, transparent and manageable.
I help organizations identify where AI is used, decide who can approve its use and review operational risks. This includes an initial look at which EU AI Act requirements may apply. The focus is on clear responsibilities and processes that teams can follow.
- Overview of AI tools and how they are used
- Acceptable-use and approval policy
- Risk-based review criteria
- Transparency and disclosure practices
- Responsibilities and paths for raising concerns
04
Fraud & impersonation risk
Reduce fraud risks in payments, access changes and information sharing.
I review how an organization verifies identities and approves requests, especially when instructions are urgent or appear to come from someone trusted. My experience in payment-fraud investigation and telecommunications security-product work helps identify stronger verification and approval steps.
- Threat and scenario mapping
- Review of identity-verification steps
- Independent approvals and separation of duties
- Escalation and incident paths
- Prioritized procedural improvements
05
Technical assessment & penetration testing
Find security weaknesses through agreed, authorized testing.
Work may include vulnerability analysis, tests based on realistic threats and penetration testing. Before testing, we agree in writing which systems are included, who is responsible for them, the testing rules and how normal operations will be protected. Findings explain how an attack might work, how far its effects could spread, which fixes matter most and how results can be checked again. Availability depends on written authorization, suitable operating conditions and insurance confirmation.
- Vulnerability and control assessment
- Authorized, scoped penetration testing
- How an attack might happen and where systems are exposed
- Business consequences and prioritized fixes
- Clear findings and criteria for testing fixes
Assessment method & delivery
How I assess security threats and business impact
Risk assessment
From realistic threats to business consequences
I examine the same risk from several perspectives: an external attacker, an insider with elevated access, a compromised supplier or a person attempting fraud. This helps uncover weak security measures and dependencies that a compliance checklist may miss.
A risk matrix helps compare how likely an incident is with how serious its consequences could be. I distinguish immediate effects on identities, data and services from wider effects on operations, finances, contracts and regulatory obligations. The result is prioritized safeguards, clear owners and decisions about the risks that would remain.
I estimate the potential financial impact of security incidents over a defined period. This includes how likely an incident is, its immediate and wider business consequences, and any relevant regulatory exposure. For investment decisions, I compare these estimates with the costs of safeguards, their expected effectiveness and the risks that would remain. I state assumptions and uncertainty clearly. The analysis supports decisions; it does not guarantee savings.
Delivery sequence
- 01
Scope
Agree objectives, what is included and excluded, the information needed, deliverables and decision responsibilities before work starts.
- 02
Assess
Review threats, security measures and operational dependencies; distinguish immediate effects from wider consequences.
- 03
Implement
Develop agreed safeguards, policies and practical documents with the people responsible.
- 04
Handover
Document decisions, remaining risks, assigned owners and how security measures will be reviewed and maintained.
Selected experience
Experience behind the consultancy
Selected engagements and projects illustrate the work performed; they are not client testimonials or claims of certification.
Translating cyber risk into financial impact
I developed and delivered a financial-risk assessment model for a technology company. It linked security scenarios, incident likelihood, immediate and wider consequences, relevant compliance exposure and possible improvement costs to help leadership compare security investment options.
GSMA SAS-UP FS.18 control development
Established controls relevant to GSMA SAS-UP FS.18 certification preparation, updated the internal audit plan and identified gaps and ways to address them ahead of an audit.
ISMS ownership and operational security
Managed and maintained the information security management system (ISMS), including risk assessment, security controls, access administration and a staff security-awareness program.
Vulnerability remediation and recovery planning
Addressed findings from penetration testing and developed business-continuity and recovery arrangements for software-as-a-service (SaaS) systems.
Security-product co-founder and product leadership
I originated the preventive voice-call verification concept, built a working proof of concept and worked across product, engineering, security, privacy and commercial priorities, translating technical trade-offs for business leadership.
Open-source AI work governance
I authored and maintain AIR, an open-source framework for structured, reviewable AI-assisted work. It is not a certification or an independently validated security-assurance service.
Payment fraud and dispute investigation
Investigated disputed and fraudulent card transactions and later led business support for complex cases.
Evidence-based Project Fit Check
I conceived, designed and developed the Fit Check on this website. It compares the requirements a visitor confirms with selected, publicly documented examples of my professional work. It highlights relevant experience, questions to resolve and working conditions to agree before a call.
Verify alignment before a call
See how my experience relates to your project
Compare your confirmed project requirements with selected examples of my documented professional experience. The check shows related experience and topics worth clarifying before a conversation.
About
Technical security experience with a business perspective
I hold a Professional Bachelor in IT Security and an AP Degree in IT Technology from Business Academy Aarhus. My training includes penetration-testing methods and technical security assessment. My documented work includes managing an ISMS, administering identity and access controls (IAM), preparing for audits and certification, and addressing security vulnerabilities. It also includes payment-fraud investigation, security-product development and AI governance.
As a security-product co-founder, I have worked across technical, compliance, operational and commercial responsibilities. I explain security findings in terms of budgets, potential business losses and management decisions, while keeping uncertainty visible.
I do not resell software, licenses or hardware. My recommendations are based on assessed risks, relevant compliance requirements and security measures the organization can operate and maintain.
Let's talk
Start with a free 30-minute introductory call
Have a cybersecurity, risk or compliance challenge to discuss? Tell me about your priorities and the outcome you need. I will help clarify whether I am the right adviser and what a focused engagement could look like.
No obligation. The call is for an initial discussion; technical assessments and detailed recommendations are part of a separately agreed engagement. Booking takes place on Calendly; the meeting is held on Google Meet.
Phone+45 91 82 51 12
Registered business address
Mølagervej 1A
8382 Hinnerup
Denmark
Delivery
Remote-first; on-site in Aarhus and elsewhere in Central Denmark Region by arrangement