Executive advisory & fractional CISO: Senior counsel for the C-suite
Independent advice for CEOs, CIOs, CTOs and boards on AI, cloud, privacy, compliance, sustainability, organisation and technology delivery, built on long, hands-on experience of leading it all.
One advisor across the whole technology agenda
AI, cloud, privacy, regulation, security, sustainability and delivery are no longer separate topics. They meet at the leadership table. We bring long experience from all of them: from GDPR and compliance programmes to software development and agile transformation. You get advice that connects the dots, and management capacity when you need someone to lead.
AI strategy & governance
Where AI creates value, how to govern it and how to stay compliant with the EU AI Act.
Privacy & GDPR
Privacy by design, data protection governance and pragmatic GDPR compliance.
Compliance & risk
NIS2, DORA, PCI DSS and ISO 27001 translated into decisions, priorities and budgets.
Cloud strategy & governance
Cloud strategy, governance models and guardrails, including sovereignty, exit plans and geopolitical risk.
Security leadership
Security strategy, risk management and incident readiness owned at management level.
Sustainable IT & ESG
Technology choices that reduce climate impact, and the data to report on it.
Development & agile delivery
Engineering practices and agile delivery models that combine speed with control.
Organisation & leadership
Organisation design, leading teams and interim management as fractional CISO, CTO or CIO.
Proven in practice
Not just talk. Requirements turned into reality.
Compliance, privacy and AI only matter when they work in real systems. Every area we advise on is one we have delivered hands-on.
PCI DSS
Seven PCI DSS certifications completed. The latest was led as CSO, for a platform storing card and financial data.
Patient data & healthcare
Designed, developed and operates a patient system for private healthcare, with applications connected to SLL. In daily use by customers for 15 years.
Monitoring, incidents & PKI
Operated the SIEM, acted as incident manager and administered PKI for a large Swedish retail group with its own bank.
Application security
Deployed a web application firewall and configured its policies and rules, protecting applications at one of the largest banks in the Nordics.
Cloud security & geopolitics
Speaks at IT security conferences on the biggest security challenges in the cloud, and writes on the geopolitical risks of cloud dependency.
AI, privacy & delivery
Long experience bringing AI, privacy and GDPR into real software development. Delivered with agile methods, not slide decks.
Advisory for executives and boards
We act as a trusted sparring partner for the C-suite: independent, candid and grounded in practice. We help you set direction, weigh trade-offs and make decisions you can explain to the board, regulators and customers.
- Technology, cloud, AI and security strategy
- Board briefings and management training (NIS2, DORA, EU AI Act)
- Risk appetite and investment framing
- Independent second opinion on programmes and vendors
- Due diligence for M&A and investments
Recommendation
Option B gives most of the value at lower risk, keeps control in-house and can be scaled later.
Cyber risk is a board responsibility
Under NIS2, management is personally accountable for cyber security, and ransomware is one of the few risks that can stop a business overnight. We help boards and management teams understand their exposure, ask the right questions and make decisions they can stand behind, before an attack and during one.
- Board briefings on ransomware and the threat landscape
- The five questions every board should be able to answer
- Tabletop exercises: a simulated attack with management
- Crisis leadership and communication when it happens
- Risk reporting that management actually understands
Can we restore all critical systems if everything is encrypted tonight?
When did we last test a full restore?
Who decides, and who do we call, in the first hour?
What leaked data about us is already for sale?
Do we meet NIS2 and GDPR reporting deadlines?
If any answer is "we don't know", that is where to start.
Organisation and leading teams
Strategy is delivered by people. We help you shape organisations where responsibilities are clear and teams can perform. We have led security, technical and development teams ourselves. We coach managers, build leadership structures and lead groups through change. Twenty years of curling at elite level has taught us the same lesson as every project: a team only performs when everyone knows exactly what to do.
- Organisation design, roles and responsibilities
- Building and leading security, IT and development teams
- Leading groups through change and transformation
- Coaching and mentoring of managers and team leads
- Collaboration between business, IT and security
Security
team health
IT & Infra
team health
Development
team health
Management when you need someone to lead
Sometimes advice is not enough. We step in as fractional or interim CISO, CTO or CIO, own the agenda, lead teams and suppliers, and hand over a working organisation when the job is done.
- Fractional CISO / CTO / CIO
- Interim management during change or recruitment
- Certification ownership, e.g. PCI DSS and ISO 27001
- IT service management based on ITIL: incident, problem and change
- Vendor and sourcing strategy
Day 1Listen & assess
Risks, people, ongoing work
Day 30Plan agreed
Priorities approved by management
Day 60Deliver
Quick wins in place, team aligned
Day 90Hand over
Working organisation, or keep us on
Cloud strategy and governance
Moving to the cloud is a business decision, not a lift-and-shift. We help you define why, what and where, and put governance in place so the cloud stays secure, compliant and under control as it grows. That includes the questions many skip: data sovereignty, provider dependency and what happens if the geopolitical landscape changes.
- Cloud strategy and target operating model
- Cloud governance: policies, roles, guardrails and landing zones
- Sovereignty, jurisdiction and geopolitical risk assessment
- Exit strategies and multi-cloud / hybrid choices
- Cost control and FinOps governance
- Compliance in the cloud: NIS2, DORA, PCI DSS, GDPR
Website & marketing
Low risk
Customer platform
EU jurisdiction
Patient & card data
Full control
A business decision, not a lift-and-shift
Sustainable and responsible technology
Digital infrastructure has a real climate footprint, and sustainability reporting increasingly covers IT. We help you make technology choices that are both responsible and resilient, and give management the facts needed for ESG reporting.
- Sustainable IT strategy and targets
- Energy-efficient cloud: right-sizing, scheduling and data centre choices
- Automated ESG measurement and reporting with AI, ready for CSRD
- Responsible AI: energy use, transparency and ethics
- Sustainability and lifecycle requirements in procurement
Compliance, privacy and AI as one programme
GDPR, NIS2, DORA, PCI DSS and the EU AI Act overlap more than they differ. We help you run them as one coherent programme with shared controls, clear ownership and evidence that holds in an audit.
- Cross-framework roadmap and control mapping
- Information classification as the shared foundation
- Privacy and data protection governance
- AI governance aligned with ISO/IEC 42001
- Reporting that management actually reads
Shared controls
Development and agile delivery
Strategy only matters if it is delivered. With a background in software development and agile methodology, we help you build delivery organisations that ship quickly, with security and compliance built into the way of working, not bolted on.
- Agile transformation, sprint reviews and retrospectives
- CI/CD as a security control, with AI code analysis
- Product and portfolio prioritisation
- Metrics for flow, quality and risk
Track record · PCI DSS
Seven PCI DSS certifications, delivered
PCI DSS is one of the most demanding standards in security. armsec founder Martin Vallée has taken organisations through seven PCI DSS certifications. The most recent was at a Northern European cybersecurity SaaS provider serving banks, finance, insurance, telecom and hosting, whose platform stores and manages sensitive card and financial data. As Chief Security Officer, he led the Security and Technical teams through the 2025 renewal.
How we work
A clear path from first meeting to lasting results
Listen
Understand ambitions, constraints and where you are today.
Frame
Turn complexity into clear options, trade-offs and priorities.
Decide
Support leadership in making and anchoring decisions.
Lead
Stay engaged, or step in and lead the change ourselves.
Looking for a senior sparring partner?
Let us discuss your agenda in a confidential, no-obligation conversation.