Article
The quiet force behind security at Visma: what a CISO actually does
Life at Visma, Security
May 21, 2025

Article
The quiet force behind security at Visma: what a CISO actually does
Article
The quiet force behind security at Visma: what a CISO actually does
Life at Visma, Security
May 21, 2025
Article
The quiet force behind security at Visma: what a CISO actually does

21/5/2025
min read
Life at Visma, Security
"The certificate helps, of course," she says. "But our security programme contains far more than what most companies already have. At first, the reaction is sometimes: do we really need all of this? But I have never once heard anyone say afterwards that it was pointless. Everyone becomes enthusiastic once they are in the programme."
That enthusiasm is no accident. It is the result of something Visma has deliberately built: a security infrastructure more complete and more complex for any individual company to carry alone but one that every Visma company can start building on from day one.
From IT concern to risk management
Cindy has been in the field long enough to witness the shift from security as an IT matter to security as risk management. "Security used to sit with IT. Now the question is: what is the security risk to the business as a whole? That is a fundamentally different question."
That shift also defines what her role looks like. She is not a technical auditor who comes to check whether the firewalls are in order. She is a connector: between companies, between companies and Visma, and between the people on the floor and the management that sets priorities.
"Security only works when it is woven into everything you do. It is not a layer you add on afterwards. And it starts with the tone at the top: if management does not consider it important, it eventually falls apart. Then the security officer ends up fighting alone against the current. That simply does not work."
What you get on day one
One of the most concrete benefits for new Visma companies is access to the GSOC, the Global Security Operations Centre. This is a 24/7 incident response team of trained specialists who do nothing else.
"As a smaller company, you might hire someone for security. But not at this level, and not around the clock. At Visma, you fall within the scope of the GSOC immediately. Even if you have only been with us for two weeks."
Those two weeks are not hypothetical. Cindy has seen it happen: a company barely onboarded when a major incident struck. The GSOC team was there straight away.
In the event of a ransomware attack, where data is encrypted and made inaccessible, the GSOC team also jumps in and handles forensic investigation, risk containment, legal support for potential privacy incidents, and communications guidance. "Our position is: we do not pay. But that means you need other measures in place to keep your business running. And we help with that."
On top of that, Visma runs Cyber Threat Intelligence: a system that monitors what appears on the dark web relating to Visma-connected data, which geopolitical threats are emerging, and which new techniques criminal organisations are developing. "If we see a credential surface with the name of a Visma company attached, we make contact with the company. We investigate what is happening and make sure it is resolved."
The network as a multiplier
What Cindy describes as her most important role is also the least visible: building a community that shares knowledge and learns from one another.
She organises regular sessions with security contacts from the companies in her segment. Online, but also in person. These sessions are not primarily about technology. They are about exchange: how do you approach this, what works for you, where are things going wrong?
"We have an enormous amount of knowledge within Visma, but that knowledge has to circulate. After an in-person session, you genuinely notice the difference. Feedback becomes more open, people find each other more easily. And, interestingly, also commercial collaborations have come out of those sessions. Companies that are dealing with the same challenges find each other."
That is the Visma logic in practice: scale advantages that operate not only at the technical or financial level, but at the level of knowledge and network. A problem that five companies share gets solved at group level. An insight at one company reaches dozens of others.
"When I see the same problem recurring across multiple companies, I look at whether I can address it at group level. A guideline, a working group, a strategy. It works in both directions: what Visma wants is explained and passed on. But what companies need also travels upward."
Security as a competitive advantage
Cindy closes with something she repeats deliberately to every company she works with: security is not only a licence to operate. It is a differentiator.
"We always say: on one hand, this is your licence to operate. It’s the minimum you need to do. But if you do it well, it is also a competitive advantage. Consumers can trust what you deliver. That is something you need to communicate."
And that trust is not built with a certificate. It is built by weaving security into everything: into your processes, your culture, and the way you communicate when something does go wrong.
"Security is not a product you install. It is something you keep improving, together with the people around you. And that is exactly what we are trying to do at Visma."
About the episode
CISO,security,data,growth,AI
Voice of Visma
Welcome to the Voice of Visma podcast, where we sit down with the business builders, entrepreneurs, and innovators across Visma, sharing their perspectives on how they scale companies, reshape industries, and create real customer value across markets.
CISO,security,data,growth,AI














































































































































































































































