Around the Qverse with Cybersecurity Experts Janne Karppinen and Petter Larsson

As?digital landscapes evolve and cyber and information security threats become more sophisticated, staying ahead of emerging threats is crucial in protecting our digital assets.?This month, in the Around the Qverse series, we explore the latest in the?cybersecurity ecosystem with seasoned experts Janne Karppinen and Petter Larsson , Co-founders and leaders of Secure by Q - Part of Qgroup .

In this short interview, Janne and Petter tell us more about Secure by Q and explore the latest trends, challenges, and strategies for protecting against cyber threats. Join us as we uncover the experience, expertise, and invaluable advice of these leading voices in cybersecurity.

Q: Hi, Janne and Petter! You recently opened your office in Malm?; congratulations! Can you tell us a little bit about your company?

A: Thank you! We specialize in modern and digital risk management, integrating cyber and information security with comprehensive compliance strategies to support business growth.

Our new Malm? office is part of our commitment to building close partnerships and offering tailored security solutions. Here, our expert team works?together with public and private sector businesses, navigating both complex digital and human threats and the stringent regulatory landscape to ensure their strategic success.

Q: Exciting! What type of projects are you currently working on?

A: Our current projects range from implementing Information Security Management Systems in the public sector to enterprise-wide holistic risk assessment frameworks for private sector companies to ensuring regulatory compliance and future risk and security readiness for multinational corporations in their digital transformation.

We prioritize human-centered design in our solutions, focusing also on empowering employees and managers to maintain security and compliance in their daily operations. We strongly believe that balanced security motivation leads to a sustainable security culture.

Q: Are there any?trends in your field?that you find particularly exciting or promising?

A: One of the key trends that is particularly promising is the proactive adoption of AI in managing regulatory compliance.

AI?not only?simplifies the process of adhering to ever-changing regulations?but also?enhances our ability to foresee and mitigate risks early.?This capability?is revolutionizing?how we maintain ongoing compliance and security in a constantly evolving regulatory landscape.

However, integrating AI into the compliance process also comes with certain risks. One?major?concern is the potential for?what's called?"surface-level compliance," where organizations may appear compliant through documentation and AI-managed checks but lack the deeper, real-world application of these regulations.

This?is particularly problematic because upcoming regulations demand genuine compliance that affects actual operations and outcomes, not just the paperwork. To address this, organizations must ensure that their use of AI in compliance goes beyond just meeting minimum standards. It should be part of a broader change management strategy that embeds compliance into the fabric of daily operations.

This involves training personnel to work?effectively with AI tools, ensuring that these technologies enhance real-world compliance, and continuously reviewing and updating systems to handle new regulatory challenges as they arise.?This approach?not only meets regulatory demands but also?fosters a culture of compliance and ethical behavior within the organization.

Q: What is one emerging cybersecurity threat you believe deserves more attention and why?

A: One cybersecurity threat that?really?needs more attention is the risk of insider actions—this means the potential harm that can come from people within your?own?organization.

These threats can be unintentional, like simple mistakes that leave security gaps, or?they can be?malicious, such as someone purposely causing harm.?What makes this especially concerning is that as regulations around data protection and cybersecurity become stricter, the impact of these insider threats can lead to serious legal issues and hefty fines.

However, the real vulnerability lies in?organizations' failure?to conduct thorough, well-grounded risk assessments.?Many upcoming regulations?not only require these assessments but?truly?emphasize them as the first critical step in any risk management and security strategy.

If organizations don't start their cyber and information security efforts here, they're missing a fundamental piece of building a robust defense.?This?isn't just about checking a box to say you're compliant; it's about deeply understanding where your risks come from so you can effectively protect against them.

That's why?strengthening internal controls and constantly educating everyone in the organization on cybersecurity best practices is so important.?This approach?not only?helps prevent risks from within?but also?builds a?stronger, more aware organization overall.

Q: How do you think AI will impact cybersecurity?in the near future?

A: AI's role in cybersecurity and information security is?really?shaping up to be a game-changer, particularly when?it comes to?managing compliance and reducing mistakes made by people.?AI can quickly spot issues and alert us by?automating the checks needed for complex regulations and keeping an eye on what's happening inside an organization.

This means businesses can react swiftly to potential security risks,?better protecting themselves against threats from outside attackers and problems that might arise?within their own walls.

However, using AI this way is a?bit of a?double-edged sword.?While it offers the power to enhance security and compliance, it also presents new challenges. For one, relying heavily on AI can create a false sense of security. Organizations might think everything is under control?just?because the AI system hasn't raised any alarms, potentially overlooking deeper issues that AI isn't programmed to catch.

Moreover, AI systems themselves can become targets for sophisticated cyber-attacks. If hackers?manage to?compromise the AI, they could manipulate it to ignore certain activities or, worse, access sensitive information.

Therefore, while AI can significantly strengthen an organization's ability to manage compliance and reduce errors,?it's crucial that this technology is?implemented thoughtfully. Businesses need to maintain a balance, using AI to enhance their capabilities without becoming overly dependent?on it.

Continual oversight, regular updates to the AI systems, and a robust understanding of their limitations are essential to ensure that AI?serves as?a tool for improvement rather than a potential liability.

Q: What advice would you give organizations looking to enhance cybersecurity in today's rapidly evolving threat landscape?

A: Consider cyber and information security not as a burden but as an enabler, transforming security responsibilities into value-adding strategic activities. Adopt a comprehensive approach that begins with an organization-wide risk assessment and integrates technology, human factors, and regulatory compliance.

Organizations should commit to ongoing cyber and information security training and acclimatization for their employees and managers, automate compliance processes where feasible, and embrace a multi-layered security strategy that combines advanced technology with robust organizational policies. This strategy should be grounded in a thorough understanding of human behavior.

This holistic approach?not only?safeguards against evolving threats but also?prepares organizations for future regulatory demands. More importantly, it supports goal achievement and fosters?business and organizational growth.

Thank you, Janne and Petter, for sharing more about Secure by Q and the latest in cyber and information security! ???????