CyberPilot ApS Due Diligence

Run due diligence on CyberPilot ApS: check compliance and get alerts when suppliers or ownership change.

Denmark · owned by Optus 1047 GmbH (Germany) · cyberpilot.io · 23 vendors

CyberPilot is a Danish cybersecurity company specializing in security awareness training and phishing simulation training for small and medium-sized businesses. Their platform provides interactive courses, simulated phishing attacks, and security culture assessments to help organizations reduce human-related cyber risks. They serve over 1,000 companies across multiple European markets including Denmark, Norway, Germany, the Netherlands, and Sweden.

Resilience scores

Technology vendors

Insights

Last updated 2026-10-15 · revision 89

23 direct vendors, 251 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

8 in-scope frameworks identified; showing 3.

EU AI Act (source) — No public evidence

CyberPilot ApS offers services that may utilize AI. The EU AI Act will apply to providers of AI systems, and depending on the nature of their services, they could be subject to its requirements.

GDPR (source) — Evidence found

CyberPilot ApS is established in Denmark, an EU member state, and therefore the GDPR applies to all its processing of personal data, regardless of where the data subjects are located.

Evidence: https://www.cyberpilot.io/privacy-policy, https://www.cyberpilot.io/cyberpilot-blog/7-gdpr-principles-explained, https://www.cyberpilot.io/cyberpilot-blog/how-to-make-sure-that-your-company-is-gdpr-compliant, https://www.cyberpilot.io/cyberpilot-blog/privacy-by-design-what-does-it-mean-and-how-is-it-important-for-the-gdpr, https://www.cyberpilot.io/cyber-security-and-gdpr-templates

NIS2 (source) — No public evidence

As a provider of cybersecurity services, CyberPilot ApS could be considered an ICT service management provider under Annex I of the NIS2 Directive. Its applicability would depend on whether it meets the size-cap for a medium-sized enterprise.

Financials

Three-year financials

Financial Resilience Score: 6/10

CyberPilot ApS demonstrates a strongly improving operational trajectory, with gross profit nearly doubling from DKK 11.6M in FY2023 to DKK 22.2M in FY2025 (~43% CAGR) and a successful turnaround from an EBIT loss of DKK -4.74M in FY2023 to positive EBIT in both FY2024 and FY2025, culminating in the first fully profitable net result (DKK 0.46M) in FY2025. The SaaS business model shows strong operating leverage, with headcount growing only modestly from 31 to 35 while gross profit nearly doubled, and a reported 90% customer renewal rate provides strong revenue visibility. However, the balance sheet remains technically distressed with negative equity of DKK -5.26M at end-FY2025, marking the fourth consecutive year below zero. This triggers mandatory capital-restoration reporting under Danish company law. Operating margins remain thin (~2.8% EBIT on gross profit), leaving minimal cushion for execution missteps. The August 2025 acquisition by SEPPmail AG (backed by LEA Partners) materially strengthens the resilience outlook by providing institutional capital, DACH distribution access from late 2026, and likely remediation of the negative equity position, though integration risk and competition from much larger players (KnowBe4, SoSafe, Hoxhunt) remain material concerns.

Key strengths: Gross profit nearly doubled from FY2023 to FY2025 (+91%), Operational turnaround with first net profit in FY2025 (DKK 0.46M), 90% customer renewal rate provides strong revenue visibility, Strong operating leverage: gross profit nearly doubled with only 4 additional staff, Acquisition by SEPPmail AG (LEA Partners-backed) brings institutional capital, Over 1,000 European organisations as customers, DACH channel expansion planned via SEPPmail from late 2026

Risk factors: Negative equity of DKK -5.26M at end-FY2025 (fourth consecutive year), Thin EBIT margin of ~2.8% on gross profit leaves little cushion, Small absolute scale vs. much larger competitors (KnowBe4, SoSafe, Hoxhunt, MetaCompliance), Integration risk following SEPPmail acquisition, Revenue not disclosed, limiting external benchmarking, Heavy geographic concentration in Denmark/Aarhus

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report