Geokon

Denmark · owned by GEOKON HOLDING A/S (Denmark) · geokon.dk · 20 vendors

Geokon A/S is a Danish company that develops IT solutions and services within the technical and environmental fields. They offer software development, IT service, and education, primarily known for their GeoEnviron solution, serving public and private sectors in Denmark and internationally.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 20 sub-vendors.

Insights

Last updated 2026-09-13 · revision 11

20 direct vendors, 238 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Geokon exhibits medium migration readiness, leaning towards the lower end due to several challenges. The core GeoEnviron solution, with over 50% of customer installations hosted in 'Danish On-Premises Hosting Centers,' suggests a traditional, potentially monolithic architecture that would require significant re-engineering for a full cloud-native migration. The extensive 'GeoEnviron Integrationer' with various external systems (ESDH, public Danish systems, financial, GIS) creates a complex web of dependencies, increasing the effort and risk associated with migrating the entire ecosystem. Strict GDPR and EU data residency requirements mandate that data remain within EU/EEA jurisdictions, limiting flexibility in choosing cloud regions or providers and adding compliance overhead to any migration strategy. The 'Vendor Lock-in Risk' is unknown, but the numerous integrations imply potential dependencies on third-party systems that could complicate migration. Financial stability data is missing, making it impossible to assess the company's capacity to fund a potentially costly and complex migration. Opportunities for migration include the presence of a 'GeoEnviron API' and 'GeoEnviron WEB' (web-based self-service portals), indicating some modularity and modern integration capabilities that could facilitate a phased migration approach. Their 'SmartCloud (Hosting)' offering demonstrates experience in managing IT infrastructure, which could be leveraged for transitioning to managed cloud services.

Compliance

8 in-scope frameworks identified; showing 3.

ISO 27001 (source) — Assessment Required

ISO 27001 risk is Medium because: (1) Geokon processes sensitive municipal and citizen data in a hosted cloud environment — information security management is directly relevant. (2) No ISO 27001 certification has been found publicly, despite the hosting page claiming 'certified hosting facilities'. (3) Geokon's public-sector clients (municipalities, state agencies) are increasingly required under Danish and EU procurement rules to ensure their IT suppliers maintain adequate information security, often evidenced by ISO 27001. (4) NIS2 compliance (if applicable) strongly aligns with ISO 27001 controls. (5) Risk is Medium rather than High because ISO 27001 is voluntary, and Danish SMEs in the software sector have variable certification rates. However, the gap between claimed 'certified facilities' and no publicly verifiable certification is a reputational and procurement risk.

Evidence: https://geokon.dk/ydelser/hosting/, https://geokon.dk/om-os/om-geokon/, https://www.iso.org/isoiec-27001-information-security.html, https://www.ds.dk/en/standards/it-security/iso-27001

ISAE 3000 (source) — Assessment Required

ISAE 3402/3000 risk is Medium because: (1) Geokon provides hosted IT services to public-sector clients (municipalities, state agencies) who are themselves subject to audit and accountability requirements. These clients may require ISAE 3402 (Type I or II) assurance reports from Geokon as their IT service provider to satisfy their own internal and external audit obligations. (2) Danish public-sector procurement and audit standards (Rigsrevisionen) increasingly expect IT service providers to public authorities to provide third-party assurance. (3) No ISAE 3402 or ISAE 3000 report has been found publicly. (4) Risk is Medium because this is a voluntary framework in Denmark, but the absence of assurance reporting may create procurement and client retention risks.

Evidence: https://geokon.dk/ydelser/hosting/, https://geokon.dk/om-os/om-geokon/, https://www.iaasb.org/publications/international-standard-assurance-engagements-isae-3402-assurance-reports-controls-service, https://www.fsr.dk/faglige-informationer/revision/isae-3402

NIS2 (source) — Assessment Required

NIS2 risk is Medium with meaningful probability of applicability for the following reasons: (1) Geokon provides IT/software services to ~70% of Danish municipalities and state agencies — public administration clients are themselves Essential Entities under NIS2 Annex I. As a critical IT supplier to public administration, Geokon may qualify as an 'ICT service management' provider or fall under supply chain security obligations imposed on its public-sector clients. (2) Geokon's GeoEnviron DEPONI (waste depot management) and GeoEnviron ROTTER (rat/pest control) solutions serve the waste management sector, which is an Important Entity sector under NIS2 Annex II. If Geokon itself qualifies as a digital provider to waste management entities, NIS2 supply chain provisions apply. (3) Geokon offers hosted cloud services ('GeoEnviron SmartCloud') — digital infrastructure/cloud services may trigger NIS2 applicability as a 'managed service provider' or 'cloud computing service provider'. (4) Size threshold uncertainty: Geokon was founded in 1971 and serves 70% of Danish municipalities — it likely meets the medium enterprise threshold (50+ employees or €10M+ turnover), but exact figures are not publicly confirmed. Risk is Medium rather than High because Geokon is primarily a niche software vendor, not a core infrastructure operator, and direct NIS2 entity classification requires formal assessment.

Evidence: https://geokon.dk/om-os/om-geokon/, https://geokon.dk/ydelser/hosting/, https://geokon.dk/loesninger/geoenviron-deponi/, https://www.cfcs.dk/en/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555, https://www.datatilsynet.dk/english

Financials

Three-year financials

Financial Resilience Score: 6/10

Geokon A/S appears to be a mature niche software vendor serving the Danish public sector with its GeoEnviron platform. While specific financial figures could not be retrieved in this session, the qualitative business profile suggests moderate-to-good financial resilience. The company benefits from sticky, long-term public-sector customer relationships with Danish municipalities, high switching costs for environmental and building-permit systems, and a recurring revenue mix from hosting, support, and SaaS-type services that provides predictable cash flow. However, several risks temper this assessment. As a small niche vendor (estimated 20-60 FTEs), Geokon faces key-person risk and customer concentration risk, as the total addressable market of ~98 Danish municipalities is limited. Public-sector procurement dynamics (SKI framework agreements, EU procurement thresholds) could force competitive re-tendering, and potential consolidation via KOMBIT/KL national platforms represents a structural threat. Limited international footprint further constrains growth optionality. Without access to CVR filings showing actual revenue, EBIT, equity, and trend data, a precise resilience score cannot be substantiated, but the business model characteristics support a moderate rating.

Key strengths: Sticky, recurring public-sector customer base with high switching costs, Recurring revenue mix from hosting, support, and SaaS services, Niche market leadership in Danish municipal environmental software, Regulatory tailwind from mandated environmental compliance activities, Established product (GeoEnviron) with long market presence, Ongoing customer engagement including 2024 Kalundborg Symbiose partnership

Risk factors: Small company / key-person risk (estimated 20-60 FTEs), Customer concentration in ~98 Danish municipalities, Public-sector procurement re-competition risk (SKI, EU tenders), Potential displacement by KOMBIT/KL national municipal IT consolidation, Limited international footprint; Denmark-only focus, Vulnerability to loss of large customers (e.g., Aarhus, Copenhagen)

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report