Henrik Larsen Informationssikkerhed Due Diligence

Run due diligence on Henrik Larsen Informationssikkerhed: check compliance and get alerts when suppliers or ownership change.

Denmark · owned by Independent (Denmark) · larsen-infosik.dk · 9 vendors

Henrik Larsen Informationssikkerhed is an independent Danish cybersecurity consultancy operated by Henrik Larsen, a seasoned information security advisor, trainer, and public speaker with over 40 years of experience. The firm offers services spanning advisory, implementation, auditing, IT governance, risk management, and regulatory compliance, with a focus on ISO 27001 and related frameworks. Henrik is a former head of DKCERT (the Danish academic CERT) and a former member of Denmark's national Cybersikkerhedsråd (Cybersecurity Council).

Resilience scores

Technology vendors

Insights

Last updated 2026-11-01 · revision 38

9 direct vendors, 78 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

4 in-scope frameworks identified; showing 3.

ISO 27001 (source) — No public evidence

This is a voluntary information security management standard. As a cybersecurity consultancy, certification is a common way to demonstrate robust security practices to clients and partners.

GDPR (source) — No public evidence

The company is established in Denmark, within the EU, and processes personal data of clients and contacts, making it subject to the General Data Protection Regulation.

NIS2 (source) — No public evidence

As a sole proprietorship established in 2023, the company does not meet the medium-sized entity criteria (50+ employees or >€10M turnover/balance sheet) for automatic inclusion. Applicability would depend on whether it is designated as a critical entity by national law.

Financials

Financial Resilience Score: 5/10

Henrik Larsen Informationssikkerhed is a one-person Danish cybersecurity consultancy with no publicly filed financial statements. As a sole proprietorship (enkeltmandsvirksomhed), it falls below Danish statutory accounts-publication thresholds, so no revenue, EBIT, or equity figures are available in CVR, Proff.dk, or any other primary filing source. Any resilience assessment must therefore be qualitative. On the positive side, the business benefits from a highly specialised and scarce skill set: the founder holds CGEIT certification (one of only 22 in Denmark), ISO 27001 Lead Implementer, ISO 27701 diploma, and ISO 27001 auditor credentials. He is the former head of DKCERT (nine years), ex-information-security chief at the University of Copenhagen, former member of the Danish national Cybersecurity Council (2020-2023), and chairs the programme committee for the global FIRST Conference held in Copenhagen in June 2025. These credentials support strong pricing power and client acquisition in a market with favourable tail-winds from NIS2 and ISO 27001/27701 demand. However, the business carries total key-person risk — it is one named individual, born 1966, with no team, no successor, and no bench. Scalability is bounded by one consultant's billable hours, and single-client concentration risk is material. The lack of filed accounts also impairs counter-party due diligence for larger engagements. Fixed-cost structure is low (home-based operation in Nykøbing F), providing a structural buffer, but overall the practice offers minimal transparency and limited structural resilience beyond the founder himself.

Key strengths: Highly specialised credentials (CGEIT, ISO 27001 Lead Implementer, ISO 27701, ISO 27001 auditor), Strong professional reputation: former head of DKCERT, ex-member of Danish national Cybersecurity Council, Chairmanship of FIRST Conference programme committee (Copenhagen, June 2025), Low fixed-cost structure (home-based, single practitioner), Favourable market demand from NIS2 and ISO 27001/27701 compliance needs, Recurring editorial/threat-assessment work for DKCERT

Risk factors: Total key-person risk — business is one individual (born 1966), No successor, bench, or team to absorb illness, retirement, or capacity constraints, Scalability ceiling bounded by one consultant's billable hours, No published accounts — impairs counter-party due diligence, Client concentration risk inherent to boutique consultancies, Only ~2 years of operating history as independent practice

Revenue by geography

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report