WelcomeSecurity Due Diligence

Run due diligence on WelcomeSecurity: check compliance and get alerts when suppliers or ownership change.

Denmark · owned by Independent (Denmark) · welcomesecurity.net · 5 vendors

WelcomeSecurity is a Danish advisory company based in Silkeborg, Denmark, operating under CVR DK36622652. It acts as a 'Security Sidekick' helping developers, DevOps teams, and Security Champions build secure and robust software faster, offering services including Security Champions programmes, developer training, secure tooling, SDLC integration, and broader cybersecurity consulting. The company also encompasses a sister brand, Sustira, focused on ESG and sustainable business development.

Resilience scores

Technology vendors

Insights

Last updated 2026-10-27 · revision 2

5 direct vendors, 126 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

6 in-scope frameworks identified; showing 3.

SOC 2 (source) — No public evidence

A SOC 2 report is a common requirement for technology service providers, particularly those serving the US market, to assure customers about the security, availability, and confidentiality of their systems.

NIS2 (source) — No public evidence

As a cybersecurity services provider in Denmark, WelcomeSecurity likely falls under the 'ICT service management' sector of Annex II of the NIS2 Directive, making it an 'important' entity if it meets the size thresholds.

ISAE 3000 (source) — No public evidence

ISAE 3000 is an international standard for assurance engagements other than audits or reviews of historical financial information. It can be used for reports on cybersecurity controls, similar to SOC 2.

Financials

Three-year financials

Financial Resilience Score: 4/10

WelcomeSecurity is a Danish sole proprietorship (enkeltmandsvirksomhed) with CVR 36622652 that is explicitly not subject to accounting disclosure obligations. No revenue, EBIT, or equity figures have ever been published, and no share capital is registered. This makes a traditional financial resilience assessment impossible on quantitative grounds. The qualitative profile is that of a micro-advisory with a very low fixed-cost base, specialist positioning in cybersecurity and ESG consulting, and credible owner credentials (GIAC GCIH, GCIA, GSSP-.NET), operating in a market with regulatory tailwinds from NIS2, GDPR, DORA, and EU MDR. Offsetting these strengths are substantial structural risks: unlimited personal liability of the owner Thomas Ljungberg Kristensen, acute key-person dependency with only 1-3 people listed, zero financial transparency to counterparties undertaking due diligence, no visible equity cushion, and micro-scale compared with Nordic competitors like CSIS Security Group, Censornet, Heimdal, and Mnemonic. The dual-brand setup (WelcomeSecurity for security, Sustira for ESG) provides some revenue diversification but within a very small operational footprint. Overall resilience is moderate-to-low based on structural factors alone.

Key strengths: Low fixed-cost base typical of a micro-consultancy, Specialist positioning in cybersecurity/DevSecOps with regulatory tailwinds (NIS2, GDPR, DORA, EU MDR), Dual-brand diversification (WelcomeSecurity + Sustira ESG), Credible owner credentials: GIAC GCIH, GCIA, GSSP-.NET; active in OWASP Aarhus, BSides, DevOps Aarhus, Business history dating back to ~2015 under the WelcomeSecurity name

Risk factors: Unlimited personal liability of the owner (enkeltmandsvirksomhed legal form), Acute key-person risk with only 1-3 people in the team, Zero public financial transparency; no filed annual reports, No registered share capital and no visible equity cushion, Micro-scale versus established Nordic cybersecurity competitors, Entity was renamed to BrygMedMie in 2020 and only re-launched as WelcomeSecurity on 1 November 2021, indicating historical discontinuity

Revenue by geography

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report