Your product ships from a cloud account, a repo and a CI/CD pipeline, and attackers know all three. eBuilder Security gives SaaS, cloud and software companies a Sweden-based 24/7 SOC that watches identities, cloud workloads and the software supply chain, so your engineers can keep shipping instead of standing watch.
See How NIS2 Maps to Cloud and CI/CDTrusted by 100+ Swedish Kommuner, Regions and
EU-Regulated Organisations Since 2002
Cloud computing, data centre, CDN and DNS providers, plus MSPs and MSSPs, are named in NIS2 Annex I, and Annex II adds online marketplaces, search engines and social platforms. Sweden’s Cybersäkerhetslagen (SFS 2025:1506) has applied this since 15 January 2026, with PTS supervising digital infrastructure and electronic communications and the MCF receiving incident notifications.
The general threshold is 50+ employees or over €10 million turnover, but several digital infrastructure categories are in scope regardless of size, and the law’s whole-entity approach pulls your entire IT footprint in once any part of the business qualifies. Anyone shipping products with digital elements also faces the Cyber Resilience Act, with vulnerability reporting duties from 11 September 2026.
MFA and least privilege across cloud IAM, SSO, source-code repositories and build pipelines, the accounts attackers actually log in with.
A 24-hour early warning, 72-hour notification and one-month final report to CERT-SE and the MCF for significant incidents, with GDPR’s own 72 hours to IMY alongside.
Open-source dependencies, package registries and third-party SaaS tooling all count as supply chain under Article 21 and need documented oversight.
Management bodies carry the compliance duty, and Sweden’s law adds management bans and personal liability for leadership that ignores it.
Attackers rarely break your product. They log in with a stolen developer credential, poison an npm dependency your build pulls automatically, or find the one cloud bucket nobody reviewed. Around 30% of intrusions now start with valid credentials, and third-party involvement in breaches has doubled, which is why software supply chain security and API security sit at the centre of cybersecurity for technology companies.
A threat actor calling itself ByteToBreach leaked source code and configuration data allegedly from CGI Sverige’s internal GitLab, reportedly including database passwords, SMTP credentials and keystore files behind core Swedish e-government platforms. Sweden’s civil-defence minister confirmed the incident. Source: CGI Sverige incident, 2026 (attribution as reported).
The Shai-Hulud worm, the first known self-replicating npm malware, stole maintainer credentials and CI/CD secrets and republished poisoned updates, compromising more than 500 packages within days in 2025. Source: Sonatype, 2026; CISA, 2025.
Third parties were involved in 30% of all breaches, double the previous 15%, putting vendors, dependencies and integrations at the heart of tech-sector risk. Source: Verizon DBIR, 2025.
The technology sector’s average breach cost was $4.79 million in 2025, fifth-highest of all industries and above the $4.44 million global average. Source: IBM/Ponemon Cost of a Data Breach Report, 2025.
From a phished maintainer account to a misconfigured bucket to a rogue AI coding tool, the same Sweden-based team detects it, contains it and reports it.
Govern AI in Your Product and Your IDE
Tech companies face AI risk twice over: in the AI features they ship and in the AI coding tools their engineers adopt unsanctioned. AIDR inventories shadow AI, blocks prompt injection and applies AI-DLP at runtime, monitoring prompts, models and agents. That matters when nearly 99% of AI-related vulnerabilities trace back to API flaws.
Watch Cloud, SSO and Pipelines, Not Just Laptops
Cloud-native companies get breached through identity, so our SOC correlates cloud workloads, SaaS and SSO sign-ins, CI/CD activity and endpoints in one place. Identity compromise underpins the large majority of cloud intrusions, and breakout time averages around 29 minutes. Our median response is 3 minutes, from analysts based in Sweden.
Test What Your Customers’ Auditors Will Ask About
Human-led CREST and OSCP testing of web applications, APIs, cloud infrastructure and Active Directory, with CVSS-rated findings and a free retest. Reports and findings stay in Sweden, ready to hand to enterprise customers running vendor security reviews.
Train the People Who Hold Repo Access
Engineers and DevOps hold the keys attackers want most, and the 2025 npm compromises started with a phished maintainer’s fake 2FA reset. Our simulations target exactly those credential and reset lures, alongside secure handling of source code and secrets.
Senior Security Leadership on a Scale-Up Budget
Startups and scale-ups rarely have security leadership to match their exposure. A vCISO runs board-level NIS2 and CRA governance, vendor risk and your SOC 2 or ISO 27001 programme, the certifications enterprise procurement treats as a gate before any deal proceeds.
FREE 30-MIN SECURITY REVIEW
Book a 30-minute review. We map your cloud, identity and pipeline exposure and tell you what to fix first.
Talk to a Security AnalystA Swedish security partner focused on transparency, consistency and long-term trust. One of our longest active MDR engagements has run for over 4 years with zero breaches recorded.
See How We Map to Article 21The industry talks in hours. We measure in minutes.
Human analysts watching every signal. Logs stay within Sweden-based infrastructure.
MDR can be live within 72 hours once access and approvals are in place.
Cybersecurity practice within eBuilder, a Swedish technology company operating since 2002.
Independently audited and certified to the ISO 27001 standard for our SOC.
All services mapped to NIS2 Article 21 risk-management measures and aligned with MCF guidance.
Human-led monitoring and infrastructure aligned with GDPR and Schrems II requirements.
No rip-and-replace, no freeze on deploys. Full 24/7 MDR coverage is typically live in about three days on top of the tooling you already run.
Sensors and integrations roll out across endpoints, cloud accounts and identity providers without touching your release pipeline.
We learn what normal looks like for your deploys, service accounts and sign-in patterns, so alerts flag anomalies rather than noise.
A named analyst and escalation runbooks tuned to your architecture, watching cloud, identity, SaaS and endpoints around the clock.
Regular reporting that doubles as material for NIS2 records, SOC 2 and ISO 27001 audits, and enterprise customer security reviews.
The product increases knowledge and security awareness. I am particularly pleased that it is an end-to-end solution where eBuilder Security takes care of the entire process from kick-off to reporting, while allowing for customization to suit the conditions unique to our business.
Per Eriksson
Information Security Strategist, Varbergs Kommun, Sweden
Through their range of security services and our decision to choose their MDR solution, eBuilder Security has significantly elevated our security posture. During the implementation phase, they were quick to assist and propose solutions to any challenges we encountered. The transition from project to production has been smooth.
Gerth Ericsson
IT Manager, Vandewiele, Sweden
eBuilder Security helps us meet our IT and information security needs. We are very satisfied by their deep knowledge, comprehensive services, and dedication to strengthening our cybersecurity posture. eBuilder Security has been a reliable partner in safeguarding our organization.
Christian Sørensen
Internal Operations Director, Médecins Sans Frontières, Norway
Browse by topic to find the answer you need.
Very likely if you provide cloud computing, data centre, CDN, DNS or managed services (MSP or MSSP), or operate an online marketplace, search engine or social platform, and you meet the size threshold of 50+ staff or €10 million or more in turnover. Several digital infrastructure categories are in scope regardless of size. Sweden’s Cybersäkerhetslagen (SFS 2025:1506) took effect on 15 January 2026 with a whole-entity approach. PTS supervises digital infrastructure and electronic communications, and incidents are notified via the MCF.
Cybersäkerhetslagen follows the NIS2 three-stage timeline: a 24-hour early warning, a 72-hour notification and a one-month final report to CERT-SE and the MCF. Fines reach €10 million or 2% of global turnover for essential entities and €7 million or 1.4% for important entities, and Sweden adds management bans and personal liability under Article 20. The Cyber Resilience Act adds separate product-vulnerability reporting from 11 September 2026, with fines up to €15 million or 2.5% of worldwide turnover.
Risk analysis and security policies: applied to cloud accounts, CI/CD and source-code repositories, not just office IT.
Incident handling: detection and response across cloud, identity and endpoints.
Business continuity and backup: recovery of SaaS production environments.
Supply chain security, Article 21(2)(d): software dependencies and package management, third-party SaaS tooling and open-source components.
Secure acquisition, development and maintenance: a secure SDLC plus vulnerability handling and coordinated disclosure.
Effectiveness assessment: policies to measure whether the controls actually work.
Cyber hygiene and training: basic hygiene plus role-based training for engineers and DevOps.
Cryptography and encryption: policies on where and how encryption is used.
HR security, access control and asset management: least privilege on repositories and cloud IAM, with joiner and leaver control.
MFA and secured communications: MFA across SSO, cloud consoles and privileged accounts under Article 21(2).
The crown jewels are your codebase, cloud environment, CI/CD pipelines and customer data rather than office documents. Engineering teams deploy constantly, rely heavily on open-source dependencies, around 90% of modern software, and on third-party SaaS, and they work remotely, so identity and software supply chain risk dominate. Third-party involvement is now present in 30% of breaches, according to the Verizon DBIR 2025.
A 24/7 SOC monitors endpoints, identities, SaaS and SSO activity and cloud workloads, correlates the telemetry and contains threats before lateral movement. Attacker breakout averages around 29 minutes, and our median response is 3 minutes. For tech companies this must include cloud and identity coverage, not just endpoint EDR. That is exactly how the Snowflake customer-credential campaign succeeded, through tenants without enforced MFA rather than through malware.
The 2025 npm incidents showed how it goes wrong: the Shai-Hulud worm stole maintainer credentials and CI/CD secrets to compromise more than 500 packages, and the chalk and debug hijack started with one phished 2FA reset. Our coverage combines identity monitoring on the accounts that hold repo and pipeline access, awareness training against exactly those lures, and Article 21(2)(d)-aligned documentation of your dependency and vendor oversight.
APIs are now a primary attack surface. For the first time, over 50% of CISA’s Known Exploited Vulnerabilities in 2024 were API-related, up from 20% in 2023, and the Dell breach exposed 49 million customer records through a partner-portal API. Our penetration testing covers your public and partner APIs specifically, with CVSS-rated findings and a free retest after fixes.
Expect direct cost near the technology-sector average of $4.79 million, according to IBM and Ponemon in 2025, plus customer churn, contractual liability and regulatory exposure. Under Cybersäkerhetslagen you must report a significant incident to CERT-SE and the MCF on the NIS2 timeline, a 24-hour early warning, a 72-hour notification and a one-month final report, and GDPR adds a 72-hour notification to IMY where personal data is involved.
100% within Sweden-based infrastructure, as a contractual commitment. For a SaaS company this is more than compliance hygiene: it supports the Schrems II and data-residency commitments you make to your own EU customers, because your codebase telemetry and security logs never route through infrastructure outside the EU.
Unsanctioned AI use carries a measurable price. IBM found that a high level of shadow AI added USD 670,000 to the average breach cost in 2025, with personal data compromised in 65% of those breaches versus 53% globally, and intellectual property in 40% versus 33%. AIDR inventories shadow AI across the organisation, blocks prompt injection and applies AI-DLP at runtime, so adoption of AI tooling does not become uncontrolled data exposure.
MDR is flat per-endpoint with no per-gigabyte log charges, incident surcharges or per-feature add-ons. Testing and advisory are scoped per project, with a tailored quote within a couple of business days. For cloud-heavy companies with few traditional endpoints, we confirm during scoping how cloud workloads, identities and SaaS coverage are counted, so the model fits your architecture rather than assuming a laptop fleet.
Yes, through CISO as a Service. For B2B SaaS these certifications are sales infrastructure: enterprise procurement frequently will not proceed until a SOC 2 report exists, and ISO 27001 is the gatekeeper for European and enterprise deals. A vCISO runs the programme, and MDR reporting doubles as audit evidence for monitoring and incident-response controls.
A named Sweden-based analyst rather than a ticket queue, 100% of security data kept in Sweden, a 3-minute median response, an ISO 27001 certified SOC and services mapped to NIS2 Article 21. On a global platform, your codebase telemetry and customer data may be handled outside the EU by an anonymous SOC, which is a hard sell in your own customers’ vendor security reviews.
Thirty minutes with a Sweden-based analyst, no cost, no obligation. We walk through your cloud, identity and pipeline exposure, flag what actually needs attention first, and show you the SOC live.
Book a 30-Minute Security Briefing