Finding an organisation’s blind spots before an attacker does – Interview with Henrik Skalmerud, co-founder and CEO of Bsure

In late October, Norway’s National Security Authority raised the national cyber risk level to its second-highest tier after a sharp rise in successful attacks. Henrik Skalmerud sees the same weak points almost everywhere he looks, such as accounts created years ago that have never been used, and privileged accounts without proper protection.

As co-founder and CEO of Bsure, founded in Norway in 2022, he works on giving organisations a full view of their identities, including employees, guests, apps and AI agents, and who is responsible for each of them. For our latest founder spotlight, we spoke with Henrik about building the company in the evenings before going all in, and what changes when AI agents and other non-human identities start to outnumber the people in an organisation.”

How do you explain what Bsure does when someone asks at a dinner party?
I usually start with what we help our customers with, which is reducing risk and cutting costs they don’t know they have. Then I ask people to think about all the apps on their phone. Each one has an account, some come with a subscription, and you need to make sure those accounts are protected and cancel the subscriptions you no longer use. Now imagine an organization with thousands of employees, each with dozens of accounts, and people joining and leaving every week. Keeping track of that by hand is impossible, and that’s where Bsure comes in.

What’s the most surprising thing you’ve found in a customer’s setup?
Honestly, nothing really surprises me anymore. It’s the reason we started Bsure, and we see the same things everywhere. Privileged accounts without proper protection, and users created years ago who have never signed in once. Most organizations have good processes on paper, but very few verify that those processes actually work, and complexity is increasing, with AI as one example. That gap matters even more now that Norwegian authorities have raised the national cyber risk level.

Where were you in life when the idea for Bsure came along, and what made you decide to bet on it?
I had just left my job at an IT services provider after we sold it to another private equity owner, and I was working for a carbon capture scaleup. One of my co-founders and I had been bouncing ideas back and forth for over a year, until one day he said he had found a problem he saw at every customer. We built Bsure in the evenings, and once we launched, a couple of us quit our jobs to start selling full time. More joined as soon as we had enough revenue to cover their salaries.

You work with municipalities in Norway and Sweden. What does a weak spot look like in a public-sector Microsoft environment, and what’s at stake if someone else finds it first?
A municipality is complex. It’s really dozens of organizations in one, with schools, healthcare, first responders and temporary staff all in the same environment. The weak spots are rarely one big hole. They are blind spots that have built up quietly over the years, which is what we call the visibility gap. We’ve started saying that someone will always find the blind spot, whether it’s you, your auditor or an attacker. The later it’s found, the more it costs.

What did it take to get the first customers to trust a Norwegian startup with their Microsoft setup?
First of all, we used our networks. We had worked with many of these organizations before, so the first conversations started with people who already knew us. The other key element was our delivery model. Bsure runs inside the customer’s own IT environment and is installed straight from Microsoft’s marketplace, so their data never leaves and there is no long procurement process to get through. That removes a lot of friction and builds trust from the very first day.

What’s something you believed about building a company that turned out to be wrong?
I believed that having paying customers from day one meant we were on the right track. In many ways it was a strength, but it also made it easy to keep doing what already worked. We spent a lot of time talking about the problem, showing customers what was wrong in their environment, and less time understanding what they were actually struggling with day to day and helping them fix it. That has changed how we sell and how we think about the product going forward.

You’ve said AI agents create accounts and access faster than anyone can follow by hand. What are you seeing in your customers’ environments?
Many of our customers are not there yet, but some are moving fast. We have seen environments where agents and other non-human identities already outnumber the workforce two to three times. Every agent comes with its own identity and permissions, many are created outside IT, and few have a clear owner. Most organizations haven’t figured out what good governance looks like yet.

You’ve grown from Asker to around 250 companies and municipalities, with offices in Stockholm and Palo Alto. What has building from Norway given you along the way?
Building out of one of the most digitalized countries in the world has been a real advantage. Norwegian organizations are heavy Microsoft users, which means we have spent years solving identity problems with our customers that many other markets are only starting to notice. Norwegian municipalities are also demanding customers. They are careful with public money, take data protection seriously and share experiences openly with each other, so you have to earn every reference.

‍