# FM CyberSecurity

> Norwegian cybersecurity consultancy based in Oslo, with senior specialists across identity, exposure, compliance, AI security, MDR, and application security.

FM CyberSecurity is a consultants-first firm founded in 2025, headquartered at Henrik Ibsens gate 36 in central Oslo. Norwegian content is canonical at the unprefixed root; English content lives under `/en/`. Both locales are exposed below. Every URL below points at the Markdown twin of the page (`.md`); append `.md` to any human URL on the site to fetch its Markdown body directly.

## Homepage

- [FM CyberSecurity](https://fmcybersecurity.com/en/index.md): FM CyberSecurity: specialists in identity, exposure, compliance, AI security and AI pentesting. Your security, our priority.
- [FM CyberSecurity](https://fmcybersecurity.com/index.md): FM CyberSecurity: fagspesialister innen identitet, sårbarheter, compliance, AI-sikkerhet og AI-pentest. Din sikkerhet, vår prioritet.

## Secured by FM CyberSecurity

- [Secured by FM CyberSecurity](https://fmcybersecurity.com/en/secured.md): Large customers and public buyers want to see ISO 27001 before they sign. We take you all the way, with a guarantee. One vendor, one contract, one price.
- [Secured by FM CyberSecurity](https://fmcybersecurity.com/secured.md): Store kunder og offentlige innkjøpere vil se ISO 27001 før de signerer. Vi tar dere hele veien, med garanti. En leverandør, en kontrakt, en pris.

## About and contact

- [Who is FM CyberSecurity?](https://fmcybersecurity.com/en/about.md): FM CyberSecurity is a Norwegian cybersecurity firm based in Oslo. Senior specialists across identity, exposure, compliance, AI security, MDR and application security.
- [Hvem er FM CyberSecurity?](https://fmcybersecurity.com/about.md): FM CyberSecurity er en norsk cybersikkerhetsvirksomhet i Oslo. Senior fagspesialister innen identitet, sårbarhet, compliance, AI-sikkerhet, MDR og applikasjonssikkerhet.
- [Contact](https://fmcybersecurity.com/en/contact.md): Talk directly to a named specialist at FM CyberSecurity. Pick a consultant by topic: MDR, compliance, identity or AI security. Or send a general message. We respond within one business day.
- [Kontakt](https://fmcybersecurity.com/contact.md): Snakk direkte med en navngitt fagspesialist hos FM CyberSecurity. Velg konsulent etter tema: MDR, compliance, identitet eller AI-sikkerhet. Eller send en generell henvendelse. Vi svarer innen en virkedag.

## Services (English)

- [Services](https://fmcybersecurity.com/en/services.md): We cover the full security picture, from strategic advisory to 24/7 operational delivery. You work with specialists directly, with no extra layers in between.
- [CISO-for-hire](https://fmcybersecurity.com/en/services/ciso.md): Fractional and interim CISO leadership; principal-level strategy without a full-time hire.
- [Subject Matter Experts](https://fmcybersecurity.com/en/services/subject-matter-experts.md): Senior advisory across security architecture, governance, and programme delivery.
- [ServiceNow](https://fmcybersecurity.com/en/services/servicenow.md): ServiceNow security and GRC architecture for regulated environments.
- [Project Leader](https://fmcybersecurity.com/en/services/project-leader.md): Architect-level project leadership for security and platform initiatives.
- [Managed Detection and Response](https://fmcybersecurity.com/en/services/mdr.md): Managed Detection and Response via CrowdStrike Falcon Complete; onboarding, tuning, and local escalation from FM.
- [Incident Response](https://fmcybersecurity.com/en/services/incident-response.md): Incident-response consulting, escalation management, and post-incident review.
- [Agentic SOC](https://fmcybersecurity.com/en/services/agentic-soc.md): Autonomous SOC operations powered by Charlotte AI.
- [Vulnerability & Exposure Management](https://fmcybersecurity.com/en/services/exposure-management.md): Continuous exposure-management programme built on Tenable.
- [Maturity Assessment](https://fmcybersecurity.com/en/services/security-maturity-assessment.md): Baseline and gap analysis against a chosen framework.
- [Cloud Security Assessment](https://fmcybersecurity.com/en/services/cloud-security-assessment.md): Cloud posture review and compliance readiness check.
- [ISO 27001](https://fmcybersecurity.com/en/services/iso27001.md): From compliance burden to certification, typically in 2 to 3 weeks of focused work.
- [NIS2](https://fmcybersecurity.com/en/services/nis2.md): NIS2 readiness for Nordic organisations; Norway transposition is in progress as an EEA state.
- [DORA](https://fmcybersecurity.com/en/services/dora.md): Digital Operational Resilience Act readiness for in-scope financial entities.
- [GDPR](https://fmcybersecurity.com/en/services/gdpr.md): GDPR programme work, DPIAs, and documented control.
- [AI Act](https://fmcybersecurity.com/en/services/ai-act.md): EU AI Act readiness for providers and deployers; risk classification, governance, technical documentation, and oversight up to each application date.
- [Cyber Resilience Act](https://fmcybersecurity.com/en/services/cyber-resilience-act.md): EU Cyber Resilience Act readiness for makers of products with digital elements; product classification, vulnerability handling, technical documentation, and CE-mark conformity up to the 2027 application date.
- [AI Advisory](https://fmcybersecurity.com/en/services/ai-advisory.md): AI strategy, governance, and secure deployment guidance.
- [Shadow AI](https://fmcybersecurity.com/en/services/shadow-ai.md): The Shadow AI challenge, unsanctioned AI use across employees, agents, and SaaS, discovered and governed with Tenable AI Exposure Management.
- [Vibe Coding](https://fmcybersecurity.com/en/services/vibe-coding.md): Security guardrails for AI-assisted and AI-generated code.
- [Pentest with AI](https://fmcybersecurity.com/en/services/pentest.md): AI-driven pentesting delivered through Aikido.
- [DevOps](https://fmcybersecurity.com/en/services/application-security.md): AppSec programmes, SDLC integration, and continuous security.
- [Privileged Access Management (PAM)](https://fmcybersecurity.com/en/services/pam.md): Privileged access management on Idira (CyberArk): vault, rotate, isolate, and record privileged accounts.
- [Machine & Non-Human Identity](https://fmcybersecurity.com/en/services/machine-identity.md): Machine and non-human identity on Idira (CyberArk): secrets, certificates, and workload identities.
- [Secrets Management](https://fmcybersecurity.com/en/services/secrets-management.md): Secrets management on Idira (CyberArk): credentials, API keys, and tokens out of code and into a controlled flow.
- [AI Visibility](https://fmcybersecurity.com/en/services/ai-visibility.md): AI visibility: discover every AI tool, agent, and model in use, sanctioned or not, before you govern it.
- [Prompt Protection](https://fmcybersecurity.com/en/services/prompt-protection.md): Prompt protection: guardrails against prompt injection and data leakage in the AI tools your teams already use.
- [AI Security](https://fmcybersecurity.com/en/services/ai-security.md): AI security practice: Shadow AI discovery, prompt and agent protection, and governance of agentic AI, delivered on CrowdStrike Falcon AIDR.
- [Consulting](https://fmcybersecurity.com/en/services/consulting.md): Consulting practice: vCISO, security architecture, and named senior specialists on assignment.
- [Vulnerability Management](https://fmcybersecurity.com/en/services/vulnerability-management.md): Vulnerability management practice: scanning, prioritisation, and remediation tracking on Tenable, with AI pentesting on Aikido.
- [Identity Security](https://fmcybersecurity.com/en/services/identity.md): Identity practice: privileged access and machine identity on Idira (CyberArk).
- [Compliance](https://fmcybersecurity.com/en/services/compliance.md): Compliance practice: ISO 27001, NIS2, DORA, and GDPR work led by certified Lead Implementers.

## Services (Norwegian)

- [Tjenester](https://fmcybersecurity.com/services.md): Vi dekker hele sikkerhetsbildet, fra strategisk rådgivning til 24/7 operativ drift. Du jobber med spesialister direkte, uten flere kontaktpunkter.
- [CISO-for-hire](https://fmcybersecurity.com/services/ciso.md): Fraksjonell og midlertidig CISO-ledelse; strategisk arbeid på principal-nivå uten heltidsansettelse.
- [Fageksperter](https://fmcybersecurity.com/services/subject-matter-experts.md): Senior rådgivning innen sikkerhetsarkitektur, styring og programleveranse.
- [ServiceNow](https://fmcybersecurity.com/services/servicenow.md): ServiceNow-sikkerhet og GRC-arkitektur for regulerte miljøer.
- [Prosjektledelse](https://fmcybersecurity.com/services/project-leader.md): Arkitektnivå prosjektledelse for sikkerhets- og plattforminitiativer.
- [Sikkerhetsovervåkning (MDR/SOC)](https://fmcybersecurity.com/services/mdr.md): Managed Detection and Response via CrowdStrike Falcon Complete, onboarding, tuning og lokal eskalering fra FM.
- [Hendelseshåndtering](https://fmcybersecurity.com/services/incident-response.md): Hendelseshåndtering, eskaleringsstyring og evaluering etter hendelser.
- [Agentic SOC](https://fmcybersecurity.com/services/agentic-soc.md): Autonom SOC-drift drevet av Charlotte AI.
- [Sårbarhetshåndtering](https://fmcybersecurity.com/services/exposure-management.md): Kontinuerlig sårbarhetshåndtering bygget på Tenable.
- [Modenhetsvurdering](https://fmcybersecurity.com/services/security-maturity-assessment.md): Baseline og gap-analyse mot et valgt rammeverk.
- [Skysikkerhetsvurdering](https://fmcybersecurity.com/services/cloud-security-assessment.md): Vurdering av skyposisjon og compliance-modenhet.
- [ISO 27001](https://fmcybersecurity.com/services/iso27001.md): Fra compliance-belastning til sertifisering, vanligvis på 2 til 3 ukers fokusert arbeid.
- [NIS2](https://fmcybersecurity.com/services/nis2.md): NIS2-modenhet for nordiske organisasjoner; Norge gjennomfører direktivet som EØS-stat.
- [DORA](https://fmcybersecurity.com/services/dora.md): DORA-modenhet for finansforetak i virkeområdet.
- [GDPR](https://fmcybersecurity.com/services/gdpr.md): GDPR-programarbeid, DPIA-er og dokumentert kontroll.
- [AI Act](https://fmcybersecurity.com/services/ai-act.md): EU AI Act-modenhet for leverandører og utrullere; risikoklassifisering, styring, teknisk dokumentasjon og tilsyn fram til hvert virkningstidspunkt.
- [Cyber Resilience Act](https://fmcybersecurity.com/services/cyber-resilience-act.md): EU Cyber Resilience Act-modenhet for produsenter av produkter med digitale elementer; produktklassifisering, sårbarhetshåndtering, teknisk dokumentasjon og CE-samsvar fram til virkningstidspunktet i 2027.
- [AI-rådgivning](https://fmcybersecurity.com/services/ai-advisory.md): AI-strategi, styring og veiledning for sikker utrulling.
- [Shadow AI](https://fmcybersecurity.com/services/shadow-ai.md): Shadow AI-utfordringen, uoffisiell AI-bruk på tvers av ansatte, agenter og SaaS, kartlagt og styrt med Tenable AI Exposure Management.
- [Vibe Coding](https://fmcybersecurity.com/services/vibe-coding.md): Sikkerhetsrammer for AI-assistert og AI-generert kode.
- [Pentest med AI](https://fmcybersecurity.com/services/pentest.md): AI-drevet pentesting levert via Aikido.
- [DevOps](https://fmcybersecurity.com/services/application-security.md): AppSec-programmer, SDLC-integrasjon og kontinuerlig sikkerhet.
- [Privilegert tilgang (PAM)](https://fmcybersecurity.com/services/pam.md): Privilegert tilgang på Idira (CyberArk): innlåsing, rotasjon, isolering og logging av privilegerte kontoer.
- [Maskinidentitet](https://fmcybersecurity.com/services/machine-identity.md): Maskin- og ikke-menneskelig identitet på Idira (CyberArk): secrets, sertifikater og workload-identiteter.
- [Secrets-håndtering](https://fmcybersecurity.com/services/secrets-management.md): Secrets-håndtering på Idira (CyberArk): credentials, API-nøkler og tokens ut av koden og inn i en kontrollert flyt.
- [AI-synlighet](https://fmcybersecurity.com/services/ai-visibility.md): AI-synlighet: oppdag hvert AI-verktøy, hver agent og hver modell i bruk, godkjent eller ikke, før du styrer det.
- [Prompt-beskyttelse](https://fmcybersecurity.com/services/prompt-protection.md): Prompt-beskyttelse: sikring mot prompt-injeksjon og datalekkasje i AI-verktøyene teamene dine allerede bruker.
- [AI-sikkerhet](https://fmcybersecurity.com/services/ai-security.md): AI-sikkerhet som fagområde: oppdag Shadow AI, beskytt prompt og agenter, og styr agentisk AI, levert på CrowdStrike Falcon AIDR.
- [Rådgivning](https://fmcybersecurity.com/services/consulting.md): Rådgivning som fagområde: vCISO, sikkerhetsarkitektur og navngitte seniorspesialister på oppdrag.
- [Sårbarhetshåndtering](https://fmcybersecurity.com/services/vulnerability-management.md): Sårbarhetshåndtering som fagområde: skanning, prioritering og oppfølging av utbedring på Tenable, med AI-pentest på Aikido.
- [Identitetssikkerhet](https://fmcybersecurity.com/services/identity.md): Identitet som fagområde: privilegert tilgang og maskinidentitet på Idira (CyberArk).
- [Compliance](https://fmcybersecurity.com/services/compliance.md): Compliance som fagområde: ISO 27001, NIS2, DORA og GDPR, ledet av sertifiserte Lead Implementers.

## Products

- [CrowdStrike](https://fmcybersecurity.com/en/products/crowdstrike.md): Certified partner; Falcon Complete Next-Gen MDR and Falcon AIDR as the core delivery model.
- [CrowdStrike](https://fmcybersecurity.com/products/crowdstrike.md): Sertifisert partner; Falcon Complete Next-Gen MDR og Falcon AIDR som kjerneleveranse.
- [Aikido](https://fmcybersecurity.com/en/products/aikido.md): Certified partner; AI Pentest as the delivery model for testing.
- [Aikido](https://fmcybersecurity.com/products/aikido.md): Sertifisert partner; AI Pentest som leveransemodell for testing.
- [Tenable](https://fmcybersecurity.com/en/products/tenable.md): Certified partner; exposure-management practice across cloud, endpoint and OT.
- [Tenable](https://fmcybersecurity.com/products/tenable.md): Sertifisert partner; sårbarhetshåndtering på tvers av sky, endepunkt og OT.
- [Idira (CyberArk)](https://fmcybersecurity.com/en/products/cyberark.md): Certified partner; PAM-focused identity practice.
- [Idira (CyberArk)](https://fmcybersecurity.com/products/cyberark.md): Sertifisert partner; PAM-fokusert identitetspraksis.

## Product modules

- [AI Pentest](https://fmcybersecurity.com/en/products/aikido/ai-pentest.md): AI Pentest uses autonomous AI agents to run continuous penetration testing and confirm real, exploitable risk.
- [API Scanning](https://fmcybersecurity.com/en/products/aikido/api-scanning.md): API Scanning discovers and tests REST and GraphQL APIs for security weaknesses.
- [Attack Surface Management](https://fmcybersecurity.com/en/products/aikido/attack-surface-management.md): Attack Surface Management discovers forgotten subdomains, exposed services, and unknown internet-facing assets, and tracks changes over time.
- [Bot Protection](https://fmcybersecurity.com/en/products/aikido/bot-protection.md): Bot Protection blocks malicious bots, scrapers, and brute-force traffic in real time.
- [Cloud Posture Management (CSPM)](https://fmcybersecurity.com/en/products/aikido/cloud-posture-management-cspm.md): Cloud Posture Management finds misconfigurations and compliance gaps across major cloud providers.
- [Container Image Scanning](https://fmcybersecurity.com/en/products/aikido/container-image-scanning.md): Container Image Scanning scans container images for vulnerable operating-system packages and libraries.
- [Device Protection](https://fmcybersecurity.com/en/products/aikido/device-protection.md): Device Protection monitors and blocks malicious browser extensions, IDE plugins, and risky code libraries on developer devices.
- [Infrastructure as Code (IaC)](https://fmcybersecurity.com/en/products/aikido/iac-scanning.md): Infrastructure as Code scanning checks Terraform, CloudFormation, Kubernetes, and Dockerfiles for misconfigurations before deploy.
- [Kubernetes Scanning](https://fmcybersecurity.com/en/products/aikido/kubernetes-scanning.md): Kubernetes Scanning checks clusters, manifests, and running images for misconfigurations and vulnerabilities.
- [Malware Detection](https://fmcybersecurity.com/en/products/aikido/malware-detection.md): Malware Detection continuously checks dependencies for malicious packages across registries such as npm and PyPI.
- [Open Source Dependencies (SCA)](https://fmcybersecurity.com/en/products/aikido/open-source-dependencies-sca.md): Open Source Dependencies checks open-source libraries for known vulnerabilities and supply-chain risk.
- [Open Source License Risk](https://fmcybersecurity.com/en/products/aikido/open-source-license-risk.md): Open Source License Risk flags risky open-source licenses and generates a software bill of materials (SBOM).
- [Outdated and EOL Software](https://fmcybersecurity.com/en/products/aikido/outdated-eol-software.md): Outdated and EOL Software flags unsupported frameworks, runtimes, and libraries that have reached end of life.
- [Secrets Detection](https://fmcybersecurity.com/en/products/aikido/secrets-detection.md): Secrets Detection finds leaked secrets such as API keys, passwords, and tokens in code and git history.
- [Static Code Analysis (SAST)](https://fmcybersecurity.com/en/products/aikido/static-code-analysis-sast.md): Static Code Analysis scans source code for security vulnerabilities before the code ships.
- [Surface Monitoring (DAST)](https://fmcybersecurity.com/en/products/aikido/surface-monitoring-dast.md): Surface Monitoring is dynamic testing that probes live web apps and APIs from the outside, the way an attacker would.
- [Virtual Machine Scanning](https://fmcybersecurity.com/en/products/aikido/virtual-machine-scanning.md): Virtual Machine Scanning checks virtual machines for vulnerable packages and outdated runtimes without an agent.
- [Zen (In-App Firewall)](https://fmcybersecurity.com/en/products/aikido/zen-in-app-firewall.md): Zen is an embedded in-app firewall that blocks attacks such as SQL injection and command injection at runtime.
- [Charlotte AI](https://fmcybersecurity.com/en/products/crowdstrike/charlotte-ai.md): Charlotte AI is a generative and agentic AI security analyst built into the Falcon platform.
- [Cloud Security](https://fmcybersecurity.com/en/products/crowdstrike/cloud-security.md): Cloud Security protects cloud workloads and infrastructure across AWS, Azure, and Google Cloud.
- [Data Protection](https://fmcybersecurity.com/en/products/crowdstrike/data-protection.md): Data Protection discovers, classifies, and stops data theft in real time.
- [Endpoint Security](https://fmcybersecurity.com/en/products/crowdstrike/endpoint-security.md): Endpoint Security protects workstations, servers, and mobile devices from a single lightweight Falcon agent.
- [Exposure Management](https://fmcybersecurity.com/en/products/crowdstrike/exposure-management.md): Exposure Management gives risk-based visibility across the attack surface from the Falcon agent.
- [Falcon AI Detection and Response](https://fmcybersecurity.com/en/products/crowdstrike/falcon-aidr.md): Falcon AI Detection and Response (Falcon AIDR) provides AI detection and response across endpoints and cloud.
- [Falcon Complete Next-Gen MDR (SOC)](https://fmcybersecurity.com/en/products/crowdstrike/falcon-complete-next-gen-mdr.md): CrowdStrike's flagship managed detection and response service, run around the clock by CrowdStrike experts.
- [Falcon for IT](https://fmcybersecurity.com/en/products/crowdstrike/falcon-for-it.md): Falcon for IT converges security and IT operations on the Falcon platform.
- [Frontier AI Readiness and Resilience Service](https://fmcybersecurity.com/en/products/crowdstrike/frontier-ai-readiness-and-resilience.md): A service that helps organizations prepare for AI-driven threats by finding and closing exploitable weaknesses faster.
- [Identity Protection](https://fmcybersecurity.com/en/products/crowdstrike/identity-protection.md): Identity Protection stops identity-based attacks across Active Directory and Entra ID.
- [Incident Response](https://fmcybersecurity.com/en/products/crowdstrike/incident-response.md): Rapid response to active breaches that contains the threat, investigates, and helps restore systems.
- [Next-Gen SIEM](https://fmcybersecurity.com/en/products/crowdstrike/next-gen-siem.md): Next-Gen SIEM is an AI-native security information and event management platform that modernizes the SOC.
- [Red Team Services](https://fmcybersecurity.com/en/products/crowdstrike/red-team-services.md): Realistic intrusion simulations that test detection and response readiness using real adversary tradecraft.
- [Strategic Advisory Services](https://fmcybersecurity.com/en/products/crowdstrike/strategic-advisory-services.md): Advisory work that aligns the security program with business risk and sets a clear roadmap for leadership.
- [Technical Advisory Services](https://fmcybersecurity.com/en/products/crowdstrike/technical-advisory-services.md): Hands-on technical assessments that harden the environment with concrete recommendations engineers can act on.
- [Threat Intelligence](https://fmcybersecurity.com/en/products/crowdstrike/threat-intelligence.md): Threat Intelligence delivers real-time intelligence on adversaries and the methods they use.
- [AI Agent Identities](https://fmcybersecurity.com/en/products/cyberark/agentic-identities.md): Identity security for autonomous AI agents.
- [Certificate Manager](https://fmcybersecurity.com/en/products/cyberark/certificate-manager.md): Certificate Manager automates the lifecycle of TLS and machine certificates, including discovery, issuance, renewal, and policy enforcement.
- [Code Sign Manager](https://fmcybersecurity.com/en/products/cyberark/code-sign-manager.md): Code Sign Manager secures code-signing keys and processes so developers can sign code under enterprise controls.
- [Endpoint Privilege Manager](https://fmcybersecurity.com/en/products/cyberark/endpoint-privilege-manager.md): Endpoint privilege management that removes excess local admin rights and controls which applications can run on each device.
- [Human Identities](https://fmcybersecurity.com/en/products/cyberark/human-identities.md): Identity security for the people in your organization, from everyday sign-in to the most privileged accounts.
- [Identity Governance](https://fmcybersecurity.com/en/products/cyberark/identity-governance.md): Modern identity governance and administration that manages lifecycles, access requests, and access reviews across applications.
- [Machine Identities](https://fmcybersecurity.com/en/products/cyberark/machine-identities.md): Identity security for the machines, secrets, certificates, keys, and workloads that run your business.
- [Privileged Access Manager](https://fmcybersecurity.com/en/products/cyberark/privileged-access-manager.md): Privileged access management that secures, rotates, and records the most powerful accounts across on-premises, cloud, and hybrid systems.
- [Secrets Hub](https://fmcybersecurity.com/en/products/cyberark/secrets-hub.md): Secrets Hub discovers and centrally manages secrets across cloud secret stores such as AWS Secrets Manager and Azure Key Vault.
- [Secrets Manager](https://fmcybersecurity.com/en/products/cyberark/secrets-manager.md): Secrets Manager stores, rotates, and controls the secrets and credentials that applications, scripts, and CI/CD pipelines use.
- [Secure AI Agents](https://fmcybersecurity.com/en/products/cyberark/secure-ai-agents.md): Secure AI Agents brings identity security to autonomous AI agents, with discovery, zero-standing-privilege access, threat detection, and lifecycle management.
- [Secure Browser](https://fmcybersecurity.com/en/products/cyberark/secure-browser.md): An identity-centric enterprise browser that adds security and control to how users reach web and SaaS applications.
- [Secure Cloud Access](https://fmcybersecurity.com/en/products/cyberark/secure-cloud-access.md): Just-in-time access to cloud consoles and command-line tools with zero standing privileges for developers and cloud administrators.
- [SSH Manager](https://fmcybersecurity.com/en/products/cyberark/ssh-manager.md): SSH Manager discovers and manages SSH keys across the organization to reduce unmanaged and risky keys.
- [Vendor PAM](https://fmcybersecurity.com/en/products/cyberark/vendor-pam.md): Secure, monitored privileged access for third-party vendors and external users, without VPNs, agents, or shared passwords.
- [Workforce Identity](https://fmcybersecurity.com/en/products/cyberark/workforce-identity.md): Identity and access management that gives employees secure, simple access to the business applications they use every day.
- [Workload Identity Manager](https://fmcybersecurity.com/en/products/cyberark/workload-identity-manager.md): Workload Identity Manager issues short-lived identities to cloud-native workloads using the open SPIFFE standard.
- [AI Exposure](https://fmcybersecurity.com/en/products/tenable/ai-exposure.md): AI Exposure secures how an organization uses AI by discovering AI platforms, finding AI-related risks, and helping govern that risk.
- [Attack Surface Management](https://fmcybersecurity.com/en/products/tenable/attack-surface-management.md): Attack Surface Management continuously discovers internet-facing assets and services so unknown exposure becomes visible.
- [Cloud Security](https://fmcybersecurity.com/en/products/tenable/cloud-security.md): Cloud Security protects cloud-native applications across AWS, Azure, and Google Cloud by finding misconfigurations, risky entitlements, and workload vulnerabilities.
- [Connectors](https://fmcybersecurity.com/en/products/tenable/connectors.md): Connectors bring data from third-party security and IT tools into Tenable One for one unified exposure view.
- [Hexa AI](https://fmcybersecurity.com/en/products/tenable/hexa-ai.md): Hexa AI is the agentic AI engine of Tenable One that orchestrates and automates security workflows and turns exposure data into action.
- [Identity Exposure](https://fmcybersecurity.com/en/products/tenable/identity-exposure.md): Identity Exposure finds risky misconfigurations and attack paths in Active Directory and Entra ID and helps close the paths attackers use for lateral movement.
- [OT Security](https://fmcybersecurity.com/en/products/tenable/ot-security.md): OT Security provides visibility and exposure management for operational technology and industrial control systems.
- [Continuous Patch Management](https://fmcybersecurity.com/en/products/tenable/patch-management.md): Tenable Patch Management delivers continuous patch management. Vulnerabilities are correlated with the right patch automatically, and fixes roll out on an ongoing basis under policy, instead of in monthly batches.
- [Vulnerability Management](https://fmcybersecurity.com/en/products/tenable/vulnerability-management.md): Vulnerability Management discovers and assesses vulnerabilities across IT assets and prioritizes them by risk so teams fix the most important issues first.
- [Web App Scanning](https://fmcybersecurity.com/en/products/tenable/web-app-scanning.md): Web App Scanning provides dynamic application security testing that automatically scans running web apps and APIs for vulnerabilities.
- [AI Pentest](https://fmcybersecurity.com/products/aikido/ai-pentest.md): AI Pentest bruker autonome AI-agenter til å kjøre kontinuerlig penetrasjonstesting og bekrefte reell, utnyttbar risiko.
- [API Scanning](https://fmcybersecurity.com/products/aikido/api-scanning.md): API Scanning oppdager og tester REST- og GraphQL-API-er for sikkerhetssvakheter.
- [Attack Surface Management](https://fmcybersecurity.com/products/aikido/attack-surface-management.md): Attack Surface Management oppdager glemte subdomener, eksponerte tjenester og ukjente internettvendte ressurser, og følger endringer over tid.
- [Bot Protection](https://fmcybersecurity.com/products/aikido/bot-protection.md): Bot Protection blokkerer ondsinnede boter, skrapere og brute-force-trafikk i sanntid.
- [Cloud Posture Management (CSPM)](https://fmcybersecurity.com/products/aikido/cloud-posture-management-cspm.md): Cloud Posture Management finner feilkonfigurasjoner og samsvarsavvik på tvers av de store skyleverandørene.
- [Container Image Scanning](https://fmcybersecurity.com/products/aikido/container-image-scanning.md): Container Image Scanning skanner container-images for sårbare operativsystempakker og biblioteker.
- [Device Protection](https://fmcybersecurity.com/products/aikido/device-protection.md): Device Protection overvåker og blokkerer ondsinnede nettleserutvidelser, IDE-plugins og risikable kodebiblioteker på utviklernes enheter.
- [Infrastructure as Code (IaC)](https://fmcybersecurity.com/products/aikido/iac-scanning.md): Infrastructure as Code-skanning sjekker Terraform, CloudFormation, Kubernetes og Dockerfiles for feilkonfigurasjon før deploy.
- [Kubernetes Scanning](https://fmcybersecurity.com/products/aikido/kubernetes-scanning.md): Kubernetes Scanning sjekker klynger, manifester og kjørende images for feilkonfigurasjoner og sårbarheter.
- [Malware Detection](https://fmcybersecurity.com/products/aikido/malware-detection.md): Malware Detection sjekker avhengigheter kontinuerlig for skadelige pakker på tvers av registre som npm og PyPI.
- [Open Source Dependencies (SCA)](https://fmcybersecurity.com/products/aikido/open-source-dependencies-sca.md): Open Source Dependencies sjekker open source-biblioteker for kjente sårbarheter og forsyningskjederisiko.
- [Open Source License Risk](https://fmcybersecurity.com/products/aikido/open-source-license-risk.md): Open Source License Risk flagger risikable open source-lisenser og genererer en software bill of materials (SBOM).
- [Outdated and EOL Software](https://fmcybersecurity.com/products/aikido/outdated-eol-software.md): Outdated and EOL Software flagger frameworks, runtimes og biblioteker uten støtte som har nådd end of life.
- [Secrets Detection](https://fmcybersecurity.com/products/aikido/secrets-detection.md): Secrets Detection finner lekkede hemmeligheter som API-nøkler, passord og tokens i kode og git-historikk.
- [Static Code Analysis (SAST)](https://fmcybersecurity.com/products/aikido/static-code-analysis-sast.md): Static Code Analysis skanner kildekode for sikkerhetssårbarheter før koden går i produksjon.
- [Surface Monitoring (DAST)](https://fmcybersecurity.com/products/aikido/surface-monitoring-dast.md): Surface Monitoring er dynamisk testing som undersøker live web-apper og API-er utenfra, slik en angriper ville gjort.
- [Virtual Machine Scanning](https://fmcybersecurity.com/products/aikido/virtual-machine-scanning.md): Virtual Machine Scanning sjekker virtuelle maskiner for sårbare pakker og utdaterte kjøretider uten agent.
- [Zen (In-App Firewall)](https://fmcybersecurity.com/products/aikido/zen-in-app-firewall.md): Zen er en innebygd in-app firewall som blokkerer angrep som SQL injection og command injection mens applikasjonen kjører.
- [Charlotte AI](https://fmcybersecurity.com/products/crowdstrike/charlotte-ai.md): Charlotte AI er en generativ og agentisk AI-sikkerhetsanalytiker bygget inn i Falcon-plattformen.
- [Cloud Security](https://fmcybersecurity.com/products/crowdstrike/cloud-security.md): Cloud Security beskytter skyarbeidslaster og infrastruktur på tvers av AWS, Azure og Google Cloud.
- [Data Protection](https://fmcybersecurity.com/products/crowdstrike/data-protection.md): Data Protection oppdager, klassifiserer og stopper datatyveri i sanntid.
- [Endpoint Security](https://fmcybersecurity.com/products/crowdstrike/endpoint-security.md): Endpoint Security beskytter arbeidsstasjoner, servere og mobile enheter fra en lett Falcon-agent.
- [Exposure Management](https://fmcybersecurity.com/products/crowdstrike/exposure-management.md): Exposure Management gir risikobasert innsikt på tvers av angrepsflaten fra Falcon-agenten.
- [Falcon AI Detection and Response](https://fmcybersecurity.com/products/crowdstrike/falcon-aidr.md): Falcon AI Detection and Response (Falcon AIDR) gir AI-deteksjon og -respons på tvers av endepunkter og sky.
- [Falcon Complete Next-Gen MDR (SOC)](https://fmcybersecurity.com/products/crowdstrike/falcon-complete-next-gen-mdr.md): CrowdStrikes flaggskip for administrert deteksjon og respons, levert døgnet rundt av CrowdStrikes eksperter.
- [Falcon for IT](https://fmcybersecurity.com/products/crowdstrike/falcon-for-it.md): Falcon for IT samler sikkerhet og IT-drift på Falcon-plattformen.
- [Frontier AI Readiness and Resilience Service](https://fmcybersecurity.com/products/crowdstrike/frontier-ai-readiness-and-resilience.md): En tjeneste som hjelper organisasjoner med å forberede seg på AI-drevne trusler ved å finne og lukke utnyttbare svakheter raskere.
- [Identity Protection](https://fmcybersecurity.com/products/crowdstrike/identity-protection.md): Identity Protection stopper identitetsbaserte angrep på tvers av Active Directory og Entra ID.
- [Incident Response](https://fmcybersecurity.com/products/crowdstrike/incident-response.md): Rask respons på aktive sikkerhetsbrudd som stanser trusselen, etterforsker og hjelper med å gjenopprette systemer.
- [Next-Gen SIEM](https://fmcybersecurity.com/products/crowdstrike/next-gen-siem.md): Next-Gen SIEM er en AI-native plattform for sikkerhetsinformasjon og hendelseshåndtering som moderniserer SOC-en.
- [Red Team Services](https://fmcybersecurity.com/products/crowdstrike/red-team-services.md): Realistiske angrepssimuleringer som tester deteksjons- og responsevne med ekte angrepsteknikker.
- [Strategic Advisory Services](https://fmcybersecurity.com/products/crowdstrike/strategic-advisory-services.md): Rådgivning som forankrer sikkerhetsarbeidet i forretningsrisiko og setter et tydelig veikart for ledelsen.
- [Technical Advisory Services](https://fmcybersecurity.com/products/crowdstrike/technical-advisory-services.md): Praktiske tekniske vurderinger som styrker miljøet med konkrete anbefalinger ingeniører kan handle ut fra.
- [Threat Intelligence](https://fmcybersecurity.com/products/crowdstrike/threat-intelligence.md): Threat Intelligence gir sanntidsinnsikt om angripere og metodene de bruker.
- [AI Agent Identities](https://fmcybersecurity.com/products/cyberark/agentic-identities.md): Identitetssikkerhet for autonome AI-agenter.
- [Certificate Manager](https://fmcybersecurity.com/products/cyberark/certificate-manager.md): Certificate Manager automatiserer livssyklusen til TLS- og maskinsertifikater, med oppdagelse, utstedelse, fornyelse og håndheving av policy.
- [Code Sign Manager](https://fmcybersecurity.com/products/cyberark/code-sign-manager.md): Code Sign Manager sikrer nøkler og prosesser for kodesignering, slik at utviklere kan signere kode under virksomhetens kontroller.
- [Endpoint Privilege Manager](https://fmcybersecurity.com/products/cyberark/endpoint-privilege-manager.md): Styring av endepunktsprivilegier som fjerner overflødige lokale admin-rettigheter og kontrollerer hvilke applikasjoner som kan kjøre på hver enhet.
- [Human Identities](https://fmcybersecurity.com/products/cyberark/human-identities.md): Identitetssikkerhet for menneskene i organisasjonen, fra daglig pålogging til de mest privilegerte kontoene.
- [Identity Governance](https://fmcybersecurity.com/products/cyberark/identity-governance.md): Moderne identitetsstyring og -administrasjon som håndterer livssykluser, tilgangsforespørsler og tilgangsgjennomganger på tvers av applikasjoner.
- [Machine Identities](https://fmcybersecurity.com/products/cyberark/machine-identities.md): Identitetssikkerhet for maskinene, secrets, sertifikater, nøkler og workloads som driver virksomheten.
- [Privileged Access Manager](https://fmcybersecurity.com/products/cyberark/privileged-access-manager.md): Styring av privilegert tilgang som sikrer, roterer og logger de kraftigste kontoene på tvers av lokale, sky- og hybride systemer.
- [Secrets Hub](https://fmcybersecurity.com/products/cyberark/secrets-hub.md): Secrets Hub oppdager og styrer hemmeligheter sentralt på tvers av skyhvelv som AWS Secrets Manager og Azure Key Vault.
- [Secrets Manager](https://fmcybersecurity.com/products/cyberark/secrets-manager.md): Secrets Manager lagrer, roterer og styrer hemmeligheter og legitimasjon som applikasjoner, skript og CI/CD-løp bruker.
- [Secure AI Agents](https://fmcybersecurity.com/products/cyberark/secure-ai-agents.md): Secure AI Agents gir identitetssikkerhet til autonome AI-agenter, med oppdagelse, tilgang uten stående privilegier, trusseldeteksjon og livssyklusstyring.
- [Secure Browser](https://fmcybersecurity.com/products/cyberark/secure-browser.md): En identitetssentrert bedriftsnettleser som gir mer sikkerhet og kontroll over hvordan brukere når web- og SaaS-applikasjoner.
- [Secure Cloud Access](https://fmcybersecurity.com/products/cyberark/secure-cloud-access.md): Just-in-time-tilgang til skykonsoller og kommandolinjeverktøy uten faste privilegier for utviklere og skyadministratorer.
- [SSH Manager](https://fmcybersecurity.com/products/cyberark/ssh-manager.md): SSH Manager oppdager og styrer SSH-nøkler i hele virksomheten for å redusere ustyrte og risikable nøkler.
- [Vendor PAM](https://fmcybersecurity.com/products/cyberark/vendor-pam.md): Sikker og overvåket privilegert tilgang for tredjepartsleverandører og eksterne brukere, uten VPN, agenter eller delte passord.
- [Workforce Identity](https://fmcybersecurity.com/products/cyberark/workforce-identity.md): Identitets- og tilgangsstyring som gir ansatte trygg og enkel tilgang til forretningsapplikasjonene de bruker hver dag.
- [Workload Identity Manager](https://fmcybersecurity.com/products/cyberark/workload-identity-manager.md): Workload Identity Manager utsteder kortlevde identiteter til skybaserte arbeidslaster med den åpne SPIFFE-standarden.
- [AI Exposure](https://fmcybersecurity.com/products/tenable/ai-exposure.md): AI Exposure sikrer hvordan en organisasjon bruker AI ved å oppdage AI-plattformer, finne AI-relatert risiko og hjelpe med å styre den risikoen.
- [Attack Surface Management](https://fmcybersecurity.com/products/tenable/attack-surface-management.md): Attack Surface Management oppdager løpende internettvendte enheter og tjenester slik at ukjente sårbarheter blir synlige.
- [Cloud Security](https://fmcybersecurity.com/products/tenable/cloud-security.md): Cloud Security beskytter skybaserte applikasjoner på tvers av AWS, Azure og Google Cloud ved å finne feilkonfigurasjoner, risikable tilganger og sårbarheter i arbeidslaster.
- [Connectors](https://fmcybersecurity.com/products/tenable/connectors.md): Connectors henter data fra tredjeparts sikkerhets- og IT-verktøy inn i Tenable One for ett samlet sårbarhetsbilde.
- [Hexa AI](https://fmcybersecurity.com/products/tenable/hexa-ai.md): Hexa AI er den agentiske AI-motoren i Tenable One som orkestrerer og automatiserer sikkerhetsarbeidsflyter og gjør sårbarhetsdata om til handling.
- [Identity Exposure](https://fmcybersecurity.com/products/tenable/identity-exposure.md): Identity Exposure finner risikable feilkonfigurasjoner og angrepsveier i Active Directory og Entra ID og hjelper med å lukke veiene angripere bruker til sideveis bevegelse.
- [OT Security](https://fmcybersecurity.com/products/tenable/ot-security.md): OT Security gir innsikt og sårbarhetshåndtering for operasjonell teknologi og industrielle styringssystemer.
- [Continuous Patch Management](https://fmcybersecurity.com/products/tenable/patch-management.md): Tenable Patch Management gir kontinuerlig patch management. Sårbarheter kobles automatisk til riktig oppdatering, og rettelsene rulles ut løpende etter policy, i stedet for i månedlige skippertak.
- [Vulnerability Management](https://fmcybersecurity.com/products/tenable/vulnerability-management.md): Vulnerability Management oppdager og vurderer sårbarheter på tvers av IT-enheter og prioriterer dem etter risiko slik at team retter de viktigste først.
- [Web App Scanning](https://fmcybersecurity.com/products/tenable/web-app-scanning.md): Web App Scanning gir dynamisk applikasjonssikkerhetstesting som automatisk skanner kjørende webapplikasjoner og API-er for sårbarheter.

## Partners

- [CrowdStrike partner page](https://fmcybersecurity.com/en/partners/crowdstrike.md): Certified partner; Falcon Complete Next-Gen MDR and Falcon AIDR as the core delivery model.
- [CrowdStrike partnerside](https://fmcybersecurity.com/partners/crowdstrike.md): Sertifisert partner; Falcon Complete Next-Gen MDR og Falcon AIDR som kjerneleveranse.
- [Aikido partner page](https://fmcybersecurity.com/en/partners/aikido.md): Certified partner; AI Pentest as the delivery model for testing.
- [Aikido partnerside](https://fmcybersecurity.com/partners/aikido.md): Sertifisert partner; AI Pentest som leveransemodell for testing.
- [Tenable partner page](https://fmcybersecurity.com/en/partners/tenable.md): Certified partner; exposure-management practice across cloud, endpoint and OT.
- [Tenable partnerside](https://fmcybersecurity.com/partners/tenable.md): Sertifisert partner; sårbarhetshåndtering på tvers av sky, endepunkt og OT.
- [Idira (CyberArk) partner page](https://fmcybersecurity.com/en/partners/cyberark.md): Certified partner; PAM-focused identity practice.
- [Idira (CyberArk) partnerside](https://fmcybersecurity.com/partners/cyberark.md): Sertifisert partner; PAM-fokusert identitetspraksis.

## Insight indexes

- [Insights](https://fmcybersecurity.com/en/insights.md): Strategic perspective, operational guides, and webinars from the FM CyberSecurity team.
- [Innsikt](https://fmcybersecurity.com/insights.md): Strategisk perspektiv, operative guider og webinarer fra FM CyberSecurity-teamet.
- [All articles](https://fmcybersecurity.com/en/insights/all.md): The full archive of articles, guides, news, reports, and press mentions from FM CyberSecurity.
- [Alle artikler](https://fmcybersecurity.com/insights/all.md): Hele arkivet med artikler, guider, nyheter, rapporter og presseomtaler fra FM CyberSecurity.
- [News](https://fmcybersecurity.com/en/insights/news.md): Latest news and announcements from FM CyberSecurity.
- [Nyheter](https://fmcybersecurity.com/insights/news.md): Siste nytt og oppdateringer fra FM CyberSecurity.
- [Events](https://fmcybersecurity.com/en/insights/events.md): Upcoming and past events, webinars, and live sessions.
- [Arrangementer](https://fmcybersecurity.com/insights/events.md): Kommende og tidligere arrangementer, webinarer og live-sesjoner.
- [Tracked attacks](https://fmcybersecurity.com/en/insights/attacks.md): Cybersecurity incidents affecting Norwegian organisations, with sourced summaries.
- [Registrerte angrep](https://fmcybersecurity.com/insights/attacks.md): Cyberhendelser mot norske organisasjoner med kildebaserte sammendrag.
- [AI hacking](https://fmcybersecurity.com/en/insights/ai-hacking.md): Confirmed incidents where an AI model ran the attack itself, with sourced summaries.
- [KI-hacking](https://fmcybersecurity.com/insights/ai-hacking.md): Bekreftede hendelser der en KI-modell kjørte selve angrepet, med kildebaserte sammendrag.
- [Press](https://fmcybersecurity.com/en/insights/press.md): FM CyberSecurity and our consultants in the press: op-eds, interviews, and founder profiles in Norwegian media.
- [Presse](https://fmcybersecurity.com/insights/press.md): FM CyberSecurity og våre konsulenter i mediene: kronikker, intervjuer og gründerprofiler i norske medier.
- [Cyber Dictionary](https://fmcybersecurity.com/en/insights/dictionary.md): A reference for the terms, acronyms, and frameworks we use every day in security work, from MDR to NIS2.
- [Cyberordbok](https://fmcybersecurity.com/insights/dictionary.md): En oppslagsbok over begreper, akronymer og rammeverk vi bruker daglig i sikkerhetsarbeidet, fra MDR til NIS2.
- [Patch Tuesday](https://fmcybersecurity.com/en/insights/series/patch-tuesday.md): Monthly analysis of Microsoft's security updates: what to patch first and why.
- [Patch Tuesday](https://fmcybersecurity.com/insights/series/patch-tuesday.md): Månedlig gjennomgang av Microsofts sikkerhetsoppdateringer: hva som må patches først og hvorfor.
- [Vulnerability News](https://fmcybersecurity.com/en/insights/vulnerabilities.md): Short, curated security news: new vulnerabilities, exploited zero days, and patches across the products Nordic organisations run.
- [Sårbarhetsnyheter](https://fmcybersecurity.com/insights/vulnerabilities.md): Korte, kuraterte sikkerhetsnyheter: nye sårbarheter, utnyttede nulldager og patcher for produktene nordiske virksomheter bruker.
- [Browse insights by topic](https://fmcybersecurity.com/en/insights/topics.md): Pick a topic to see every article, guide, and update from the FM CyberSecurity team in that area.
- [Bla i innsikter etter tema](https://fmcybersecurity.com/insights/topics.md): Velg et tema for å se alle artikler, guider og oppdateringer fra FM CyberSecurity-teamet på det området.
- [Strategy](https://fmcybersecurity.com/en/insights/strategy.md): Articles, guides and news on Strategy.
- [Strategi](https://fmcybersecurity.com/insights/strategy.md): Artikler, guider og nyheter om Strategi.
- [Compliance](https://fmcybersecurity.com/en/insights/compliance.md): Articles, guides and news on Compliance.
- [Compliance](https://fmcybersecurity.com/insights/compliance.md): Artikler, guider og nyheter om Compliance.
- [Endpoint Security](https://fmcybersecurity.com/en/insights/endpoint.md): Articles, guides and news on Endpoint Security.
- [Endepunktssikkerhet](https://fmcybersecurity.com/insights/endpoint.md): Artikler, guider og nyheter om Endepunktssikkerhet.
- [Identity Security](https://fmcybersecurity.com/en/insights/identity.md): Articles, guides and news on Identity Security.
- [Identitetssikkerhet](https://fmcybersecurity.com/insights/identity.md): Artikler, guider og nyheter om Identitetssikkerhet.
- [Cloud Security](https://fmcybersecurity.com/en/insights/cloud.md): Articles, guides and news on Cloud Security.
- [Skysikkerhet](https://fmcybersecurity.com/insights/cloud.md): Artikler, guider og nyheter om Skysikkerhet.
- [Exposure Management](https://fmcybersecurity.com/en/insights/exposure.md): Articles, guides and news on Exposure Management.
- [Sårbarhetshåndtering](https://fmcybersecurity.com/insights/exposure.md): Artikler, guider og nyheter om Sårbarhetshåndtering.
- [Application Security](https://fmcybersecurity.com/en/insights/appsec.md): Articles, guides and news on Application Security.
- [Applikasjonssikkerhet](https://fmcybersecurity.com/insights/appsec.md): Artikler, guider og nyheter om Applikasjonssikkerhet.
- [AI Security](https://fmcybersecurity.com/en/insights/ai-security.md): Articles, guides and news on AI Security.
- [AI-sikkerhet](https://fmcybersecurity.com/insights/ai-security.md): Artikler, guider og nyheter om AI-sikkerhet.
- [Industry](https://fmcybersecurity.com/en/insights/industry.md): Articles, guides and news on Industry.
- [Bransje](https://fmcybersecurity.com/insights/industry.md): Artikler, guider og nyheter om Bransje.
- [ServiceNow vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/servicenow.md): Curated vulnerability news about ServiceNow from FM CyberSecurity.
- [Sårbarhetsnyheter om ServiceNow](https://fmcybersecurity.com/insights/vulnerabilities/servicenow.md): Kuraterte sårbarhetsnyheter om ServiceNow fra FM CyberSecurity.
- [Microsoft vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/microsoft.md): Curated vulnerability news about Microsoft from FM CyberSecurity.
- [Sårbarhetsnyheter om Microsoft](https://fmcybersecurity.com/insights/vulnerabilities/microsoft.md): Kuraterte sårbarhetsnyheter om Microsoft fra FM CyberSecurity.
- [Windows vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/windows.md): Curated vulnerability news about Windows from FM CyberSecurity.
- [Sårbarhetsnyheter om Windows](https://fmcybersecurity.com/insights/vulnerabilities/windows.md): Kuraterte sårbarhetsnyheter om Windows fra FM CyberSecurity.
- [Apple vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/apple.md): Curated vulnerability news about Apple from FM CyberSecurity.
- [Sårbarhetsnyheter om Apple](https://fmcybersecurity.com/insights/vulnerabilities/apple.md): Kuraterte sårbarhetsnyheter om Apple fra FM CyberSecurity.
- [Google vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/google.md): Curated vulnerability news about Google from FM CyberSecurity.
- [Sårbarhetsnyheter om Google](https://fmcybersecurity.com/insights/vulnerabilities/google.md): Kuraterte sårbarhetsnyheter om Google fra FM CyberSecurity.
- [Firefox vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/firefox.md): Curated vulnerability news about Firefox from FM CyberSecurity.
- [Sårbarhetsnyheter om Firefox](https://fmcybersecurity.com/insights/vulnerabilities/firefox.md): Kuraterte sårbarhetsnyheter om Firefox fra FM CyberSecurity.
- [npm vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/npm.md): Curated vulnerability news about npm from FM CyberSecurity.
- [Sårbarhetsnyheter om npm](https://fmcybersecurity.com/insights/vulnerabilities/npm.md): Kuraterte sårbarhetsnyheter om npm fra FM CyberSecurity.
- [GitHub vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/github.md): Curated vulnerability news about GitHub from FM CyberSecurity.
- [Sårbarhetsnyheter om GitHub](https://fmcybersecurity.com/insights/vulnerabilities/github.md): Kuraterte sårbarhetsnyheter om GitHub fra FM CyberSecurity.
- [Ivanti vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/ivanti.md): Curated vulnerability news about Ivanti from FM CyberSecurity.
- [Sårbarhetsnyheter om Ivanti](https://fmcybersecurity.com/insights/vulnerabilities/ivanti.md): Kuraterte sårbarhetsnyheter om Ivanti fra FM CyberSecurity.
- [Aikido vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/aikido.md): Curated vulnerability news about Aikido from FM CyberSecurity.
- [Sårbarhetsnyheter om Aikido](https://fmcybersecurity.com/insights/vulnerabilities/aikido.md): Kuraterte sårbarhetsnyheter om Aikido fra FM CyberSecurity.
- [CrowdStrike vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/crowdstrike.md): Curated vulnerability news about CrowdStrike from FM CyberSecurity.
- [Sårbarhetsnyheter om CrowdStrike](https://fmcybersecurity.com/insights/vulnerabilities/crowdstrike.md): Kuraterte sårbarhetsnyheter om CrowdStrike fra FM CyberSecurity.
- [Tenable vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/tenable.md): Curated vulnerability news about Tenable from FM CyberSecurity.
- [Sårbarhetsnyheter om Tenable](https://fmcybersecurity.com/insights/vulnerabilities/tenable.md): Kuraterte sårbarhetsnyheter om Tenable fra FM CyberSecurity.
- [Claude vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/claude.md): Curated vulnerability news about Claude from FM CyberSecurity.
- [Sårbarhetsnyheter om Claude](https://fmcybersecurity.com/insights/vulnerabilities/claude.md): Kuraterte sårbarhetsnyheter om Claude fra FM CyberSecurity.
- [AI vulnerability news](https://fmcybersecurity.com/en/insights/vulnerabilities/ai.md): Curated vulnerability news about AI from FM CyberSecurity.
- [Sårbarhetsnyheter om AI](https://fmcybersecurity.com/insights/vulnerabilities/ai.md): Kuraterte sårbarhetsnyheter om AI fra FM CyberSecurity.

## Insight articles (English)

- [CrowdStrike: Safe AI answers can become parts of an attack](https://fmcybersecurity.com/en/insights/ai-security/crowdstrike-ai-safety-checks-miss-combined-attacks.md): A safety decision about one question does not necessarily account for the workflow its answer becomes part of.
- [Irregular tests the boundaries around AI hacking evaluations](https://fmcybersecurity.com/en/insights/ai-security/irregular-ai-agent-containment-tests.md): Hacking capability and permission to reach other systems are different questions. A new research update explains how containment tests examine the second.
- [ISO 27001 vs NIS2: what each one is, and how they differ](https://fmcybersecurity.com/en/insights/compliance/iso-27001-vs-nis2-what-is-the-difference.md): ISO 27001 is a voluntary standard you can be certified against. NIS2 is EU law with mandatory duties, reporting clocks and fines. They overlap in content, not in consequence.
- [An AI policy does not decide which files an assistant can read](https://fmcybersecurity.com/en/insights/ai-security/delinea-ai-policy-data-access-gap.md): Delinea's new survey highlights the difference between an assistant's approved task and its actual access to company data.
- [When an AI data search turns into an attack attempt](https://fmcybersecurity.com/en/insights/ai-security/transluce-ai-agents-data-search-hacking-attempts.md): New research examines what agents did when ordinary data retrieval failed.
- [KnowBe4 test: an AI-generated email draft leaked a login code](https://fmcybersecurity.com/en/insights/ai-security/knowbe4-email-ai-draft-prompt-injection.md): A lab test shows why an email assistant's model and its surrounding automation must be understood together. The results differed between Gmail's sidebar and a custom workflow.
- [RatHat: how AI helps malware navigate an Android phone](https://fmcybersecurity.com/en/insights/ai-security/rathat-ai-navigates-infected-android-phones.md): Zimperium describes Android malware that asks an AI assistant where to tap and scroll. The model helps navigate a phone the malware has already compromised.
- [Plugin4Shell: when an approved AI plugin installs different code](https://fmcybersecurity.com/en/insights/ai-security/plugin4shell-ai-coding-agent-plugin-verification.md): Plugin4Shell exposed a gap between approving an AI coding plugin and checking the code delivered. A published Codex fix explains the missing verification.
- [How Claude helped researchers reach OpenAI accounts through a forum](https://fmcybersecurity.com/en/insights/ai-security/claude-assisted-openai-forum-account-takeover.md): Hacktron describes Claude-assisted research linking a forum image-upload flaw to OpenAI account access. Here is how the chain worked.
- [CrowdStrike links PhantomRaven malware to likely AI-written code](https://fmcybersecurity.com/en/insights/ai-security/crowdstrike-phantomraven-ai-malware.md): CrowdStrike's new PhantomRaven report connects likely AI-written malware, npm packages and bug bounty activity. Here is what the findings establish.
- [CrowdStrike uses AI on the PC to recognise sensitive information](https://fmcybersecurity.com/en/insights/ai-security/crowdstrike-on-device-ai-data-classification.md): Falcon Data Security aims to recognise confidential information in ordinary text. Here is how classification on the PC works.
- [What is CrowdStrike Agentic Identity Provider?](https://fmcybersecurity.com/en/insights/ai-security/what-is-crowdstrike-agentic-identity-provider.md): Agentic IdP gives AI agents verifiable identities and connects their access to the person or system behind them. Here is how it relates to Guardian and Continuous Identity.
- [What is CrowdStrike SafeMind?](https://fmcybersecurity.com/en/insights/ai-security/what-is-crowdstrike-safemind.md): SafeMind combines offensive and defensive AI models with software that runs security tasks. Here is how Red Tempest, Blue Solano and the testing loop fit together.
- [What is CrowdStrike Falcon Guardian?](https://fmcybersecurity.com/en/insights/ai-security/what-is-falcon-guardian.md): All 14 capabilities in CrowdStrike's AIDR-to-Guardian comparison explained, from shadow AI discovery to agent controls, investigations and cost analytics.
- [An image should not be allowed to rewrite your AI agent](https://fmcybersecurity.com/en/insights/ai-security/visual-prompt-injection-agent-configuration.md): Visual prompt-injection research exposes a practical boundary: an agent reading customer images should not be able to change its own operating instructions.
- [News from Fal.Con Las Vegas: Guardian, SafeMind and Agentic IdP](https://fmcybersecurity.com/en/insights/ai-security/crowdstrike-september-2026-falcon-ai-security-news.md): CrowdStrike's Fal.Con 2026 announcements connect AI activity, agent identities and AI-powered defence. Here is what Guardian, SafeMind and Agentic IdP each add.
- [Falcon Guardian: putting limits on what AI agents can do](https://fmcybersecurity.com/en/insights/ai-security/falcon-guardian-ai-agent-security.md): CrowdStrike is extending AI security into agent activity. Here is what Guardian adds and what we would check before a rollout.
- [Researchers link May's RubyGems abuse to OpenAI agents](https://fmcybersecurity.com/en/insights/ai-security/openai-agents-rubygems-rubydoc-rce.md): RubyGems removed more than 500 malicious packages in May. New research attributes the campaign to AI agents and highlights risks in automated documentation builds.
- [Anthropic's threat report shows several levels of attacker autonomy](https://fmcybersecurity.com/en/insights/ai-security/anthropic-report-five-groups-ran-ai-agents-on-real-targets.md): The September report describes AI-assisted intrusions with varying human involvement. The response should focus on access and observable behaviour.
- [Google reports a credential-harvesting campaign built in under six hours](https://fmcybersecurity.com/en/insights/ai-security/ai-agents-six-hour-credential-harvest.md): An agent-assisted campaign moved from planning to credential theft in hours. Check how quickly your cloud response can contain unauthorised activity.
- [A ChatGPT isolation flaw exposed the risk of connected data](https://fmcybersecurity.com/en/insights/ai-security/chatgpt-shared-clipboard-data-leak.md): Check Point demonstrated a cross-account channel combined with prompt injection. The channel was closed, but connector permissions still deserve review.
- [AI agents used a dormant wiki to coordinate outside their tasks](https://fmcybersecurity.com/en/insights/ai-security/openai-agents-abandoned-wiki-coordination.md): Researchers reconstructed about 18,000 agent posts on DSEwiki. The findings raise practical questions about writable websites and agent network controls.
- [GuardBreaker: a refused analysis is not a clean verdict](https://fmcybersecurity.com/en/insights/ai-security/guardbreaker-malware-prompt-blocks-ai-analysis.md): ESET describes malware comments intended to derail AI-assisted analysis. Your pipeline needs an explicit path for incomplete or refused results.
- [Aurora reporting puts AI coding agents inside the intrusion workflow](https://fmcybersecurity.com/en/insights/ai-security/aurora-ransomware-cursor-agent.md): Researchers describe an Aurora operator using Cursor during attacks. Focus on the actions and access, rather than treating the tool's name as a verdict.
- [The AI cyber-defense pledge needs a practical follow-through](https://fmcybersecurity.com/en/insights/ai-security/ai-cyber-defense-pledge.md): The industry calls for faster cyber defense. For business leaders, the next step is to turn that commitment into funded, accountable work.
- [OpenAI's Hugging Face report exposes gaps in agent isolation](https://fmcybersecurity.com/en/insights/ai-security/openai-report-ai-agent-swarm-hugging-face.md): OpenAI's investigation describes unauthorised agent communication and uneven safeguards. Shared storage and test environments need explicit security boundaries.
- [A booking task led an AI agent past the application's limits](https://fmcybersecurity.com/en/insights/ai-security/ai-agents-exploit-web-bugs-without-being-asked.md): Aikido's lab recreation shows an agent bypassing a booking restriction. The result is a reminder to enforce permissions on the server.
- [What Unit 42's AI-malware numbers do—and do not—show](https://fmcybersecurity.com/en/insights/ai-security/ai-malware-97-percent-never-left-the-sandbox.md): Only 12 of 405 samples appeared in Unit 42's endpoint dataset. That is useful evidence, but not a measure of every AI-assisted attack.
- [AI-assisted scripts target Siemens controllers: check the access paths](https://fmcybersecurity.com/en/insights/ai-security/ai-exploit-scripts-siemens-plcs.md): An NSA-led advisory describes reconnaissance against Siemens PLCs. Review exposure and remote access with the people responsible for the process.
- [Encrypted prompts show why an agent must remember where data came from](https://fmcybersecurity.com/en/insights/ai-security/grok-zero-click-encrypted-prompt-injection.md): Adversa demonstrated a Grok attack using encrypted webpage content. Transforming external data must not turn it into trusted instructions.
- [OpenAI paused frontier training while strengthening cyber safeguards](https://fmcybersecurity.com/en/insights/ai-security/openai-paused-frontier-training-over-critical-cyber-risk.md): OpenAI reported a training pause and stricter controls after signs of critical cyber capability. The announcement also makes the cost of agent oversight visible.
- [Agent memory needs protection from untrusted instructions](https://fmcybersecurity.com/en/insights/ai-security/ai-mind-viruses-spread-through-agent-memory-files.md): A preprint shows instructions propagating between agents. Its warning-prompt result is promising, but should not replace access controls.
- [GPT-5.6-Cyber expands access to advanced security research](https://fmcybersecurity.com/en/insights/ai-security/openai-gpt-5-6-cyber-model-writes-exploits.md): OpenAI's cyber model responds to more advanced security requests. Its 95 percent completion figure measures refusals, not a universal exploit success rate.
- [Dream reports an AI-agent campaign against government systems](https://fmcybersecurity.com/en/insights/ai-security/ai-agents-breached-taiwan-government.md): Dream's research describes a four-day intrusion using AI agents. The findings show why weak authentication and exposed APIs still matter.
- [Encrypted AI traces can still contain sensitive information](https://fmcybersecurity.com/en/insights/ai-security/ai-reasoning-traces-leaked-secrets.md): Researchers recovered sensitive data from published reasoning blocks. Treat agent traces as potentially confidential before sharing them.
- [Shai-Hulud brings editor configuration into the supply-chain review](https://fmcybersecurity.com/en/insights/ai-security/shai-hulud-npm-worm-spreads-through-ai-coding-tools.md): JFrog describes malicious hooks and editor tasks in the August campaign. Review executable project settings as well as package dependencies.
- [Ghostjacking: a blocked request can still reach an AI agent](https://fmcybersecurity.com/en/insights/ai-security/ghostjacking-poisoned-logs-hijack-ai-agents.md): Tenet's research shows how attacker-controlled log content can steer an agent. Reading an event should not give that event authority to change systems.
- [How long does ISO 27001 take?](https://fmcybersecurity.com/en/insights/compliance/how-long-does-iso-27001-take.md): The ISO 27001 timeline depends on your starting point, the controls you need to implement and the certification body's audit schedule.
- [Where AI can help with ISO 27001 preparation](https://fmcybersecurity.com/en/insights/compliance/how-we-use-ai-to-get-smbs-certification-ready.md): AI can help draft policies and organise evidence. People still need to make risk decisions, implement controls and verify that the records describe reality.
- [ISO 27001 or NIS2 first?](https://fmcybersecurity.com/en/insights/compliance/iso-27001-or-nis2-first.md): Build shared security processes, but track legal duties and certification separately. Applicable legal deadlines take priority over commercial preferences.
- [What ISO 27001 costs, and what drives the price](https://fmcybersecurity.com/en/insights/compliance/what-iso-27001-costs-and-what-drives-the-price.md): Compare ISO 27001 proposals on implementation, internal time, tools, audit fees and ongoing maintenance. Scope matters more than an unsupported headline price.
- [Your customer requires ISO 27001. What do you do now?](https://fmcybersecurity.com/en/insights/compliance/your-customer-requires-iso-27001-what-now.md): Clarify the certificate scope, deadline and acceptable evidence before promising a date. Then assess the gaps and agree a credible plan.
- [ISO 27001 work as part of a security subscription](https://fmcybersecurity.com/en/insights/strategy/iso-27001-as-a-subscription.md): Secured by FM CyberSecurity combines security operations, advice and ISO 27001 preparation. Here is what to clarify when buying that work as a subscription.
- [AI hacking: When AI models hack on their own](https://fmcybersecurity.com/en/insights/ai-security/prepare-for-ai-driven-hacking.md): AI agents breached Hugging Face during a security evaluation. What does it mean for a model to find weaknesses and act on its own?
- [CyberArk is now Idira: what to check after the name change](https://fmcybersecurity.com/en/insights/identity/cyberark-is-now-idira.md): Palo Alto Networks introduced Idira in May 2026. Here is how to navigate the new name, existing CyberArk documentation and licence questions.
- [How to start a privileged access management programme](https://fmcybersecurity.com/en/insights/identity/how-to-start-a-pam-programme.md): Start with account ownership and high-impact access. Plan credential rotation, emergency access and ongoing operation before expanding the rollout.
- [What to check in a next-generation SIEM proposal](https://fmcybersecurity.com/en/insights/endpoint/what-next-gen-siem-is.md): The next-gen label does not define one architecture or price model. Evaluate source coverage, detection, search, retention and the work behind the service.
- [DORA testing: the annual programme and threat-led penetration tests](https://fmcybersecurity.com/en/insights/compliance/dora-and-recurring-penetration-testing.md): DORA distinguishes general resilience testing from designated TLPT. Choose methods against risk, document coverage and verify remediation.
- [What the Idira EPM agent control panel does](https://fmcybersecurity.com/en/insights/identity/what-the-idira-epm-agent-control-panel-is.md): The EPM control panel gives Windows users access to administrative tasks enabled by IT policy. It is separate from both Windows Control Panel and the admin console.
- [Tenable One versus Vulnerability Management: module or broader package?](https://fmcybersecurity.com/en/insights/exposure/tenable-one-vs-tenable-vulnerability-management.md): Tenable's vulnerability service is available separately and within the wider platform. Compare the extra coverage and operating work before choosing a package.
- [Choosing tools for DORA work](https://fmcybersecurity.com/en/insights/compliance/tooling-for-dora-compliance.md): Software can organise registers, evidence and technical findings. Choose it around the decisions, data and responsibilities in your DORA programme.
- [Incident response: preparation, containment and reporting in Norway](https://fmcybersecurity.com/en/insights/endpoint/what-incident-response-is-and-how-to-run-it.md): A response plan should identify who can act, how evidence is preserved and which notifications apply. The first decisions depend on the incident, not a fixed script.
- [Is Aikido a CSPM? What its cloud module covers](https://fmcybersecurity.com/en/insights/cloud/is-aikido-a-cspm.md): Aikido includes cloud posture checks. Assess its configuration coverage, permissions and reporting against the cloud risks you need to manage.
- [DORA reporting and audit: keep the obligations separate](https://fmcybersecurity.com/en/insights/compliance/dora-audit-and-reporting-requirements.md): The ICT agreement register, planned-contract notices, incident reports and internal audit have different purposes. Assign owners and use the current submission rules.
- [Anthropic's evaluation incidents show why isolation must be verified](https://fmcybersecurity.com/en/insights/ai-security/claude-models-breached-three-companies-in-cyber-evals.md): Three incidents reached real systems from an evaluation setup with unintended internet access. A prompt describing a sandbox cannot enforce its boundaries.
- [Data breaches and ransomware: different consequences, connected response](https://fmcybersecurity.com/en/insights/endpoint/data-breaches-and-ransomware-in-norway.md): Ransomware can affect availability, confidentiality and recovery. Norwegian businesses need to assess operational harm and personal-data obligations together.
- [What vulnerability scanning finds and how to use the results](https://fmcybersecurity.com/en/insights/exposure/what-vulnerability-scanning-is.md): A useful scan needs authorised scope, reliable collection and follow-up. Understand the difference between missing findings and missing coverage.
- [DORA continuity planning: functions, recovery and exercises](https://fmcybersecurity.com/en/insights/compliance/dora-continuity-and-response-plans.md): Continuity plans should follow the services the firm must sustain. Map dependencies, set recovery objectives and exercise the decisions as well as the technology.
- [Endpoint privilege management: fewer admin rights, with a workable exception process](https://fmcybersecurity.com/en/insights/identity/what-endpoint-privilege-management-is.md): EPM lets users work without permanent local administrator rights. Successful deployment needs precise rules, an approval process and support for legitimate tasks.
- [OpenAI agents breached Hugging Face during a cybersecurity evaluation](https://fmcybersecurity.com/en/insights/ai-security/openai-agent-escaped-sandbox-and-breached-hugging-face.md): Agents left the intended boundaries of an OpenAI evaluation and compromised Hugging Face. The incident puts shared infrastructure and agent permissions in focus.
- [FM Cyber Breakfast: CrowdStrike](https://fmcybersecurity.com/en/insights/ai-security/fm-cyber-breakfast-crowdstrike-2026-08.md): Event listing for 20 August 2026: AI use, prompt injection and AI Detection & Response with CrowdStrike at MESH Youngstorget, Oslo.
- [The Cyber Resilience Act: reporting has started](https://fmcybersecurity.com/en/insights/compliance/what-the-eu-cyber-resilience-act-is.md): CRA manufacturer reporting began on 11 September 2026. The main product requirements follow in December 2027. Check product scope and your role now.
- [What CISSP certification means when picking a cybersecurity consultant](https://fmcybersecurity.com/en/insights/strategy/what-cissp-means-when-picking-a-consultant.md): CISSP is a broad security credential with experience requirements. Verify it, then assess the person's fit for your specific systems and assignment.
- [What an ISO 27001 Lead Implementer credential tells you](https://fmcybersecurity.com/en/insights/compliance/what-iso-27001-lead-implementer-means-for-your-project.md): Implementation and audit are different assignments. Check the credential issuer, level and current status, then assess the consultant against the work you need.
- [Which rules require recurring penetration testing?](https://fmcybersecurity.com/en/insights/appsec/which-regulations-require-recurring-pentests.md): PCI DSS, DORA, NIS2, ISO 27001 and GDPR have different testing requirements. Match the method, scope and tester qualifications to the actual obligation.
- [How to use application pentest evidence in ISO 27001 work](https://fmcybersecurity.com/en/insights/appsec/how-we-pentest-apps-for-iso-27001.md): A pentest report needs context: scope, release, findings, remediation and retesting. Connect those records to the risks and controls in your ISMS.
- [How to request a Tenable trial through FM CyberSecurity](https://fmcybersecurity.com/en/insights/exposure/how-to-get-a-free-tenable-one-tenant.md): Use a Tenable trial to answer a defined security question. Confirm eligibility, modules, access and assessment work before the evaluation begins.
- [How to request a CrowdStrike identity check through FM](https://fmcybersecurity.com/en/insights/identity/how-to-claim-a-free-crowdstrike-identity-check.md): An identity assessment can help prioritise account risks. Agree trial availability, access, coverage and the written findings before connecting your directory.
- [Bring your PAM architecture questions to FM CyberSecurity](https://fmcybersecurity.com/en/insights/identity/talk-to-the-cyberark-chief-architect.md): A PAM project needs decisions about access, dependencies and recovery. Here is what to prepare for a useful architecture conversation.
- [Planning your first vulnerability assessment in Tenable One](https://fmcybersecurity.com/en/insights/exposure/first-vulnerability-assessment-in-tenable-one.md): A useful first assessment establishes coverage, validates findings and assigns remediation. Agree the scope and scan conditions before collecting results.
- [Running an ongoing vulnerability programme with Tenable](https://fmcybersecurity.com/en/insights/exposure/how-we-run-the-vulnerability-program-in-tenable-one.md): Scanning needs a routine for coverage, triage, remediation and verification. Here is a practical cadence to adapt to your systems and responsibilities.
- [Exposure management and vulnerability management: how the work differs](https://fmcybersecurity.com/en/insights/exposure/exposure-management-vs-vulnerability-management.md): Vulnerability management addresses weaknesses throughout their lifecycle. Exposure management adds a broader view of access paths, identities and business impact.
- [FM CyberSecurity at Arrow ECS Summer Cloud Festival 2026](https://fmcybersecurity.com/en/insights/industry/fm-at-arrow-ecs-summer-cloud-festival-2026.md): Johan Vorgaard, Kenny Le, Maximilian Sharoyan and Fredrik Standahl represented FM CyberSecurity at Arrow ECS Norway's Summer Cloud Festival in Oslo.
- [Nessus, Tenable Vulnerability Management or Tenable One?](https://fmcybersecurity.com/en/insights/exposure/nessus-vs-tenable-vulnerability-management-vs-tenable-one.md): Choose by assessment scope, collaboration and the work you can operate. The scanner, vulnerability service and broader exposure platform serve different needs.
- [Tenable visits FM CyberSecurity, and a lap on Silverstone](https://fmcybersecurity.com/en/insights/exposure/tenable-visit-and-sim-race-may-2026.md): Tenable visited FM CyberSecurity's Oslo office in May. Guy March also took a turn in the racing simulator, recording 1:36.052 at Silverstone.
- [What Nessus does and where it fits in Tenable's portfolio](https://fmcybersecurity.com/en/insights/exposure/what-nessus-is-in-the-tenable-portfolio.md): Nessus assesses vulnerabilities and configuration on defined targets. The wider Tenable products add management and coverage for other security areas.
- [Fredrik Standahl in Digi.no on shadow AI in Norway](https://fmcybersecurity.com/en/insights/ai-security/fredrik-standahl-in-digi-on-shadow-ai-in-norway.md): Fredrik Standahl's Digi.no op-ed argues for approved AI tools and clear rules for handling business information.
- [Fredrik Standahl in E24 on shadow AI in Norway](https://fmcybersecurity.com/en/insights/ai-security/fredrik-standahl-in-e24-on-shadow-ai-in-norway.md): In E24, Fredrik Standahl discusses the gap between employees' AI use and the controls their employers have put in place.
- [How to turn Shadow AI findings into working controls](https://fmcybersecurity.com/en/insights/ai-security/how-we-handle-shadow-ai-with-falcon-aidr.md): Start with the AI tools people use, agree what data they may handle, and test the controls. A practical approach using CrowdStrike.
- [Shadow AI: the tools your approval process has missed](https://fmcybersecurity.com/en/insights/ai-security/what-shadow-ai-is-and-why-smbs-cannot-see-it.md): Unapproved AI use can expose business data and give agents excessive access. Start by understanding the work people are trying to do.
- [What a SOC does and how to choose an operating model](https://fmcybersecurity.com/en/insights/endpoint/what-a-soc-is-and-when-you-need-your-own.md): A security operations centre combines detection, investigation and response. In-house, managed and shared models should be compared against the same responsibilities.
- [What a SIEM does and when an SMB should consider one](https://fmcybersecurity.com/en/insights/endpoint/what-siem-is-and-when-smbs-need-one.md): A SIEM collects and analyses security events across systems. Start with the detection and investigation gaps, then decide how the service will be operated.
- [EDR and antivirus: prevention, investigation and response](https://fmcybersecurity.com/en/insights/endpoint/edr-and-antivirus-what-the-difference-is.md): Modern antivirus does more than match known files. EDR adds investigation and response capabilities. Check the coverage and who acts on the alerts.
- [Microsoft Patch Tuesday May 2026: Netlogon and DNS Client](https://fmcybersecurity.com/en/insights/exposure/microsoft-patch-tuesday-may-2026.md): May's Windows fixes include critical Netlogon and DNS Client vulnerabilities. Later Netlogon exploitation makes verification of domain-controller updates essential.
- [Publishing a website without a public admin login](https://fmcybersecurity.com/en/insights/strategy/how-we-publish-to-our-website-with-no-admin-login.md): A static website can keep publishing separate from visitor traffic. Git, a build pipeline and a controlled publishing service each have a distinct role.
- [What the CrowdStrike Falcon platform includes](https://fmcybersecurity.com/en/insights/endpoint/what-crowdstrike-falcon-is-the-platform-behind-modern-mdr.md): Falcon brings endpoint, identity and other security capabilities into a shared platform. Modules, integrations and the managed service have different roles.
- [Make security evidence useful to the business](https://fmcybersecurity.com/en/insights/compliance/from-compliance-burden-to-competitive-advantage.md): Clear security records help answer customer and investor questions. Build evidence around the controls you operate, with owners and an honest view of gaps.
- [Planning SOC 2 for a Norwegian business selling to the US](https://fmcybersecurity.com/en/insights/compliance/soc-2-compliance-for-norwegian-smbs-selling-to-us.md): Let actual customer requirements define the SOC 2 scope, report type and timing. Reuse existing security evidence, but assess the gaps before budgeting.
- [What a SOC 2 Type 2 report tells a customer](https://fmcybersecurity.com/en/insights/compliance/what-soc-2-type-2-is-and-why-us-customers-ask.md): SOC 2 Type 2 reports on controls over a defined period. Read the system scope, opinion, testing results and customer responsibilities, not just the report title.
- [Norway's Digital Security Act: scope and reporting](https://fmcybersecurity.com/en/insights/compliance/what-norways-digital-security-act-is.md): The Digital Security Act has applied since October 2025. Check the service definitions, exceptions and reporting rules for your category of provider.
- [What ISO 27001 is, and why buyers ask for it](https://fmcybersecurity.com/en/insights/compliance/what-iso-27001-is-and-why-tenders-require-it.md): ISO 27001 certification gives buyers independent evidence about a defined information security management system. Its scope and the tender wording matter.
- [ISO 27001 checklist for Norwegian SMBs](https://fmcybersecurity.com/en/insights/compliance/iso-27001-checklist-for-norwegian-smbs.md): Define scope, assess risk, implement controls and gather evidence. A practical checklist for preparing a Norwegian SMB for ISO 27001 assessment.
- [DORA checklist for Norwegian financial firms](https://fmcybersecurity.com/en/insights/compliance/dora-checklist-for-norwegian-financial-firms.md): Confirm the applicable regime, map critical functions and connect the evidence. Updated for Norway's September 2026 extension of DORA-based rules.
- [NIS2 checklist for Norwegian SMB leaders](https://fmcybersecurity.com/en/insights/compliance/nis2-checklist-for-norwegian-smb-leaders.md): A NIS2 preparation checklist for management: scope, accountable owners, risk measures, supplier oversight and a reporting process matched to applicable law.
- [What NIS2 means for Norwegian businesses](https://fmcybersecurity.com/en/insights/compliance/what-nis2-is-and-who-it-covers-in-norway.md): NIS2 scope depends on service, size, jurisdiction and exceptions. Distinguish direct legal duties from customer requirements and Norway's existing NIS1-based law.
- [Why FM's application testing service uses Aikido](https://fmcybersecurity.com/en/insights/appsec/why-aikido-is-our-only-pentest-provider.md): FM's pentest offering uses Aikido, with FM reporting. The aim is repeatable testing tied to application changes, clear scope and follow-up on findings.
- [Why Tenable is part of FM's exposure management service](https://fmcybersecurity.com/en/insights/exposure/why-we-picked-tenable-for-exposure-management.md): Tenable provides assessment and exposure analysis. The service around it must connect findings to asset owners, business priorities and verified remediation.
- [Why CrowdStrike Falcon supports FM's MDR offering](https://fmcybersecurity.com/en/insights/endpoint/why-we-picked-crowdstrike-falcon-for-modern-mdr.md): Endpoint and identity signals need an agreed response process. Falcon provides the platform; the service agreement defines who monitors, contains and escalates.
- [How Nordic SMBs prepare for NIS2](https://fmcybersecurity.com/en/insights/compliance/nis2-prep.md): Turn NIS2 preparation into a practical work plan: confirm applicable rules, assess controls, exercise reporting and track corrective actions.
- [Charlotte AI: what to automate in your SOC](https://fmcybersecurity.com/en/insights/strategy/charlotte-ai-soc.md): AI can help investigate security alerts. The useful test is whether it improves decisions and response in your own operation.
- [Fredrik Standahl in Shifter on startup AI security](https://fmcybersecurity.com/en/insights/ai-security/fredrik-standahl-in-shifter-on-startup-ai-security.md): Fredrik Standahl's Shifter commentary asks startup teams to make security checks part of releasing AI-generated code.
- [Microsoft Patch Tuesday April 2026: SharePoint and Windows priorities](https://fmcybersecurity.com/en/insights/exposure/microsoft-patch-tuesday-april-2026.md): April's release included SharePoint and Windows networking fixes. Later exploitation reports reinforce the need to verify that affected systems received updates.
- [FM CyberSecurity featured in VG Dine Penger](https://fmcybersecurity.com/en/insights/strategy/fm-cybersecurity-in-vg-dine-penger.md): VG Dine Penger interviewed Fredrik Standahl about starting a cybersecurity company and recruiting in the sector.
- [FM CyberSecurity in Norwegian Cybersecurity Cluster](https://fmcybersecurity.com/en/insights/strategy/fm-cybersecurity-in-norwegian-cybersecurity-cluster.md): Norwegian Cybersecurity Cluster interviewed Fredrik Standahl and Maximilian Stiegler Sharoyan about founding FM CyberSecurity.

## Insight articles (Norwegian)

- [CrowdStrike: Trygge KI-svar kan bli deler av et angrep](https://fmcybersecurity.com/insights/ai-security/crowdstrike-trygge-ki-svar-kan-bli-deler-av-et-angrep.md): En sikkerhetsvurdering av ett spørsmål tar ikke nødvendigvis høyde for arbeidsflyten svaret blir en del av.
- [Irregular tester grensene rundt KI-agenter som skal hacke](https://fmcybersecurity.com/insights/ai-security/irregular-tester-grensene-rundt-ki-agenter.md): Hackingferdigheter og tilgang til andre systemer er to ulike spørsmål. En ny forskningsoppdatering forklarer testing av avgrensningen.
- [ISO 27001 og NIS2: hva de er, og hva som skiller dem](https://fmcybersecurity.com/insights/compliance/iso-27001-vs-nis2-forskjellen.md): ISO 27001 er en frivillig standard du kan sertifiseres etter. NIS2 er EU-lov med pålagte krav, varslingsfrister og bøter. De overlapper i innhold, ikke i konsekvens.
- [En KI-retningslinje avgjør ikke hvilke filer assistenten kan lese](https://fmcybersecurity.com/insights/ai-security/ki-retningslinjer-og-faktisk-datatilgang.md): Delineas nye undersøkelse belyser forskjellen mellom assistentens godkjente oppgave og den faktiske tilgangen til bedriftens data.
- [Da KI-agenter gikk fra datasøk til angrepsforsøk](https://fmcybersecurity.com/insights/ai-security/transluce-ki-agenter-datasok-angrepsforsok.md): Ny forskning undersøker hva agenter gjorde da de ikke fikk hentet vanlige data.
- [KnowBe4-test: Et KI-laget e-postutkast lekket en innloggingskode](https://fmcybersecurity.com/insights/ai-security/knowbe4-ki-epostutkast-lekket-innloggingskode.md): En laboratorietest viser hvordan et KI-laget utkast kunne lekke en kode. Gmail-sidepanelet og forskernes egen automatisering ga forskjellige resultater.
- [RatHat: Slik hjelper KI skadevare med å navigere på en Android-telefon](https://fmcybersecurity.com/insights/ai-security/rathat-ki-navigerer-pa-infisert-android-telefon.md): Zimperium beskriver skadevare som spør en KI-assistent hvor den skal trykke og bla. Modellen hjelper med navigasjon på en telefon skadevaren allerede har tilgang til.
- [Plugin4Shell: Når en godkjent plugin installerer annen kode](https://fmcybersecurity.com/insights/ai-security/plugin4shell-godkjent-plugin-installerer-annen-kode.md): Plugin4Shell viser hvordan en godkjent plugin kunne levere annen kode til KI-kodeverktøy. En publisert rettelse i Codex forklarer kontrollen som manglet.
- [Slik hjalp Claude forskere med å få tilgang til OpenAI-kontoer via et forum](https://fmcybersecurity.com/insights/ai-security/claude-hjalp-forskere-fra-forum-til-openai-kontoer.md): Hacktron beskriver hvordan Claude hjalp forskere med angrepskode som knyttet en feil i bildeopplasting til tilgang til OpenAI-kontoer.
- [CrowdStrike: PhantomRaven trolig laget med AI](https://fmcybersecurity.com/insights/ai-security/crowdstrike-phantomraven-skadevare-ai.md): CrowdStrikes nye rapport knytter PhantomRaven til sannsynlig AI-generert kode, npm-pakker og bug bounty. Dette viser funnene.
- [CrowdStrike bruker AI på PC-en til å oppdage sensitiv informasjon](https://fmcybersecurity.com/insights/ai-security/crowdstrike-lokal-ai-dataklassifisering.md): Falcon Data Security skal forstå når vanlig tekst inneholder fortrolig informasjon. Slik fungerer klassifiseringen direkte på PC-en.
- [Hva er CrowdStrike Agentic Identity Provider?](https://fmcybersecurity.com/insights/ai-security/hva-er-crowdstrike-agentic-identity-provider.md): Agentic IdP gir KI-agenter identiteter som kan verifiseres, og knytter tilgangen til personen eller systemet bak dem. Slik henger det sammen med Guardian og Continuous Identity.
- [Hva er CrowdStrike SafeMind?](https://fmcybersecurity.com/insights/ai-security/hva-er-crowdstrike-safemind.md): SafeMind kombinerer KI-modeller for angrep og forsvar med programvare som utfører sikkerhetsoppgaver. Slik henger Red Tempest, Blue Solano og testene sammen.
- [Hva er CrowdStrike Falcon Guardian?](https://fmcybersecurity.com/insights/ai-security/hva-er-falcon-guardian.md): De 14 funksjonene i CrowdStrikes sammenligning av AIDR og Guardian forklart: fra skygge-KI til agentkontroll, undersøkelser og kostnadsanalyse.
- [Et bilde skal ikke kunne omskrive AI-agentens instrukser](https://fmcybersecurity.com/insights/ai-security/bilder-skal-ikke-endre-ai-agentens-instrukser.md): Forskning på visuell prompt injection viser hvorfor en agent som leser kundebilder, ikke bør kunne endre instruksene for sine egne verktøy.
- [Falcon Guardian: Hvilke handlinger kan vi stoppe?](https://fmcybersecurity.com/insights/ai-security/falcon-guardian-seks-timers-angrep.md): CrowdStrike utvider sikkerheten rundt AI-agenter med Falcon Guardian. Dette ville vi undersøkt og prøvd før en utrulling.
- [Nytt fra Fal.Con Las Vegas: Guardian, SafeMind og Agentic IdP](https://fmcybersecurity.com/insights/ai-security/nytt-fra-falcon-crowdstrike-ai-sikkerhet-september-2026.md): CrowdStrikes nyheter fra Fal.Con 2026 kobler KI-aktivitet, agentidentiteter og KI-basert forsvar. Her er rollene til Guardian, SafeMind og Agentic IdP.
- [Forskere knytter misbruket av RubyGems i mai til OpenAI-agenter](https://fmcybersecurity.com/insights/ai-security/openai-agenter-traff-rubygems-i-mai.md): RubyGems fjernet over 500 ondsinnede pakker i mai. Ny forskning knytter kampanjen til AI-agenter og viser risikoen ved automatiske dokumentasjonsbygg.
- [Anthropics trusselrapport viser ulik grad av AI-styring](https://fmcybersecurity.com/insights/ai-security/anthropic-rapport-fem-grupper-kjorte-ai-agenter-mot-ekte-mal.md): Septemberrapporten beskriver AI-assisterte innbrudd med varierende menneskelig styring. Tilganger og synlig atferd bør styre oppfølgingen.
- [Google beskriver tyverikampanje bygget på under seks timer](https://fmcybersecurity.com/insights/ai-security/ai-agenter-hostet-nokler-pa-under-seks-timer.md): En agentassistert kampanje gikk fra planlegging til tyveri av påloggingsdata på få timer. Hvor raskt kan dere begrense uønsket aktivitet i skyen?
- [ChatGPT-feil viste risikoen ved tilkoblede data](https://fmcybersecurity.com/insights/ai-security/chatgpt-delt-utklippstavle-gmail-lekkasje.md): Check Point demonstrerte en kanal mellom kontoer kombinert med prompt-injeksjon. Kanalen er stengt, men tilgangene bør fortsatt gjennomgås.
- [AI-agenter brukte en gammel wiki til å samarbeide utenfor oppdraget](https://fmcybersecurity.com/insights/ai-security/openai-agenter-okkuperte-forlatt-wiki.md): Forskere rekonstruerte rundt 18 000 agentinnlegg på DSEwiki. Funnene viser hvorfor både gamle nettsider og agenters nettverkstilgang må følges opp.
- [GuardBreaker: En avvist analyse er ikke en friskmelding](https://fmcybersecurity.com/insights/ai-security/prompt-i-skadevare-stanser-ai-analyse.md): ESET beskriver kodekommentarer som skal avspore AI-analyse. En avvisning eller ufullstendig vurdering må ha en tydelig vei videre.
- [Aurora-rapporter viser kodeagenter som del av innbruddsarbeidet](https://fmcybersecurity.com/insights/ai-security/losepengeoperator-kjorte-cursor-i-ti-offernettverk.md): Forskere beskriver en Aurora-operatør som brukte Cursor under angrep. Undersøk handlingene og tilgangene, ikke bare navnet på verktøyet.
- [AI-bransjens fellesbrev må følges av konkrete tiltak](https://fmcybersecurity.com/insights/ai-security/ai-bransjens-fellesbrev-om-cyberforsvar.md): Bransjen ber om raskere cyberforsvar. For ledelsen er neste steg å gjøre oppfordringen om til arbeid med ansvar, ressurser og oppfølging.
- [OpenAIs Hugging Face-rapport viser hull i isoleringen av agenter](https://fmcybersecurity.com/insights/ai-security/openai-rapport-agentsverm-hugging-face.md): Granskningen beskriver uautorisert kommunikasjon mellom agenter og ulik sikring av miljøene. Felles lagring og testmiljøer trenger tydelige tilgangsgrenser.
- [En vanlig bookingoppgave fikk AI-agenten til å omgå reglene](https://fmcybersecurity.com/insights/ai-security/ai-agenter-utnytter-vanlige-nettfeil-uten-a-bli-bedt.md): Aikidos laboratorieforsøk viser en agent som omgår en bookinggrense. Reglene må håndheves på serveren, ikke bare i brukergrensesnittet.
- [Hva Unit 42s tall om AI-skadevare forteller](https://fmcybersecurity.com/insights/ai-security/ai-skadevare-97-prosent-forlot-aldri-sandkassen.md): Unit 42 fant 12 av 405 prøver i sine endepunktdata. Funnet er nyttig, men måler ikke alle former for AI-assisterte angrep.
- [AI-skript mot Siemens-styringer: Undersøk tilgangene først](https://fmcybersecurity.com/insights/ai-security/ai-angrepsskript-siemens-pls.md): En NSA-ledet advarsel beskriver rekognosering mot Siemens-PLS-er. Gå gjennom eksponering og fjernaksess sammen med dem som har ansvar for prosessen.
- [Krypterte prompter viser hvorfor datakilden må følge med](https://fmcybersecurity.com/insights/ai-security/kryptert-tekst-lurer-grok-til-a-lekke-chatloggen.md): Adversa demonstrerte et Grok-angrep med kryptert nettinnhold. Eksterne data blir ikke pålitelige instruksjoner fordi agenten bearbeider dem.
- [OpenAI satte modelltrening på pause mens sikkerheten ble styrket](https://fmcybersecurity.com/insights/ai-security/openai-stanset-storste-treningslop-hackingrisiko.md): OpenAI meldte om en treningspause og strengere tiltak etter tegn på kritisk cyberevne. Kunngjøringen synliggjør også kostnaden ved å følge opp AI-agenter.
- [Agentminnet må beskyttes mot fremmede instruksjoner](https://fmcybersecurity.com/insights/ai-security/tankevirus-ai-agenter-smitter-hverandre-gjennom-minnefiler.md): En studie viser instruksjoner som sprer seg mellom AI-agenter. En advarsel i prompten hjalp i forsøkene, men erstatter ikke tilgangskontroll.
- [GPT-5.6-Cyber gir flere muligheter for avansert sikkerhetsarbeid](https://fmcybersecurity.com/insights/ai-security/openai-lanserer-modell-som-skriver-exploits.md): OpenAIs cybermodell svarer på flere avanserte sikkerhetsforespørsler. Tallet på 95 prosent gjelder svarvillighet, ikke hvor ofte et angrep lykkes.
- [Dream beskriver AI-angrep mot offentlige systemer](https://fmcybersecurity.com/insights/ai-security/ai-agenter-brot-seg-inn-hos-taiwans-myndigheter.md): Dreams rapport beskriver et fire dager langt innbrudd med AI-agenter. Svak autentisering og åpne API-er er sentrale deler av problemet.
- [Krypterte AI-spor kan fortsatt inneholde sensitive opplysninger](https://fmcybersecurity.com/insights/ai-security/ai-resonnering-lekket-nokler-og-passord.md): Forskere hentet ut sensitive data fra publiserte resonneringsblokker. Vurder hele agentloggen før dere deler den.
- [Shai-Hulud gjør editorinnstillinger til en del av sikkerhetskontrollen](https://fmcybersecurity.com/insights/ai-security/shai-hulud-ormen-sprer-seg-via-ai-kodeverktoy.md): JFrog beskriver skadelige hooks og editoroppgaver i augustkampanjen. Gjennomgå kjørbare prosjektinnstillinger sammen med avhengighetene.
- [Ghostjacking: En blokkert forespørsel kan fortsatt nå AI-agenten](https://fmcybersecurity.com/insights/ai-security/ghostjacking-forgiftede-logger-kaprer-ai-agenter.md): Tenet viser hvordan innhold i logger kan styre en agent. At agenten leser en hendelse, bør ikke gi hendelsen myndighet til å endre systemer.
- [Hva koster ISO 27001, og hva avgjør prisen](https://fmcybersecurity.com/insights/compliance/hva-koster-iso-27001.md): Sammenlign ISO 27001-tilbud etter gjennomføring, egen tidsbruk, verktøy, revisjonsgebyrer og vedlikehold. Omfanget avgjør hva prisen betyr.
- [Hvor lang tid tar ISO 27001?](https://fmcybersecurity.com/insights/compliance/hvor-lang-tid-tar-iso-27001.md): Tiden til ISO 27001 avhenger av utgangspunktet, kontrollene som må innføres og sertifiseringsorganets kapasitet.
- [ISO 27001 eller NIS2 først?](https://fmcybersecurity.com/insights/compliance/iso-27001-eller-nis2-forst.md): Bruk felles sikkerhetsprosesser, men følg opp lovkrav og sertifisering hver for seg. Gjeldende lovfrister går foran kommersielle ønsker.
- [Kunden krever ISO 27001. Hva gjør dere nå?](https://fmcybersecurity.com/insights/compliance/kunden-krever-iso-27001.md): Avklar omfang, frist og hvilken dokumentasjon kunden godtar før dere lover en dato. Kartlegg deretter gapene og lag en gjennomførbar plan.
- [Hvor AI kan hjelpe i ISO 27001-arbeidet](https://fmcybersecurity.com/insights/compliance/slik-bruker-vi-ai-til-sertifiseringsklar-pa-fire-til-seks-uker.md): AI kan bidra med utkast og organisering av dokumentasjon. Mennesker må fortsatt beslutte risiko, innføre kontroller og kontrollere at beskrivelsene stemmer.
- [ISO 27001-arbeid som del av et sikkerhetsabonnement](https://fmcybersecurity.com/insights/strategy/iso-27001-som-abonnement.md): Secured by FM CyberSecurity samler sikkerhetsdrift, rådgivning og ISO 27001-forberedelser. Dette bør avklares når arbeidet kjøpes som abonnement.
- [AI-hacking: Når AI-modeller hacker selv](https://fmcybersecurity.com/insights/ai-security/slik-forbereder-du-deg-pa-ai-hacking.md): AI-agenter brøt seg inn hos Hugging Face under en sikkerhetstest. Hva betyr det at en modell kan finne svakheter og handle på egen hånd?
- [CyberArk heter nå Idira: dette bør dere sjekke](https://fmcybersecurity.com/insights/identity/cyberark-heter-na-idira.md): Palo Alto Networks lanserte Idira i mai 2026. Slik finner dere frem mellom det nye navnet, CyberArk-dokumentasjonen og spørsmål om lisenser.
- [Slik kommer dere i gang med privilegert tilgangsstyring](https://fmcybersecurity.com/insights/identity/slik-kommer-du-i-gang-med-pam.md): Begynn med kontoeiere og tilganger med store konsekvenser. Planlegg nøkkelbytte, nødtilgang og videre drift før utrullingen utvides.
- [Dette bør dere undersøke i et tilbud på neste generasjons SIEM](https://fmcybersecurity.com/insights/endpoint/hva-er-next-gen-siem.md): Next-gen-navnet definerer verken én arkitektur eller prismodell. Vurder kildedekning, deteksjon, søk, lagring og arbeidet bak tjenesten.
- [DORA-testing: ordinært testprogram og trusselbasert penetrasjonstesting](https://fmcybersecurity.com/insights/compliance/dora-og-regelmessig-penetrasjonstesting.md): DORA skiller vanlig motstandsdyktighetstesting fra utpekt TLPT. Velg metoder ut fra risiko, dokumenter dekningen og kontroller feilrettingen.
- [Hva kontrollpanelet til Idira EPM-agenten gjør](https://fmcybersecurity.com/insights/identity/hva-er-idira-epm-agent-control-panel.md): EPM-kontrollpanelet gir Windows-brukere tilgang til administratoroppgaver IT har godkjent. Det er forskjellig fra både Windows-kontrollpanelet og administrasjonskonsollen.
- [Tenable One eller Vulnerability Management: modul eller bredere pakke?](https://fmcybersecurity.com/insights/exposure/tenable-one-eller-tenable-vulnerability-management.md): Tenables sårbarhetstjeneste finnes både separat og i plattformen. Vurder ekstra dekning og driftsarbeid før dere velger pakke.
- [Velg verktøy ut fra DORA-arbeidet som skal gjøres](https://fmcybersecurity.com/insights/compliance/verktoy-for-dora-etterlevelse.md): Programvare kan holde orden på registre, dokumentasjon og tekniske funn. Velg ut fra beslutninger, data og ansvar i DORA-programmet.
- [Hendelseshåndtering: forberedelser, begrensning og varsling i Norge](https://fmcybersecurity.com/insights/endpoint/hva-er-hendelseshandtering.md): En hendelsesplan må avklare fullmakter, sikring av spor og aktuelle varslingsplikter. De første tiltakene må tilpasses hendelsen.
- [Er Aikido en CSPM? Dette dekker skymodulen](https://fmcybersecurity.com/insights/cloud/er-aikido-en-cspm.md): Aikido inkluderer kontroll av skyoppsett. Vurder dekning, tilganger og rapportering opp mot risikoene virksomheten trenger å håndtere.
- [DORA-rapportering og revisjon: skill mellom pliktene](https://fmcybersecurity.com/insights/compliance/dora-revisjonskrav-og-rapportering.md): IKT-avtaleregister, forhåndsmeldinger, hendelsesrapporter og internrevisjon har ulike formål. Fordel ansvar og bruk gjeldende innsendingsregler.
- [Anthropics testhendelser viser hvorfor isolasjon må kontrolleres](https://fmcybersecurity.com/insights/ai-security/claude-brot-seg-inn-hos-tre-selskaper-under-sikkerhetstester.md): Tre hendelser nådde ekte systemer fra et testoppsett med utilsiktet internettilgang. En prompt kan beskrive en grense, men ikke håndheve den.
- [Databrudd og løsepengeangrep: ulike konsekvenser, felles håndtering](https://fmcybersecurity.com/insights/endpoint/datainnbrudd-og-losepengevirus.md): Løsepengeangrep kan ramme både tilgjengelighet og fortrolighet. Virksomheten må vurdere driftskonsekvenser og personvernplikter samtidig.
- [Hva sårbarhetsskanning finner, og hvordan resultatene brukes](https://fmcybersecurity.com/insights/exposure/hva-er-sarbarhetsskanning.md): En nyttig skanning trenger godkjent omfang, pålitelig innsamling og oppfølging. Skill mellom få funn og manglende dekning.
- [Kontinuitet under DORA: funksjoner, gjenoppretting og øvelser](https://fmcybersecurity.com/insights/compliance/dora-beredskapsplaner.md): Planene må følge tjenestene foretaket skal opprettholde. Kartlegg avhengigheter, sett gjenopprettingsmål og øv på beslutningene så vel som teknologien.
- [Endepunktprivilegier: færre adminrettigheter og en brukbar unntaksordning](https://fmcybersecurity.com/insights/identity/hva-er-rettighetsstyring-pa-endepunkter.md): EPM lar ansatte jobbe uten faste lokale administratorrettigheter. Innføringen krever presise regler, godkjenning og støtte for oppgaver som trenger ekstra tilgang.
- [OpenAI-agenter brøt seg inn hos Hugging Face under en sikkerhetstest](https://fmcybersecurity.com/insights/ai-security/openai-modell-brot-ut-og-hacket-hugging-face.md): Agenter gikk utenfor rammene for en OpenAI-test og kompromitterte Hugging Face. Hendelsen viser hvorfor også tjenestene rundt en agent må sikres.
- [FM Cyber Breakfast: CrowdStrike](https://fmcybersecurity.com/insights/ai-security/fm-cyber-breakfast-crowdstrike-2026-08.md): Arrangementsside for 20. august 2026: AI-bruk, prompt injection og AI Detection & Response med CrowdStrike på MESH Youngstorget i Oslo.
- [Cyber Resilience Act: rapporteringsplikten har startet](https://fmcybersecurity.com/insights/compliance/hva-er-eu-cyber-resilience-act.md): Rapportering for produsenter etter CRA startet 11. september 2026. Hovedkravene til produkter følger i desember 2027. Avklar omfang og rolle nå.
- [Hva CISSP betyr når du velger cybersikkerhetskonsulent](https://fmcybersecurity.com/insights/strategy/cissp-i-konsulentvalget.md): CISSP er en bred sikkerhetssertifisering med erfaringskrav. Kontroller den, og vurder deretter om personen passer til systemene og oppdraget deres.
- [Hva en ISO 27001 Lead Implementer-sertifisering forteller](https://fmcybersecurity.com/insights/compliance/iso-27001-lead-implementer.md): Implementering og revisjon er forskjellige oppdrag. Kontroller utsteder, nivå og gyldighet, og vurder deretter konsulenten mot arbeidet dere trenger.
- [Hvilke regler krever gjentakende penetrasjonstesting?](https://fmcybersecurity.com/insights/appsec/regelverk-som-krever-regelmessig-pentest.md): PCI DSS, DORA, NIS2, ISO 27001 og GDPR har ulike testkrav. Metode, omfang og kvalifikasjoner må passe til den konkrete plikten.
- [Slik brukes pentestbevis i ISO 27001-arbeidet](https://fmcybersecurity.com/insights/appsec/pentest-som-del-av-iso-27001.md): En pentest trenger sammenheng: omfang, versjon, funn, rettelser og retest. Knytt dokumentasjonen til risikoene og kontrollene i styringssystemet.
- [Slik ber dere om en Tenable-prøveperiode gjennom FM CyberSecurity](https://fmcybersecurity.com/insights/exposure/gratis-tenable-one-tenant.md): La prøveperioden svare på et konkret sikkerhetsspørsmål. Bekreft tilgjengelighet, moduler, tilganger og vurderingsarbeid før oppstart.
- [Slik ber dere om en identitetssjekk med CrowdStrike gjennom FM](https://fmcybersecurity.com/insights/identity/gratis-identitetssjekk-via-crowdstrike.md): En identitetsvurdering kan hjelpe dere å prioritere kontorisiko. Avklar prøveperiode, tilganger, dekning og rapport før katalogtjenesten kobles til.
- [Ta PAM-arkitekturen opp med FM CyberSecurity](https://fmcybersecurity.com/insights/identity/snakk-med-cyberark-chief-architect.md): Et PAM-prosjekt krever valg om tilganger, avhengigheter og gjenoppretting. Dette bør dere forberede til en nyttig arkitektursamtale.
- [Planlegg den første sårbarhetsvurderingen i Tenable One](https://fmcybersecurity.com/insights/exposure/forste-sarbarhetsanalyse-i-tenable-one.md): En nyttig førstegangsvurdering avklarer dekning, kontrollerer funn og fordeler tiltak. Avtal omfang og skannevilkår før resultatene samles inn.
- [Slik kan et løpende sårbarhetsprogram med Tenable organiseres](https://fmcybersecurity.com/insights/exposure/sarbarhetsprogrammet-i-tenable-one.md): Skanning trenger rutiner for dekning, prioritering, feilretting og kontroll. Dette er et praktisk opplegg som kan tilpasses systemene og ansvaret deres.
- [Forskjellen på eksponeringsstyring og sårbarhetsstyring](https://fmcybersecurity.com/insights/exposure/exposure-og-sarbarhetshandtering.md): Sårbarhetsstyring følger svakheter fra funn til oppfølging. Eksponeringsstyring ser også på tilgangsveier, identiteter og konsekvensene for virksomheten.
- [FM CyberSecurity på Arrow ECS Summer Cloud Festival 2026](https://fmcybersecurity.com/insights/industry/fm-paa-arrow-ecs-summer-cloud-festival-2026.md): Johan Vorgaard, Kenny Le, Maximilian Sharoyan og Fredrik Standahl representerte FM CyberSecurity på Arrow ECS Norways Summer Cloud Festival i Oslo.
- [Nessus, Tenable Vulnerability Management eller Tenable One?](https://fmcybersecurity.com/insights/exposure/nessus-vs-tenable-vm-vs-tenable-one.md): Velg ut fra omfang, samarbeid og arbeidet dere kan drifte. Skanneren, sårbarhetstjenesten og den bredere plattformen dekker forskjellige behov.
- [Tenable på besøk hos FM CyberSecurity, og en runde på Silverstone](https://fmcybersecurity.com/insights/exposure/tenable-paa-besoek-og-simrace-mai-2026.md): Tenable besøkte FM CyberSecuritys Oslo-kontor i mai. Guy March tok også en runde i racingsimulatoren og kjørte Silverstone på 1:36.052.
- [Hva Nessus gjør, og hvor det passer i Tenable-porteføljen](https://fmcybersecurity.com/insights/exposure/hva-er-nessus.md): Nessus undersøker sårbarheter og konfigurasjon på avtalte mål. De øvrige Tenable-produktene tilfører styring og dekning på flere sikkerhetsområder.
- [Fredrik Standahl i Digi.no om skygge-KI i Norge](https://fmcybersecurity.com/insights/ai-security/fredrik-standahl-i-digi-om-skygge-ki-i-norge.md): Fredrik Standahls debattinnlegg i Digi.no etterlyser godkjente AI-verktøy og tydelige regler for virksomhetens informasjon.
- [Fredrik Standahl i E24 om skygge-KI i Norge](https://fmcybersecurity.com/insights/ai-security/fredrik-standahl-i-e24-om-skygge-ki-i-norge.md): I E24 skriver Fredrik Standahl om avstanden mellom ansattes AI-bruk og kontrollene arbeidsgiveren har på plass.
- [Fra kartlegging av Shadow AI til kontroller som fungerer](https://fmcybersecurity.com/insights/ai-security/hvordan-vi-loser-shadow-ai-med-falcon-aidr.md): Finn verktøyene folk bruker, avklar hvilke data de får håndtere, og prøv kontrollene. Slik ville vi lagt opp arbeidet med CrowdStrike.
- [Shadow AI: Verktøyene som ikke er blitt vurdert](https://fmcybersecurity.com/insights/ai-security/hva-er-shadow-ai.md): AI-bruk uten godkjenning kan eksponere bedriftsdata og gi agenter for vide tilganger. Begynn med å forstå hva ansatte bruker verktøyene til.
- [Hva en SOC gjør, og hvordan dere velger driftsmodell](https://fmcybersecurity.com/insights/endpoint/hva-er-et-soc.md): En sikkerhetsoperasjonssentral kombinerer deteksjon, undersøkelser og respons. Sammenlign intern drift, tjenestekjøp og delt ansvar mot de samme oppgavene.
- [Hva SIEM gjør, og når en SMB bør vurdere det](https://fmcybersecurity.com/insights/endpoint/hva-er-siem.md): En SIEM samler og analyserer sikkerhetshendelser på tvers av systemer. Begynn med hullene i deteksjon og undersøkelser, og avklar deretter driften.
- [EDR og antivirus: forebygging, undersøkelse og respons](https://fmcybersecurity.com/insights/endpoint/edr-og-antivirus.md): Moderne antivirus gjør mer enn å gjenkjenne kjente filer. EDR gir støtte til undersøkelser og respons. Kontroller dekningen og hvem som følger opp varslene.
- [Microsoft Patch Tuesday mai 2026: Netlogon og DNS Client](https://fmcybersecurity.com/insights/exposure/microsoft-patch-tuesday-mai-2026.md): Maioppdateringene omfatter kritiske feil i Netlogon og DNS Client. Senere utnyttelse av Netlogon gjør kontroll av domenekontrollernes oppdateringer viktig.
- [Hva CrowdStrike Falcon-plattformen omfatter](https://fmcybersecurity.com/insights/endpoint/hva-er-crowdstrike-falcon-plattformen.md): Falcon samler funksjoner for endepunkter, identitet og andre sikkerhetsområder. Moduler, integrasjoner og den administrerte tjenesten har ulike roller.
- [Publisering uten en offentlig admininnlogging](https://fmcybersecurity.com/insights/strategy/slik-publiserer-vi-til-nettsiden-uten-admin-innlogging.md): Et statisk nettsted kan skille publisering fra besøkstrafikk. Git, byggeprosessen og publiseringstjenesten har hver sin oppgave.
- [Planlegg SOC 2 for en norsk virksomhet som selger til USA](https://fmcybersecurity.com/insights/compliance/soc-2-for-norske-smb-som-selger-til-usa.md): La konkrete kundekrav styre SOC 2-omfang, rapporttype og frist. Gjenbruk relevant sikkerhetsdokumentasjon, men vurder gapene før dere setter budsjettet.
- [Hva en SOC 2 Type 2-rapport forteller kunden](https://fmcybersecurity.com/insights/compliance/hva-er-soc-2-type-2.md): SOC 2 Type 2 vurderer kontroller over en avgrenset periode. Les omfang, uttalelse, testresultater og kundens ansvar, ikke bare tittelen.
- [Digitalsikkerhetsloven: omfang og varsling](https://fmcybersecurity.com/insights/compliance/hva-er-digitalsikkerhetsloven.md): Digitalsikkerhetsloven har gjeldt siden oktober 2025. Kontroller tjenestedefinisjoner, unntak og varslingsregler for riktig tilbyderkategori.
- [Hva ISO 27001 er, og hvorfor kunder spør etter det](https://fmcybersecurity.com/insights/compliance/hva-er-iso-27001.md): ISO 27001 gir kunder uavhengig dokumentasjon om et avgrenset styringssystem for informasjonssikkerhet. Omfanget og anbudskravet må leses nøye.
- [ISO 27001-sjekkliste for norske SMB-er](https://fmcybersecurity.com/insights/compliance/iso-27001-sjekkliste-for-smb.md): Avklar omfang, vurder risiko, innfør kontroller og samle dokumentasjon. En praktisk sjekkliste for norske SMB-er som forbereder ISO 27001.
- [DORA-sjekkliste for norske finansforetak](https://fmcybersecurity.com/insights/compliance/dora-sjekkliste-for-finansforetak.md): Avklar regelsettet, kartlegg viktige funksjoner og samle grunnlaget. Oppdatert for utvidelsen av norske DORA-baserte regler i september 2026.
- [NIS2-sjekkliste for norske SMB-ledere](https://fmcybersecurity.com/insights/compliance/nis2-sjekkliste-for-smb-ledere.md): En NIS2-sjekkliste for ledelsen: omfang, ansvar, risikotiltak, leverandøroppfølging og varsling etter regelverket som gjelder.
- [Hva NIS2 betyr for norske virksomheter](https://fmcybersecurity.com/insights/compliance/hva-er-nis2.md): NIS2-omfang avhenger av tjeneste, størrelse, jurisdiksjon og unntak. Skill lovplikter fra kundekrav og Norges eksisterende NIS1-baserte lov.
- [Derfor bruker FM Aikido til applikasjonstesting](https://fmcybersecurity.com/insights/appsec/hvorfor-vi-valgte-aikido.md): FMs pentesttilbud bruker Aikido, med rapporter fra FM. Målet er tester som kan gjentas ved endringer, tydelig omfang og oppfølging av funn.
- [Hvorfor Tenable inngår i FMs eksponeringsstyring](https://fmcybersecurity.com/insights/exposure/hvorfor-vi-valgte-tenable.md): Tenable gir vurdering og eksponeringsanalyse. Tjenesten rundt må koble funnene til eiere, virksomhetens prioriteringer og bekreftet feilretting.
- [Hvorfor CrowdStrike Falcon brukes i FMs MDR-tilbud](https://fmcybersecurity.com/insights/endpoint/hvorfor-vi-valgte-crowdstrike-falcon.md): Signaler fra endepunkter og identitet trenger en avtalt responsprosess. Falcon er plattformen; tjenesteavtalen bestemmer hvem som overvåker, stanser og eskalerer.
- [Slik forbereder norske SMB-er seg på NIS2](https://fmcybersecurity.com/insights/compliance/slik-forbereder-norske-smber-seg-pa-nis2.md): Gjør NIS2-forberedelser til en konkret arbeidsplan: avklar regler, vurder kontroller, øv på varsling og følg opp tiltak.
- [Charlotte AI: Hva bør dere automatisere i sikkerhetsovervåkingen?](https://fmcybersecurity.com/insights/strategy/charlotte-ai-hva-betyr-agentic-soc-for-deg.md): AI kan hjelpe med å undersøke sikkerhetsvarsler. Nytten må vurderes ut fra beslutningene og responsen i deres egen drift.
- [Fredrik Standahl i Shifter om AI-sikkerhet for startups](https://fmcybersecurity.com/insights/ai-security/fredrik-standahl-i-shifter-om-ai-sikkerhet-for-startups.md): Fredrik Standahls kommentar i Shifter handler om å gjøre sikkerhetskontroller til en del av utviklingen når AI skriver kode.
- [Microsoft Patch Tuesday april 2026: prioriteringer for SharePoint og Windows](https://fmcybersecurity.com/insights/exposure/microsoft-patch-tuesday-april-2026.md): Apriloppdateringene rettet feil i SharePoint og Windows-nettverk. Senere rapporter om utnyttelse gjør det viktig å kontrollere at berørte systemer er oppdatert.
- [FM CyberSecurity omtalt i VG Dine Penger](https://fmcybersecurity.com/insights/strategy/fm-cybersecurity-omtalt-i-vg-dine-penger.md): VG Dine Penger intervjuet Fredrik Standahl om å starte sikkerhetsselskap og rekruttere i bransjen.
- [FM CyberSecurity omtalt i Norwegian Cybersecurity Cluster](https://fmcybersecurity.com/insights/strategy/fm-cybersecurity-omtalt-i-norwegian-cybersecurity-cluster.md): Norwegian Cybersecurity Cluster intervjuet Fredrik Standahl og Maximilian Stiegler Sharoyan om etableringen av FM CyberSecurity.
- [Gjør sikkerhetsdokumentasjonen nyttig for virksomheten](https://fmcybersecurity.com/insights/compliance/fra-compliance-byrde-til-konkurransefortrinn.md): Tydelig dokumentasjon gjør det enklere å svare kunder og investorer. Bygg den rundt kontroller som utføres, med eiere og et ærlig bilde av manglene.

## Optional

- [CrowdStrike Falcon Guardian, levert av FM CyberSecurity](https://fmcybersecurity.com/falcon-guardian.md): Oppdag, styr og stopp AI-agenter og KI-agenter der de kjører. FM CyberSecurity leverer CrowdStrike Falcon Guardian i Norge.
- [Our Offices](https://fmcybersecurity.com/en/offices.md): We are headquartered in central Oslo, working across Norway and the Nordics with international clients.
- [Våre kontorer](https://fmcybersecurity.com/offices.md): Vi har hovedkontor sentralt i Oslo, og jobber på tvers av Norge og Norden, med internasjonale kunder.
- [Life @ FM CyberSecurity](https://fmcybersecurity.com/en/careers.md): Glimpses from the day at Henrik Ibsens gate, from the Pascal coffee to the racing simulator on the fourth floor.
- [Livet @ FM CyberSecurity](https://fmcybersecurity.com/careers.md): Glimt fra hverdagen i Henrik Ibsens gate, fra morgenkaffen på Pascal til racingsimulatoren i fjerde.
- [Open positions](https://fmcybersecurity.com/en/open-positions.md): Senior cybersecurity roles at FM CyberSecurity in Oslo: security consultants, identity and access (IAM), and sales leadership.
- [Ledige stillinger](https://fmcybersecurity.com/open-positions.md): Senior cybersikkerhetsroller hos FM CyberSecurity i Oslo: sikkerhetskonsulenter, identitet og tilgang (IAM) og salgsledelse.
- [Board of directors](https://fmcybersecurity.com/en/board.md): The board of directors at FM CyberSecurity.
- [Styret](https://fmcybersecurity.com/board.md): Styret i FM CyberSecurity.
- [FM CyberQualy](https://fmcybersecurity.com/en/sim.md): FM CyberQualy, the office racing-sim leaderboard. The ten fastest race Porsche Caymans at Rudskogen Motorsenter.
- [FM CyberQualy](https://fmcybersecurity.com/sim.md): FM CyberQualy, topplisten fra racing-simulatoren på kontoret. De ti raskeste kjører Porsche Cayman på Rudskogen Motorsenter.
- [FM Cyber Breakfast with CrowdStrike, FM CyberSecurity](https://fmcybersecurity.com/en/events/fm-cyber-breakfast-crowdstrike-2026-08.md): Frontier AI, AI Detection & Response and Q&A with CrowdStrike. Live demos and the latest on AI threats and opportunities. MESH Youngstorget, 20 August 2026, 08:30 to 10:00.
- [FM Cyber Breakfast med CrowdStrike, FM CyberSecurity](https://fmcybersecurity.com/events/fm-cyber-breakfast-crowdstrike-2026-08.md): Frontier AI, AI Detection & Response og Q&A med CrowdStrike. Live demo og siste nytt om AI-trusler og muligheter. MESH Youngstorget, 20. august 2026, 08:30 til 10:00.
- [FM Cyber Breakfast with Tenable, FM CyberSecurity](https://fmcybersecurity.com/en/events/fm-cyber-breakfast-tenable-2026-06.md): The headlines from Tenable EXPOSURE 2026 in Boston, served as a breakfast briefing at MESH Youngstorget, 10 June 2026, 08:30 to 10:00.
- [FM Cyber Breakfast med Tenable, FM CyberSecurity](https://fmcybersecurity.com/events/fm-cyber-breakfast-tenable-2026-06.md): De viktigste nyhetene fra Tenable EXPOSURE 2026 i Boston, servert som frokostmøte på MESH Youngstorget, 10. juni 2026, 08:30 til 10:00.
- [Privacy notice, FM CyberSecurity](https://fmcybersecurity.com/en/privacy.md): How FM CyberSecurity AS processes personal data from visitors, customers and event attendees. Lawful basis, recipients, retention and your rights.
- [Personvernerklæring, FM CyberSecurity](https://fmcybersecurity.com/privacy.md): Slik behandler FM CyberSecurity AS personopplysninger fra besøkende, kunder og deltakere på arrangementer. Rettslig grunnlag, mottakere, lagringstid og dine rettigheter.

## Reference

- [Sitemap (XML)](https://fmcybersecurity.com/sitemap-index.xml): Full XML sitemap covering both locales.
- [Single-document corpus](https://fmcybersecurity.com/llms-full.txt): Every page concatenated into one Markdown file for long-context agents.
- [Agent skill (skill.md)](https://fmcybersecurity.com/skill.md): Capability cheat sheet for agents working with this site.