Built to trust.

AI, cloud and compliance from Scandinavia.

Secure cloud. Governed AI. Compliance you can prove.

For regulated sectors, municipalities and government agencies across Sweden and the Nordics.

Between the consultancies and the tools

Large consultancies bring breadth but rarely someone who does the work themselves. Pure tools bring data but nobody to interpret it. Creedcon sits in between: specialised in security platforms such as Microsoft’s, Wiz and CrowdStrike, with a product that makes the analysis repeatable.

That means the same company can both find the gaps and fix them, and you always get to see what an analysis is based on.

We build security you can trust.

We respect what already works and bring in the new with care.

Cloud and infrastructure
Know what runs. Secure what matters.
From architecture to deploying and running systems and servers in Azure, AWS and GCP, with security built in: Microsoft Sentinel and Defender, log ingestion and API security.
Compliance and security audits
Prove it.
Security audits of your IT environment and vulnerability assessments, gap analysis against NIS2, DORA and the EU AI Act, audit preparation, and supplier and vendor reviews.
AI security and governance
Use AI with confidence.
Risk assessment, AI governance, secure harnesses for AI agents and a plan for secure adoption.
Management
At the helm.
Interim security lead, interim IT or security manager, vendor management and security strategy for leadership teams.

All services

Products

Tools that make our analysis repeatable.

At launch: Azure and Microsoft 365. Next: AWS.

Filter the noise. Illuminate with AI.

Qimbas™ shows what your logs really cover, finds the patterns hiding in the noise, models the threats to what you actually run, and tells you where you stand against frameworks like SOC 2, NIS2 and DORA, with the evidence ready for your auditor.

See what your logs really cover, and where they have gone quiet
Find the patterns hiding in the noise, just by asking
Model the threats to what you actually run, with STRIDE
Know where you stand against SOC 2, NIS2, DORA and more

Launching in Q4 2026.

All products

How an engagement works

First conversation
We go through your situation, your systems and what you want to achieve.
Current state
We review the environment and document what works and where the gaps are.
Remediation
We prioritise together and carry out the work in your environment.
Handover
You receive documentation, evidence for audits and a plan for what remains.

Regulation that affects you

Four EU acts shape security work in the sectors we serve. We help you understand what applies to you and show that you meet it.

Key dates in the EU acts
Date	Act	What happens
1 Aug 2024	EU AI Act	Enters into forcePast
17 Oct 2024	NIS2	Deadline for transposition into national lawPast
17 Jan 2025	DORA	Starts to applyPast
2 Feb 2025	EU AI Act	The prohibitions applyPast
2 Aug 2025	EU AI Act	Rules for general-purpose AI models applyPast
2 Aug 2026	EU AI Act	Most of the rules applyPast
11 Sep 2026	CRA	Reporting of actively exploited vulnerabilities appliesPast
Today
2 Dec 2027	EU AI Act	Requirements for high-risk AI systems applyNext
11 Dec 2027	CRA	Most other obligations applyUpcoming
2 Aug 2028	EU AI Act	Requirements for high-risk AI in regulated products applyUpcoming

NIS2: The EU directive on cybersecurity for essential and important entities. It requires risk management, incident reporting, supply-chain security and management accountability. Member states were to transpose it into national law by 17 October 2024. In Sweden that is the Swedish Cybersecurity Act (cybersäkerhetslagen), which has applied since 15 January 2026 and also covers municipalities, regions and a number of government agencies.
DORA: The EU regulation on digital operational resilience in the financial sector. It has applied to financial entities and their critical ICT third-party providers since 17 January 2025, with requirements on ICT risk management, incident reporting, resilience testing and third-party contracts.
EU AI Act: The EU regulation on artificial intelligence. It sets risk-based requirements on how AI systems may be developed and used, with prohibited practices and obligations for high-risk systems. It entered into force on 1 August 2024 and applies in stages: most of it from 2 August 2026, the requirements for high-risk systems from 2 December 2027, and those for AI in products covered by EU product safety rules from 2 August 2028.
CRA: The EU regulation on cybersecurity requirements for products with digital elements, such as hardware and software. It requires secure design, vulnerability handling and security updates throughout the support period, and applies to manufacturers, importers and distributors. Reporting of actively exploited vulnerabilities has applied since 11 September 2026; most other obligations apply from 11 December 2027.

National implementation and transition periods can change. We always check what applies to your organisation.

15+years in IT and information security, over ten of them as a consultant.

Who you work with

Creedcon is run by its founder. The background is hands-on: cloud security architecture, Microsoft Sentinel, API security, Azure infrastructure, log ingestion pipelines, security auditing and vendor management, in banking and finance, energy, aviation and logistics, manufacturing with strict uptime requirements, and the public sector, in several countries.

About Creedcon