Icelandic food wholesaler Innnes has transformed its cybersecurity strategy following a penetration test, combining services from cybersecurity provider Syndis with Aftra’s attack surface management technology to improve visibility, vulnerability management and security awareness across the business.
For Innnes, a penetration test became the catalyst for a significant change in how the company approaches cybersecurity.
The largest food wholesaler in Iceland had grown considerably while its approach to security had not developed at the same pace. The issue became increasingly apparent following the company’s move to Reykjavik harbour in 2021, as its reliance on technology continued to increase.
“Not too long ago, Innnes was a typical Icelandic company with a warehouse,” said Tinna Harðardóttir, CTO at Innnes, according to a case study published by cybersecurity company Aftra.
The turning point came when Innnes underwent a penetration test conducted by Icelandic cybersecurity company Syndis. The exercise highlighted that the organisation lacked a comprehensive view of how its infrastructure appeared externally and had limited oversight of its wider digital footprint and attack surface.
The findings helped demonstrate the scale of the challenge to senior management and strengthened the case for further investment in cybersecurity.
Innnes subsequently expanded its relationship with Syndis, initially using the company’s Security Operations Centre before adding security management services. The company says it has completed preparatory work for NIS2 and is also working towards ISO 27001.
Its relationship with Syndis subsequently led Innnes to adopt Aftra’s Attack Surface Management technology, adding continuous monitoring of threats and vulnerabilities to its security operations.
The platform provides Innnes with a consolidated view of its external attack surface and identifies vulnerabilities requiring attention. When an issue is identified, the company’s Chief System Administrator can investigate and remediate it.
“We feel like we can manage our security and our assets better, now that we have an overview of everything in one place,” said Berglind Grímsdóttir, CISO at Innnes, according to the Aftra case study.
The company has also introduced a security scoring system that provides employees and senior management with a measurable indication of its security posture. Innnes says its score has risen to 95 out of 100 since adopting the platform.
The metric has also helped make cybersecurity more accessible to people outside the IT and security functions. According to the case study, the company’s CEO has become an active supporter of the security programme and has shared its security score with employees during a company meeting.
“The Security Score is very tangible for the whole team, from the CEO down to each employee, and you get competitive about it,” Grímsdóttir said in the Aftra case study.
Harðardóttir also uses the dashboard regularly to track whether the organisation is maintaining its progress.
“I go into the Aftra dashboard many times a week just to see if we’re maintaining the progress we’ve accomplished since implementing the platform,” she said in the case study.
The cybersecurity programme has extended beyond technology. Innnes has introduced campaigns showing employees information about their own digital footprints, helping staff understand the potential security implications of using corporate accounts for personal online activity.
This has been particularly relevant for employees who have been with the organisation for many years and accumulated a larger digital footprint during a period when separating corporate and personal online activity was less widely emphasised.
Innnes has also sought to establish a culture in which employees are encouraged to report security mistakes rather than conceal them. This includes incidents such as clicking a suspicious link, allowing the security team to respond rather than discovering the event later.
The company’s approach demonstrates how a technical security assessment can become the starting point for a broader organisational change. What began with a penetration test exposing gaps in external visibility has developed into a programme combining continuous monitoring, vulnerability management, employee awareness and greater involvement from senior leadership.
For Harðardóttir, improving cybersecurity remains an ongoing process rather than a destination.
“It’s like walking Everest, you have your milestones,” she said in the Aftra case study.
Innnes is also willing to discuss its experience publicly in the hope that other organisations can learn from its approach.
“We have a social responsibility to share our story,” Harðardóttir said in the case study.
