For us, cybersecurity is not about finding the most vulnerabilities. It is about understanding and reducing risk.
At Viking Line, we operate a diverse IT environment that includes customer-facing services, corporate IT, and systems supporting our operations both onshore and onboard our vessels.
As our environment continues to evolve, we wanted a more continuous way to identify and manage cyber risks rather than relying solely on periodic assessments. Traditional penetration tests are valuable, but they only provide a snapshot in time.
We looked for better visibility into our external attack surface and a way to identify risks before they became security incidents.
Looking Beyond Traditional Penetration Testing
An important part of this was gaining better oversight of services that belong to Viking Line but are developed, hosted, or maintained by external partners.
Even if we do not operate these services ourselves, they remain our responsibility from a security and business perspective. Having an independent view of their security helps us manage risk, follow up on supplier responsibilities, and ensure that security issues are addressed when needed.
We wanted to understand:
- What Viking Line assets are exposed to the internet
- Where potential weaknesses exist
- Whether credentials or sensitive information has been exposed
- Which findings represent real risk and should be prioritized
- How partner-managed services contribute to our overall attack surface
- Whether externally developed and maintained services meet our security expectations
Working with River Security
To support this approach, we partnered with River Security and adopted Active Focus together with targeted penetration testing.
What stood out to me was their ability to provide context, not just findings. Active Focus gives us continuous visibility into our external attack surface, helping us identify changes, exposures, and risks as they emerge.
The service has also strengthened our ability to follow up on services delivered by external partners and verify that security expectations are met.
From Visibility to Action
One of the biggest benefits is that we no longer have to wait for the next assessment cycle to understand our exposure. We can identify and address issues as they appear.
The findings are practical, relevant, and help us focus on the risks that matter most. This gives us a better basis for prioritization, decision-making, and discussions with both internal teams and external suppliers.
A Trusted Security Partner
We value partners who are practical, knowledgeable, and able to focus on what really matters. For us, cybersecurity is not about finding the most vulnerabilities. It is about understanding and reducing risk.
River Security helps us maintain visibility into our attack surface, identify issues that require attention, and verify that security controls are working as intended.
Just as importantly, penetration testing is not only about finding weaknesses. It is also a way of validating that investments, security controls, and development efforts have produced the expected result. For both our internal teams and our partners, an independent assessment provides valuable confirmation that the right things have been done.
A good penetration test should not only identify what needs improvement. It should also confirm what is working well. In my experience, that insight is just as valuable.
That combination of continuous visibility, independent verification, and practical guidance is why we see River Security as a trusted security partner.
Alexander Östergård, Head of IT Infrastructure & Security, Viking Line Abp
Customers often want to focus on what matters most to them. Active Focus helps them prioritize the actions that deliver the greatest value in the shortest possible time. I believe that’s exactly what we’re helping Viking Line achieve.