OR Security
OR Security is a Budapest-based, founder-led cybersecurity and data protection advisory practice serving European mid-market and enterprise organizations with recurring vCISO and vDPO support and project-based technical security services across healthcare, gaming, retail, automotive, and other regulated sectors.
- Company typePrivate
- Founded2020
- HeadquartersBudapest, Hungary
- Headcount1–10
- GTM typeB2B
- OfferingServices
What OR Security does
OR Security is a founder-led cybersecurity and data protection advisory practice headquartered in Budapest, Hungary, with a German-language operating presence reflected in a +49 freephone contact line and a stated preference for European data processing locations. The firm was founded around 2020 by Örs Apor Horváth, who began his career in the hacker community in 1996 and brings 25+ years of experience across red team, purple team, blue team, threat intelligence, social engineering, cloud security, and vCISO leadership; the senior practitioner circle reportedly contributes more than 100 years of cumulative professional experience.
The company's offerings sit in three interconnected service lines. vCISO provides recurring executive security leadership covering board reporting, security strategy, risk prioritization, and regulatory readiness for frameworks including NIS2, DORA, GDPR, and ISO 27001. vDPO delivers recurring data protection officer support spanning GDPR governance, records of processing activities, DPIA assistance, data subject request handling, and incident response. Technical Security Services covers security assessments, gap reviews, vulnerability assessment, scoped OWASP-aligned penetration testing, cloud security review across AWS, Azure, and GCP, architecture review, secure development support, and security awareness training. There is no proprietary software product or platform; the firm operates as a services practice.
OR Security's business model is predominantly recurring engagement-based for vCISO and vDPO, with project-based and interim leadership work where scope is well-defined, and project-based delivery for technical security work. Pricing is opaque and determined per engagement. The firm grows primarily through long-standing relationships and word of mouth, supplemented by consultative direct outreach, a professional website, measured media commentary, and ecosystem partnerships with the European Cyber Security Organisation (ECSO), Women4Cyber, Hackrate, and Scirge. Named customers span healthcare (Data4Life, Healthmetrix), medical technology (DiaMonTech), natural products retail (Sunday Natural), gaming (Deutsche Gesellschaft für Glücksspiel), automotive (CarOnSale), equipment finance (Flexcavo), and project management (Projx).
OR Security firmographics
Firmographics- Name
- OR Security
- Legal name
- OR Security
- Website
- https://or.security
- Company type
- Private
- Founded year
- 2020
- Operating status
- Operating
- Headcount range
- 1–10 employees
- Short description
- OR Security is a Budapest-based, founder-led cybersecurity and data protection advisory practice serving European mid-market and enterprise organizations with recurring vCISO and vDPO support and project-based technical security services across healthcare, gaming, retail, automotive, and other regulated sectors.
- Ownership category
- akta.pro rank
OR Security industry classification
Industry- Product category
- Cybersecurity Advisory & Data Protection Services
- NAICS
- Computer Systems Design and Related Services (54151)
- SIC
- Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- Executive/Board Security Advisory & Risk Briefings (BPAKADAK)
- akta.pro secondary industry
- Cybersecurity Operations Outsourcing (SOC / SecOps) (BPAEAMAG)
Keywords
Where OR Security is headquartered
LocationHeadquarters
- HQ city
- Budapest
- HQ country
- Hungary
- HQ region
- Europe
Offices1 record
Markets served
OR Security business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Operations, Marketing or Sales, Technology or R&D
Revenue model
- vCISO Services: Virtual Chief Information Security Officer support providing executive security leadership, board-level reporting, security strategy, risk prioritization, and roadmap delivery. Most engagements are recurring with project-based or interim leadership support available.
- vDPO Services: Virtual Data Protection Officer support for GDPR governance, privacy oversight, records of processing activities, DPIA support, data subject requests, and incident/breach support. Regular recurring support is the most common model with project-based privacy governance also available.
- Technical Security Services: Focused technical work including security assessments, gap reviews, third-party/SaaS review, incident readiness, vulnerability assessment, scoped penetration testing, cloud security review, architecture review, and secure development support. Scope-dependent project work.
- Security Awareness and Training: Education and awareness work including awareness sessions, role-based training, campaign planning, and phishing-resilience exercises. Often combined with vCISO and vDPO support.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Other | Multi-year contract | Custom-scoped professional services |
Go-to-market motion4 records
Distribution channels2 records
Marketing channels4 records
OR Security product offering
Product offeringCore offering
OR Security provides senior cybersecurity advisory services through three offerings: a virtual CISO (vCISO) function delivering executive security leadership, strategy, and board-level reporting; a virtual DPO (vDPO) function providing independent GDPR and privacy governance; and Technical Security Services covering security assessments, scoped penetration testing, cloud security review, architecture review, secure development support, and security awareness training. Engagements are scoped per client and delivered as a combination of recurring advisory retainers and project-based work for European mid-market and enterprise organizations.
Product overview
OR Security offers a portfolio of three interconnected advisory and technical security services: vCISO (Virtual Chief Information Security Officer) for executive security leadership and strategy; vDPO (Virtual Data Protection Officer) for GDPR and privacy governance; and Technical Security Services covering security assessments, penetration testing, cloud security review, architecture review, and security training. The offerings are designed to be combined flexibly — for example, vCISO and vDPO services can be paired when security and privacy oversight need to move together, and technical services can be linked to management reporting and privacy obligations.
Differentiator
Problem solved
Functional benefit
Products and services
- vCISO (Virtual Chief Information Security Officer) Senior security leadership advisory service providing executive security strategy, governance, risk management, board-level reporting, regulatory compliance support (NIS2, DORA, GDPR, ISO 27001), awareness work, and programme delivery for organisations needing CISO-level guidance without a full-time hire. Engagements are recurring with project-based or interim leadership support available where scope is defined.
- vDPO (Virtual Data Protection Officer) Independent data protection and privacy governance advisory service providing GDPR oversight, records of processing activities, DPIA support, data subject request (DSAR) handling, incident and breach support, and regulatory authority interaction. Most engagements are recurring with project-based privacy governance also available.
- Technical Security Services Focused technical security work including security assessments and gap reviews, third-party and SaaS vendor review, incident readiness, vulnerability assessment, scoped penetration testing (OWASP-aligned), cloud security review across AWS, Azure and GCP, architecture and solution review, secure development support, and security awareness and training. Often combined with vCISO and vDPO support.
Quantifiable outcome
- No known record of compromise or data breach across managed systems and organizations
Companies that use OR Security
Customer profileNamed customers8 records
Segments5 records
Ideal customer profiles4 records
OR Security technology and API
TechnologyTechnology focussed No
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature1 record
OR Security partnerships and signals
Strategic signalPartnerships
Two partnerships are on record, tiered core.
- European Cyber Security Organisation (ECSO)coreStrategic partnership with ECSO, the European Cyber Security Organisation. Collaboration focused on advancing cybersecurity across Europe through joint initiatives, knowledge sharing, and ecosystem development.
- Women4CybercoreStrategic partnership with Women4Cyber, supporting inclusive cybersecurity communities. Alignment with OR Security's commitment to diverse and inclusive cybersecurity professional communities.
Scale indicators3 records
Recent moves6 records
Expansion highlights4 records
OR Security competitors and assessment
Company assessmentBroad incumbents
- NCC Group: UK-listed global cybersecurity firm with a large advisory, assurance, and managed services portfolio — competes in the vCISO and security consulting space across Europe but at significantly greater scale and breadth.
- Trustwave: Global cybersecurity firm offering managed security, consulting, and advisory services including vCISO-style leadership — overlaps with OR Security's services portfolio but operates at far greater scale.
- Optiv: Large US-headquartered security solutions integrator and advisory firm serving enterprise clients globally — competes with OR Security in the vCISO/cybersecurity advisory space but at much larger scale and geographic reach.
- WithSecure (formerly F-Secure): Nordic-headquartered cybersecurity firm with a dedicated consulting arm covering strategy, governance, and risk advisory — overlaps with OR Security's vCISO/GRC offerings while adding a large product business.
- Kudelski Security: Swiss-based global security consultancy offering advisory, managed detection and response, and security testing — comparable European positioning and advisory-led delivery model to OR Security.
- DNV Cyber (formerly Nixu): European cybersecurity services business following DNV's acquisition of Nixu, providing advisory, managed security, and assurance to enterprise and mid-market clients across the Nordics and wider Europe.
Direct peers
- Convergent Risks: European consultancy providing integrated privacy and security advisory, including vDPO and security leadership services — directly mirrors OR Security's combined vCISO + vDPO positioning.
- Bridewell: UK-based cybersecurity services firm offering vCISO, penetration testing, managed security, and security advisory — directly comparable to OR Security's vCISO + technical security services model and European mid-market focus.
- SecAlliance: European threat-intelligence-led security advisory firm providing vCISO-style strategic security services to mid-market and enterprise clients — closely aligned with OR Security's advisory-heavy, recurring engagement model.
Emerging players
- SureCloud: UK-based cybersecurity services and GRC software firm offering penetration testing, compliance, and advisory services — comparable to OR Security's mid-market cybersecurity advisory positioning in the UK/European market.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat3 records
Key risks6 records
Key highlights7 records
Customer concentration
OR Security social profiles
Digital presenceOR Security financial estimates
Financial estimateRevenue estimate
Valuation estimate
OR Security leadership team
Management profileNumber of profiles
Profiles1 record
OR Security funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
OR Security M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about OR Security
What does OR Security do?
OR Security provides senior cybersecurity advisory services through three offerings: a virtual CISO (vCISO) function delivering executive security leadership, strategy, and board-level reporting; a virtual DPO (vDPO) function providing independent GDPR and privacy governance; and Technical Security Services covering security assessments, scoped penetration testing, cloud security review, architecture review, secure development support, and security awareness training. Engagements are scoped per client and delivered as a combination of recurring advisory retainers and project-based work for European mid-market and enterprise organizations.
Is OR Security a public or private company?
OR Security is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was OR Security founded?
OR Security was founded in 2020. It employs 1 to 10 people.
Where is OR Security based?
OR Security is headquartered in Budapest, Hungary, in the Europe region.
How does OR Security make money?
Four revenue lines are on record. vCISO Services are the primary driver. The others are vDPO Services, technical Security Services and security Awareness and Training.
Who are OR Security's main competitors?
Broad incumbents on record are NCC Group, Trustwave, Optiv, WithSecure (formerly F-Secure), Kudelski Security and DNV Cyber (formerly Nixu). Direct peers are Convergent Risks, Bridewell and SecAlliance. SureCloud is listed as an emerging player.
Does OR Security have an API?
No public API is recorded for OR Security.
What industry is OR Security in?
OR Security's product category is Cybersecurity Advisory & Data Protection Services. Its primary akta.pro industry code is BPAKADAK, Executive/Board Security Advisory & Risk Briefings, with a secondary code of BPAEAMAG, Cybersecurity Operations Outsourcing (SOC / SecOps). Its NAICS code is 54151 and its SIC code is 7370.