Not Bad Security Oy
Not Bad Security Oy is an employee-owned Helsinki-based cybersecurity consulting firm, founded in 2022, specializing exclusively in Microsoft security (Entra ID, Defender, Sentinel, Intune, Copilot for Security) and serving enterprise and mid-market organizations in Finland and the Nordic/Baltic region through custom-quote advisory, implementation, and incident-response engagements.
- Company typePrivate
- Founded2022
- HeadquartersHelsinki, Finland
- Headcount1–10
- GTM typeB2B
- OfferingServices
What Not Bad Security Oy does
Not Bad Security Oy is a Helsinki-based, employee-owned cybersecurity consulting firm founded in early 2022 by Jussi Roine and Antti Kujamäki. The firm specializes exclusively in the Microsoft security ecosystem — Microsoft Entra ID (Azure AD), Microsoft Intune, Defender for Cloud, Defender for Endpoint, Microsoft Sentinel SIEM, Microsoft Purview, Microsoft 365 Backup, and Microsoft Copilot for Security — and extends the same Zero Trust, identity-governance, and SIEM/SOC design expertise into hybrid and multi-cloud environments (Azure, Google Cloud, AWS). The team of approximately six to seven includes two Microsoft MVPs, multiple MCTs, and senior security architects with 20+ years of relevant experience, with Jukka Kettunen joining as Senior Security Advisor in August 2023 to deepen multi-cloud and networking coverage. Services are priced on a custom-quote basis for paid engagements, with free 1-hour Microsoft 365 and Azure security audits conducted via Microsoft Teams functioning as the customer acquisition funnel, and are delivered primarily to enterprise and mid-market organizations in Finland and the broader Nordic/Baltic region. Marketing is content-driven via a substantial Finnish-language technical blog, Microsoft MVP-channel visibility, and speaker appearances at Microsoft Build, Ignite, and the European Power Platform Conference. Revenue is generated entirely from professional services (assessments, implementation projects, advisory roles, and reactive incident response); the firm does not ship software, does not maintain an API or SDK, and does not offer 24/7 on-call monitoring.
Not Bad Security Oy firmographics
Firmographics- Name
- Not Bad Security Oy
- Legal name
- Not Bad Security Oy
- Website
- https://notbadsecurity.com
- Company type
- Private
- Founded year
- 2022
- Operating status
- Operating
- Headcount range
- 1–10 employees
- Short description
- Not Bad Security Oy is an employee-owned Helsinki-based cybersecurity consulting firm, founded in 2022, specializing exclusively in Microsoft security (Entra ID, Defender, Sentinel, Intune, Copilot for Security) and serving enterprise and mid-market organizations in Finland and the Nordic/Baltic region through custom-quote advisory, implementation, and incident-response engagements.
- Ownership category
- akta.pro rank
Not Bad Security Oy industry classification
Industry- Product category
- Cybersecurity Consulting Services
- SIC
- Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- Security Architecture & Engineering Advisory (Zero Trust, IAM, Network) (BPAKADAF)
- akta.pro secondary industries
- Access Management & Policy Enforcement (Zero Trust) (BPAMAEAH), Network Security Services (Firewall/VPN/ZTNA/SASE Integration) (BPAEAEAG), Endpoint Security for End Users (EDR/XDR, Patch/Vuln, Zero Trust Endpoint) (BPAEAIAG)
Keywords
Where Not Bad Security Oy is headquartered
LocationHeadquarters
- HQ city
- Helsinki
- HQ country
- Finland
- HQ region
- Europe
Offices1 record
Markets served
Not Bad Security Oy business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Marketing or Sales, Operations, Technology or R&D
Revenue model
- Professional Services — Security Consulting: Core revenue stream from billable security consulting engagements. Services include security assessments, architecture design, implementation projects, and advisory roles for Microsoft 365, Azure, and hybrid environments. Engagements are scoped and delivered directly by senior security architects.
- Free Security Audits (Lead Generation): Free Microsoft 365 and Azure security audits conducted as 1-hour Microsoft Teams sessions, producing a written report with findings, gaps, recommended improvements, and next steps. These audits serve as a customer acquisition and scoping tool leading to paid engagements.
- Project and Advisory Roles: The company operates in challenging project, initiative, and advisory roles. Work includes reactive incident response (e.g., data breaches), architecture design, and implementation. The company explicitly does not offer 24/7 on-call services as of 2024.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | One-time | Free Microsoft 365 Security Audit |
| Freemium | One-time | Free Microsoft Azure Security Audit |
| Subscription | Monthly | Entra Suite (Microsoft licensing reference) |
| Subscription | Monthly | Microsoft 365 Copilot (Microsoft licensing reference) |
| Subscription | Monthly | Defender for Servers (Microsoft licensing reference) |
| Usage-based | Pay-as-you-go | Microsoft 365 Backup (Microsoft licensing reference — preview) |
Go-to-market motion1 record
Distribution channels3 records
Marketing channels5 records
Not Bad Security Oy product offering
Product offeringCore offering
Not Bad Security Oy is a Microsoft security consulting firm that delivers security audits, architecture design, implementation projects, and advisory services for organizations using Microsoft 365, Azure, and hybrid environments. The practice spans Zero Trust architecture, identity and access management (Microsoft Entra ID), endpoint security (Intune, Defender for Endpoint), SIEM (Microsoft Sentinel), PKI modernization, and Microsoft Copilot for Security advisory, starting with free Microsoft 365 and Azure security audits.
Product overview
Not Bad Security Oy is a consulting company specializing in Microsoft security solutions, not a software product vendor. The company offers a portfolio of security consulting services including free Microsoft 365 and Azure security assessments, security implementation consulting, Zero Trust architecture design, identity management, endpoint security (Intune/Defender), network design/VPN, and PKI infrastructure services. Key technology domains include Microsoft Entra ID, Microsoft Intune, Defender for Cloud, Defender for Endpoint, Microsoft Sentinel, Conditional Access, Microsoft Defender, Log Analytics, and Zero Trust frameworks. The company operates in hybrid and multi-cloud environments supporting Microsoft 365, Azure, Google Cloud, and Amazon Web Services.
Differentiator
Problem solved
Functional benefit
Products and services
- Microsoft 365 Security Review (Microsoft 365 Tietoturvakatselmointi)
Quantifiable outcome
- Free security audits (Microsoft 365 and Azure) result in a clear written report with findings, gaps, recommended improvements, and next steps, delivered in a 1-hour Teams session.
- +2 more outcomes
Companies that use Not Bad Security Oy
Customer profileSegments2 records
Ideal customer profiles1 record
Not Bad Security Oy technology and API
TechnologyTechnology focussed No
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature7 records
Not Bad Security Oy partnerships and signals
Strategic signalPartnerships
Three partnerships are on record, tiered minor and core.
- North AdvisorsminorNorth Advisors is a Finnish technology advisory firm. Jussi Roine is associated with both Not Bad Security and North Advisors. The relationship appears to be a professional network/affiliation rather than a formal business partnership.
- CorelliaminorCorellia is a Finnish technology company. Jussi Roine is associated with both Not Bad Security and Corellia as part of a broader professional network including his brother Antti Roine. The relationship appears to be personal/informal network affiliation rather than a formal business partnership.
- MicrosoftcoreNot Bad Security is a Microsoft-centric security consulting firm that operates within the Microsoft ecosystem, implementing and advising on Microsoft security products including Microsoft 365, Azure, Microsoft Entra ID, Defender, Sentinel, Intune, and Copilot for Security. The company has Microsoft MVPs on staff and is recognized by Microsoft as a Partner of the Year Impact Creator. The firm 'dogfoods' Microsoft security solutions internally.
Scale indicators4 records
Recent moves5 records
Expansion highlights5 records
Not Bad Security Oy competitors and assessment
Company assessmentBroad incumbents
- Capgemini: Global IT services firm with a large cybersecurity and Microsoft alliance practice, frequently co-selling Microsoft security transformations to multinational clients. Competes for the same large enterprise Microsoft security work as NBS but offers global delivery, 24/7 SOC, and managed services at hyperscale.
- CGI: Global IT and business consulting services firm with deep Nordic presence (significant Finnish operations post-Logica acquisition). Overlaps with NBS through enterprise security consulting, Microsoft implementations, and managed services, but operates across all IT domains at vastly greater scale.
- Accenture Security: Global consulting giant with a dedicated Accenture Security practice spanning strategy, implementation, and managed services, including Microsoft security partnerships. Overlaps with NBS on enterprise security transformation deals but at vastly greater scale and with global delivery capability.
- TietoEVRY: Nordic-headquartered IT services and software company (formed from Tieto + EVRY merger) with extensive managed security, cloud, and Microsoft practice. Competes for Nordic enterprise security work alongside NBS but at substantially larger scale and broader portfolio scope.
Direct peers
- Orange Cyberdefense: European cybersecurity services arm of Orange, providing MSSP, consulting, threat intelligence, and incident response across 10+ European countries. Comparable as a cybersecurity consulting/MSSP competitor for enterprise Microsoft security work in Europe, with much greater scale and 24/7 SOC capability.
- Nixu (DNV Cyber): Nordic-origin cybersecurity consultancy that merged into DNV in 2024; provides security advisory, managed detection, and identity/Zero Trust services across the Nordics and broader Europe. Highly comparable business model to NBS — security services firm specializing in advisory and implementation — but materially larger scale and broader service portfolio.
- Innofactor: Largest Nordic Microsoft-focused IT solutions provider, delivering Microsoft 365, Azure, and Dynamics implementations with a strong security practice. Direct comparable as a Nordic Microsoft partner competing for similar mid-market and enterprise Microsoft security implementation work.
- Truesec: Swedish cybersecurity consultancy specializing in incident response, managed detection, and security advisory across the Nordics. Comparable as a Nordic cybersecurity specialist with overlapping enterprise advisory and IR services, though Truesec has broader geographic reach and a larger team.
- WithSecure: Finnish-headquartered cybersecurity company (formerly F-Secure's enterprise business), publicly listed, providing managed detection, consulting, and software security across the Nordics and Europe. Comparable as a Finnish cybersecurity specialist with a similar enterprise customer base, though WithSecure is far larger and offers proprietary software products.
Emerging players
- Hoxhunt: Helsinki-based cybersecurity company providing AI-powered security awareness and phishing simulation, operating globally. Comparable as a Finnish-headquartered cybersecurity firm with international reach, though Hoxhunt is a product/SaaS business rather than a consulting firm — adjacent rather than directly competitive.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat3 records
Key risks5 records
Key highlights6 records
Customer concentration
Not Bad Security Oy social profiles
Digital presenceNot Bad Security Oy financial estimates
Financial estimateRevenue estimate
Valuation estimate
Not Bad Security Oy leadership team
Management profileNumber of profiles
Profiles4 records
Not Bad Security Oy funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Not Bad Security Oy M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Not Bad Security Oy
What does Not Bad Security Oy do?
Not Bad Security Oy is a Microsoft security consulting firm that delivers security audits, architecture design, implementation projects, and advisory services for organizations using Microsoft 365, Azure, and hybrid environments. The practice spans Zero Trust architecture, identity and access management (Microsoft Entra ID), endpoint security (Intune, Defender for Endpoint), SIEM (Microsoft Sentinel), PKI modernization, and Microsoft Copilot for Security advisory, starting with free Microsoft 365 and Azure security audits.
Is Not Bad Security Oy a public or private company?
Not Bad Security Oy is a private company. It is classified as management employee owned and is currently operating.
When was Not Bad Security Oy founded?
Not Bad Security Oy was founded in 2022. It employs 1 to 10 people.
Where is Not Bad Security Oy based?
Not Bad Security Oy is headquartered in Helsinki, Finland, in the Europe region.
How does Not Bad Security Oy make money?
Three revenue lines are on record. Professional Services — Security Consulting is the primary driver. The others are free Security Audits (Lead Generation) and project and Advisory Roles.
Who are Not Bad Security Oy's main competitors?
Broad incumbents on record are Capgemini, CGI, Accenture Security and TietoEVRY. Direct peers are Orange Cyberdefense, Nixu (DNV Cyber), Innofactor, Truesec and WithSecure. Hoxhunt is listed as an emerging player.
Does Not Bad Security Oy have an API?
No public API is recorded for Not Bad Security Oy.
What industry is Not Bad Security Oy in?
Not Bad Security Oy's product category is Cybersecurity Consulting Services. Its primary akta.pro industry code is BPAKADAF, Security Architecture & Engineering Advisory (Zero Trust, IAM, Network), with a secondary code of BPAMAEAH, Access Management & Policy Enforcement (Zero Trust). Its SIC code is 7370.