Upheads delivers managed IT, cloud, and security services to small and medium-sized organizations across Sweden and Norway. They have chosen Nimblr as their human risk management partner, helping customers reduce security risks related to human behavior through continuous security awareness training and realistic simulations.
Upheads has built Nimblr into its standard service package instead of offering it individually, making security awareness a natural part of the overall security offering. The training requires minimal day-to-day administration for Upheads’ consultants while giving customers greater visibility into human risk and helping employees become more security aware.
A changing threat landscape for SMBs
Security and AI are two of the most prominent themes for the customers of Upheads. Anton Ehn, Account Manager at Upheads explains: “There will always be network and IT infrastructure, but the two main concerns right now are definitely cybersecurity and AI. And we have different solutions and service packages for both.”
Upheads, however, realized they needed a human risk management solution to help customers reduce security risks related to human behavior. Awareness training is important for all types of businesses, and risk is not limited to a specific industry or company size. "The attacks are becoming increasingly sophisticated, and smaller and mid-sized businesses are by no means exempt. That makes strengthening the human layer of security increasingly important across our customer base", says Marcus Juvin, Technical Lead for Security and Compliance at Upheads Sweden.
From public sector bodies with stricter compliance requirements through to contractors running a business with a handful of employees, the need for awareness training was real, and Nimblr’s real-life simulations content was a great fit. “In our Security Operations Center, we see a lot of new threats that weren't prominent a year ago,” says Endre Bru, SOC Operations Manager at Upheads Norway.
"Attacks are becoming increasingly sophisticated. That makes strengthening the human layer of security increasingly important across our customer base."
Marcus Juvin, Technical Lead, Upheads.
Human risk management in a service bundle
Initially, Nimblr was delivered to customers as a standalone product, but when Upheads rebuilt their service offering, Nimblr was moved into a standard bundle. Anton elaborates: “When we rebuilt the solutions we provide, I wanted Nimblr in Upheads Evergreen, because it’s such a good compliment to what we provide for our customers. We have the infrastructure security, and then we can add the security training through Nimblr.”
In Sweden, Nimblr is now included in Upheads Evergreen, the company’s managed service for a modern and secure Microsoft 365 environment. Evergreen is built around the people using the environment rather than the environment alone, which is how Marcus describes the scope: “Evergreen is about the users. Secure the users, secure their Microsoft tenant.” With this approach, human risk management becomes a core part of Upheads’ security package.
In Norway, the team adopted a similar approach. Nimblr is also packaged into a recommended secure customer bundle by default and has wide application across their customer portfolio. As Endre puts it: “We bundle Nimblr into our Secure Employee package as standard, so the majority of our customer base can benefit from it.”
Being a default solution requires speed, ease, and satisfaction
A service only earns a place in a standard offering if it can be delivered efficiently and consistently at scale, and after onboarding Nimblr into the organization, Upheads can now onboard customers easily. Endre says: “It's easy. We have a team of nine people who are able to create new customers, and on a day-to-day basis, it's not a lot of work.”
For customers, it’s easy too, explains Anton: “It takes five minutes twice a month, so it's not a big deal, and customers realize that as well. And when they have it, there are no complaints. Nimblr is easy to win business with, and just as easy to set up. You integrate with Microsoft 365 and it is more or less done. After that it simply goes on, and requires very little ongoing administration.”
Providing a service that is both easy to work with for Upheads and easy to use for customers is paramount to ensure satisfaction all around. “Everything is working great,” says Marcus about Nimblr in Sweden. “We're really, really happy with the service, and it fits well into what we want to offer our customers. We just get more and more customers using it, so really good.”
In Norway, the picture is similar. Endre says: “We quickly resolve any issues with support, and the customers are generally happy and content with the product.”
"Nimblr is easy to win business with, and just as easy to set up."
Anton Ehn, Account Manager, Upheads.
Giving customers a new layer of visibility and confidence
Adding Nimblr to the portfolio has benefitted customers at all levels. For management, the appeal is visibility. Most of these organizations have no way of knowing whether their employees would recognize a phishing attempt until one arrives, and continuous training and simulations turn that into something they can see and improve. “CEOs get the reassurance that their organization at least knows what a phishing attack looks like,” says Endre. “One employee checking one more link before clicking could save them thousands, or worst-case millions, in ransom.” Anton adds: “It gives them confidence, knowing their employees are being tested, and they can see in the portal who clicks and who doesn’t.”
For employees, the commitment stays small enough that it never becomes friction. And the benefit of Nimblr is one to take home. Anton explains: “It's both professional and personal. Users learn to not click links at work and in their private life they are able to critically review an SMS from PostNord for instance, so it's beneficial in that way too.”
Room to grow across markets
Being able to provide security awareness training also gives Upheads another way to start conversations around security. As directives such as NIS2 and DORA raise the need for a human risk strategy, awareness climbs the agenda for organizations that had not previously considered it. “Some customers only want security awareness training,” says Marcus. “Often, they have a NIS2 requirement in the company or have had a breach.” These conversations can uncover additional security needs and create opportunities for broader conversations about the customer's security culture.
Bundling Nimblr into the standard offering has given Upheads a comprehensive security proposition in both markets, and one that expands as the group does. Both teams want to build the relationship further. “It has been a really good partnership from the beginning, very easy, no issues at all,” says Anton. “The people at Nimblr are a very good match with Upheads, and we would both benefit from working more and more together with new customers.”
