A security or IT services firm gets on the list when a company has to meet NIS2 by being the firm the answers can describe: a page for each service that says what it covers, who does the work and where, what the client gets at the end, and which certificates stand behind it, in Swedish and in English. Throughline reads what the assistants tell security and IT buyers every week, which firms they name and from which pages, and drafts the pages that are missing.
This page is for an IT consultancy, managed service provider, managed security provider or pen-testing firm of ten to two hundred people, selling to companies and public bodies in the Nordics and Europe. Work comes through referrals, platform partnerships and tenders. The consultants are respected, and their own LinkedIn posts carry much of the reputation. The site is a list of services and a contact form, and new rules are bringing in buyers who have never bought security services and do not know whom to ask, so they ask an assistant. Smaller companies newly covered by the law have no security team of their own, and DORA sends banks, insurers and their IT suppliers looking for a partner who can test and report on time.
What do the answers say, service by service?
A buyer brought into scope by a new rule asks for help with each piece of it. This is a week of those questions, who was named, and what each answer had to go on for this firm.
What does Throughline read for a security or IT services firm?
The firm’s own record first. The CRM (HubSpot or Dynamics) gives every enquiry, tender and renewal; the booking tool gives every first call and where the buyer heard of the firm; Search Console shows which service pages are found and for what; the webinar platform shows who stayed for the NIS2 session; and LinkedIn shows which consultants’ posts the buyers engaged with, since that is where most of the firm’s reputation lives.
Then the questions. The weekly watch asks ChatGPT, Claude, Gemini and Perplexity what a security or IT lead asks: who can help us meet NIS2 and how fast, who answers when something happens at night, whether the analysts and the data stay in Sweden or the EU, what a pen test covers and what the report looks like, how to tell whether security spending works. It asks in Swedish and in English, “Vem kan hjälpa oss att uppfylla NIS2?” beside its English twin, and records who is named and which pages each answer leans on.
And the triggers. Deadlines under new security laws, guidance from the national authorities, an incident in the sector, an audit or an insurance renewal each start a search. The scouts watch for them, and for tenders and framework agreements in the firm’s regions, so the page that answers the new question is ready when the search starts.
What does it find when buyers look for security help?
The findings are about being describable: which questions the firm is named for, which it loses for want of a page, and what moved with enquiries.
Enquiries moved with the weeks the firm published its NIS2 explainers, not with the months of paid search on security terms.
Asked for a 24/7 SOC with analysts in Sweden, the answers name two larger firms from their service pages and describe this firm from its LinkedIn page.
Meetings moved with the weeks two consultants posted about recent incidents, and the posts link to nothing on the firm’s site.
What do the agents draft for a services firm?
The pages a new buyer needs before they call, in Swedish and English: one page per service that says what it covers, who does it, where they sit and what the client receives; a sample pen-test report and a sample runbook with client details removed; a NIS2 explainer for each obligation buyers ask about; a certificates page; tender-ready answers kept current; and posts the consultants can publish under their own names with somewhere to link. A partner approves each piece, and nothing goes out without that yes.
Every page is tested against the questions buyers ask before it goes live, and read again a week later.
- PageSOC page: who answers, where, what you get$6.40
- PageNIS2 explainer, Swedish and English$6.40
- PageSample pen-test report, client details removed$6.40
- BriefTender answers kept current$2.60
- Video45s from the NIS2 webinar$10.80
- SocialFour posts for two consultants$1.20
That is one week’s queue. If a draft takes more runs to get right, those runs are on us, never on the bill.
Which numbers move, and by how much?
A firm known by referral is invisible to a buyer nobody referred, and new rules are bringing in exactly those buyers. The firm moves from described to named when each service has a page an answer can quote, in both languages, with the certificates and the location stated. Over two quarters it is named for the services it is best at, the consultants’ posts lead somewhere, and enquiries that did not come by referral rise. How fast depends on how many services the firm can describe with real deliverables.
| The number | How it moves | What the size of the move depends on |
|---|---|---|
| Named in answers to security and IT questions | Service by service, starting with the ones the firm is known for | How specific each service page is about scope and location |
| Enquiries that were not a referral | Rise with each obligation that has its own page | How many organisations in the firm’s regions are newly in scope |
| Swedish answers that name the firm | Catch up with the English ones as pages are published in both | Whether the firm works in Swedish with its clients |
| Consultant posts that lead to a page | From none to every post, with a page on its topic | How often the consultants post |
| Time from new guidance to the page that answers it | From months to the same week | Who signs off on technical and legal wording |
The larger firms are named because their services have pages. A smaller firm that describes its work plainly, in both languages, is as easy to name.
What happens in the first thirty days?
- Week 1Throughline reads the CRM, the booking tool, search, the webinar platform and the consultants’ LinkedIn, and starts the weekly watch in Swedish and English.
- Week 2The first briefing: each buyer question, who is named, what the answers say about the firm, and which services have no page.
- Week 3The first service page, the NIS2 explainer and the sample report are drafted and approved.
- Week 4The first receipt: what shipped, what it cost, what moved.
Questions people ask
Most of our work comes from tenders. Does this help there?
Tenders are scored on their own criteria. The pages help before a tender is written, when the buyer is deciding whom to invite and what to ask for, and the tender answers stay current in the same queue.
We cannot name our clients. Can we still show proof?
Yes. A sample report, a sample runbook and a description of the kind of client and the problem show the work without a name. Anything that names a client goes to them first.
Our consultants already post on LinkedIn. What changes?
Their posts get a page to link to, and the briefing shows which topics moved with meetings, so the next post builds on what worked.
Who on our team approves the work?
Usually a partner, with the consultant who owns the service checking anything technical. Every approval happens in one queue.
Where do we start?
With the Visibility Report: a week of the questions your buyers ask, in Swedish and English, and who is named. The call after it sets the scope.