Writing a security policy is the easy part. Getting people across an organization to act on it, in their own roles, languages, and working hours, is harder. The five CISOs below, one each from Finland, Denmark, Sweden, Norway, and Iceland, have made that problem central to their work. They lead security at a media group, a public broadcaster, a state-owned gaming company, a bank, and a food importer, and each has found a different way to turn rules into everyday decisions.
Maciej WĹ‚odarczyk – CISO, Sanoma Media Finland
Imagine it is 1492, and Christopher Columbus asks you, his CISO, to approve a voyage west with no maps and no proof it can be done. Maciej Włodarczyk uses that scenario to explain how he sees the job. A “classical” CISO would say the risk is too great, and would be right, but the organization would never discover America. His alternative is to understand what the business wants and why, make sure the risks are clearly understood, and then offer practical help: take at least three ships for redundancy, and pack food that keeps. As CISO of Sanoma Media Finland since 2024 and a member of its Tech and Data Management Board, he leads security strategy and governance and has built networks of security champions, known for translating cyber risk into terms that work from the boardroom to the development team. He came to security from software, starting as an engineer at TietoEnator in 2005, and later led a team of 12 security coaches and a GDPR rollout across Tieto’s healthcare, welfare, and education portfolio.
Kenneth BĂĽlow – CISO, DR
“As CISO, it is my most important task to make information security relevant and understandable for the entire organization, and it starts at the top,” Kenneth Bülow wrote after DR finished training its top management in NIS2 and information security, using cases drawn from the broadcaster’s own working life. He is DR’s first consolidated CISO, appointed in March 2024, and has brought governance, risk and compliance, security operations, and security culture together into one function. At CISO Challenges in June 2026, he spoke about moving from policy to practice: treating people not only as a risk but as a central part of an organization’s defense, and using clear frameworks, leadership, and psychological safety to turn policies into action. He was nominated for Denmark’s CISO of the Year in 2025. Before taking the role, he was chief of staff for DR Technology and head of digital business development at Denmark’s Ministry of Foreign Affairs.
Sharon Larsson – CISO, Svenska Spel
Earlier this year, Sharon Larsson joined more than 90 security professionals from the national lotteries of 19 countries at the Eurojackpot Cyber Security Conference, where the program included an incident simulation alongside sessions on AI security, cloud, and third-party risk. As CISO of Svenska Spel, the Swedish state-owned gaming company, since 2022, she takes a practical approach to translating regulations and requirements into actions that matter to the business, with human factors at the center of a strong security culture. Originally from Ireland and based in Sweden since 2006, she spent nine years at Ericsson in roles focused on change, quality, and improvement, then served as COO of Frostlight Solutions and CIO of Edisen. In May 2026 she joined the advisory board of TUC’s information security coordinator program, and she is scheduled to speak at Cyber Squeeze Nordics in November 2026.
Marianne Hove Solberg – CISO, SpareBank 1 SMN
Marianne Hove Solberg started out finding weaknesses, working on intrusion detection during summer internships and later on penetration testing of web applications, networks, and mobile apps at EY. Today her focus is on people. As CISO of SpareBank 1 SMN since 2023, she leads information security across the banking group and is responsible for developing its program for security training and culture-building, alongside setting security requirements and overseeing compliance. She describes herself as committed to security culture and attitudes and to communicating the security message, connecting strategic goals with technical, organizational, and human safeguards. Before the bank, she was CISO of Hemit and spent five years as a consultant at Transcendent Group. She was named one of Norway’s Top 50 Women in Tech in 2024 and has served on the board of Norsk helsenett since 2025.
Berglind GrĂmsdĂłttir – CISO, INNNES
Four years ago, Berglind GrĂmsdĂłttir was a store manager at Icelandic outdoor brand 66°North. She moved into information security consulting at Syndis in 2023, and in 2024 became the first CISO of INNNES, an Icelandic food importer and wholesaler with around 250 employees, where she also serves as data protection officer. As the first in the role, she has had the chance to shape it from the start. In a February 2026 talk at UTmessan, she discussed building a positive security culture across staff with varied roles, languages, and working hours. Her academic background suits that challenge: she holds a BA in anthropology from the University of Iceland, focused on digital anthropology and criminology, and an MS in criminology from the University of Kent, focused on cybercrime.
Different Words, Same Message
WĹ‚odarczyk talks about helping the business sail farther. BĂĽlow starts with the executive team. Larsson translates regulations into actions, Hove Solberg builds training programs, and GrĂmsdĂłttir works across languages and shifts. Each has a different way of saying it, but all five are trying to make security something people understand well enough to act on.
Discover more CISOs securing their organizations:
-
- Going the Distance: The Marathon-Running CISOs to Watch
- Beyond the Office Network: Australia’s Operational Cyber Leaders to Watch
- From Molecule to Pharmacy: The Swiss CISOs Securing the Medicine Supply
- Shared Defence: Cybersecurity Leaders Protecting Research and Education
- Protecting Member Trust: Cybersecurity Leaders Behind America’s Credit Unions
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.