IN CONVERSATION WITH CYBERCUE
Exploring awareness testing and how to bring invisible threats and needs to the forefront with CEO & Founder of Cybercue, Eskil Sørensen:
What inspired you to work with cybersecurity, why is it important?
We have been frustrated by how often cybersecurity solutions failed to make a measurable impact, especially for smaller businesses. The problem was clear: communication around cybersecurity wasn’t personal enough. Generic warnings or blanket advice leaves SMEs disengaged, thinking, “this doesn’t apply to me”.
So, we took a different approach. We built a tool that allows businesses to describe their specific setup – specifying for example, their IT systems. From there, Cybercue sends highly individualised cues and notifications, tailored to their exact situation. We make these communications feel personal, because we think that will trigger SMEs to take more action.
How has the tourism market responded to your product?
Initially, it was tough. Many tourism SMEs view cybersecurity as something for larger companies or high-risk industries. A common mindset was “Why would anyone target us? We’re just a small hotel or tour operator.” This perception created a barrier not just for Cybercue but for cybersecurity providers in general.
We approached tourism organisations not as a sector, but as SMEs with unique challenges. Tourism businesses juggle seasonality, high turnover of staff, and scaling operations quickly when demand spikes – all factors that amplify cyber risks. Our focus was on connecting these realities with the need for good cybersecurity behaviours early on, so as they scale, they’re doing it securely.
The tourism industry proved to be a great, and extreme place for testing. It’s not bogged down by heavy compliance, which gave us room to try out new approaches, but it is also incredibly challenging as it is an industry which deals primarily with immediate business concerns, so finding ways to make cybersecurity feel accessible and worth their time was critical.
What did you learn from testing Cybercue with XNTC?
We onboarded about 10-12 organisations and found challenges in maintaining engagement beyond onboarding. The platform sends notifications to prompt users when action is needed. These notifications often went unaddressed – not because they weren’t valuable, but because the urgency felt overwhelming.
We found that if they didn’t act immediately, they lost momentum. This insight has been invaluable in rethinking how we design for and communicate with time-strapped users.
What strategies have you found effective in turning 'unknown needs' into recognised priorities?
Weirdly, it’s not necessarily hammering on about the urgency around not taking cybersecurity seriously, which has been our main lever for grabbing attention. Pushing the “cyber threats are imminent” narrative only created stress or led to disengagement. Tourism SMEs already have enough urgent matters to deal with.
Instead, we shifted to a more empathetic approach: We know you’re busy. When you’re ready to focus on cybersecurity, here’s how we’ll help you make the most of that time.
Our focus is now on creating a safe space for businesses to engage – not based on a fear of falling behind. For instance, one common question we received was: How much time do I have to spend on this?
Our answer became a key part of our pitch: Set aside an hour a month, and we’ll make that hour as valuable as possible.
We want to improve how we frame the narrative: Move beyond cybersecurity being synonymous as avoiding disaster; but about creating trust and stability for your business and your customers.
What advice do you have for startups working with the tourism industry?
Understand the language of the industry. Tourism is about experiences, storytelling, and human connections. If you frame your product in technical or compliance-driven terms, you’ll lose their attention. Instead, tie your solution to the human experience, that’s what we’re taking with us. For example, cybersecurity isn’t just about IT – it’s about protecting the trust travellers place in a business to keep their data and experiences secure.
Nordic countries are safe travel destinations based on strong institutions and culture. Inhabitants have trust within another. It’s a strong value for the countries and a strength for the tourism industry.
However, this is also a weakness because cyber threat actors, i.e. cyber criminals, take advantage of this trust. Cyber criminals can capitalise on it, deface the industry and break down a part of the economy in the Nordics - ultimately challenging the value of the Nordics itself. Creating a strong cybersecurity culture in a single tourism SME supports the industry itself.
What’s next for Cybercue?
We’re focusing on making cybersecurity as approachable as possible for SMEs. Like I said before, this means moving beyond that “urgency narrative” we used to grab and maintain attention, but instead emphasise small, achievable steps like dedicate an hour to this platform and we’ll be right here to guide you through it all. Like a part-time Chief Information Security Officer or security consultant would do.