This market gets talked about a lot and measured very little. So every year I sit down with the annual reports from every Norwegian company that makes its money from cyber security, and write up what they actually say. New this year is a leaderboard showing who leads on each measure. All the graphs are live at stats.o3c.no.
Disclaimer
One rule: a company has to make at least 80% of its income from cyber security to be in here.
That leaves out the big consultancies. They do far more than security, and their accounts do not show me which part of the income and costs belongs to it. Putting them in would mean guessing, and guessing is exactly what this report is meant to avoid.
The market at a glance
Who came out on top, top three in each category:
Look at how little the lists overlap. None of the three biggest companies make the margin ranking, and none of the three best margins belong to a company anywhere near the top on revenue. Being big and being profitable are not the same thing in this market.
Growth of companies
42 companies were registered at the end of 2025, down from 43. A small change, but it is the first time this number has gone down. Some closed, others were bought by bigger groups.
The number of companies doubled in five years. That has now stopped.
Market income
Income came in at NOK 3.72 billion, up 11.7% from NOK 3.33 billion. Over five years the market has grown 15.5% a year on average.
Some of that income is not really theirs. If a company buys a licence for 80 and sells it for 100, the customer pays 100, but 80 goes straight back to the vendor. Only the 20 is theirs. Value creation subtracts what they paid the vendor, so the 20 counts and the 80 does not.
With that in mind, value creation grew 16.4%, faster than the total income did. So the growth is coming from their own work, not from moving more product.
Total market result
Purple bars are years the market made money. Teal bars are years it lost money. Four losses in a row now, and 2025 is the second worst at minus NOK 134.6 million, against minus NOK 99.1 million in 2024.
That total hides what actually happened. Of the 40 companies, 27 made money and 13 lost money. Five of those 13 lost NOK 223.9 million between them:
- Omny, minus NOK 63.8 million (OT security software, started 2022)
- Telenor Cyberdefence, minus NOK 60.3 million (not a new business, it sat inside Telenor before and is now its own company)
- Pistachio, minus NOK 55.0 million (awareness training software, started 2022)
- Defendable, minus NOK 25.7 million (smaller loss than previous years)
- Sicra, minus NOK 19.0 million (strong results for years, now trying to grow faster with PE backing, which is most likely what this number reflects)
Take those five out and the rest of the market made NOK 89.2 million.
So the market is not in trouble. A small group with investor or parent-company money behind them are spending hard to buy a position, and their spending is big enough to bury everyone else in the total. Three of them are software companies, where spending years building before the money comes in is normal.
Market share
Plain market share makes resellers look bigger than they are. A company that buys hardware for 80 and sells it for 100 counts the whole 100 as income, even though only 20 is theirs. Take the cost out and you see the real business underneath. Grey is share of income, purple is share of value creation.
Mnemonic leads on both, 30.2% of income and 29.6% of value creation. It barely moves between the two, which tells you its size is real work and not boxes shipped. It is down from around 35.9% in 2020.
NetSecurity is the opposite: 22.5% of income but only 13.6% of value creation, the biggest gap on the chart. Promon goes the other way, from 7.5% up to 11.6%. EMP Secure sits at 9.0% and 8.0%.
The top three hold 61.6% of income between them, the top five 73.6%. Measured on value creation instead, the market is worth NOK 2.37 billion rather than 3.72.
Who actually took market share
NetSecurity took 14.5 percentage points, almost certainly because they bought Data Equipment. Promon added 2.9 without buying anyone. Then Kommando 1.1, Defendable 0.9, O3 Cyber 0.9 and Ivolv 0.7. On the other side, Mnemonic gave up 3.4, Orange Cyberdefense Norway 2.2 and Advisense 1.4.
Results and profit margin
Biggest profits in kroner: Promon NOK 32.7 million (up from 22.9), Mnemonic NOK 20.4 million (down from 57.5), Kommando NOK 17.8 million (up from 10.1), NetSecurity NOK 17.6 million (up from minus 3.9), Junglemap NOK 14.7 million (up from 6.3).
The best margins are Binary Security at 31.9%, Junglemap 29.1% and O3 Cyber 19.0%, then Kommando, FM Cybersecurity, Xlent Cyber Security and Promon in double digits. Not one of them is a full-service provider. Mnemonic came in at 1.8%, NetSecurity 2.1%, EMP Secure 2.7%.
Full-service is a volume game. You compete on how much you can cover and how big the contract is, and the margins show it. Specialists earn several times more on a fraction of the revenue.
Salary and compensation
Average salary was NOK 1,045,412 per person, up 3.7% from 2024. That is the average of what each company pays, across the 30 companies with five or more employees.
Houmb tops the chart at NOK 1,476,907, then O3 Cyber at NOK 1,466,217 and Gritera Security at NOK 1,452,283. The firms at the top hire seniors and almost nobody else, so there is no junior tier pulling the average down. Bigger companies mix graduates, mid-level and principals, and land nearer the middle: Mnemonic NOK 1,097,436, NetSecurity NOK 1,062,362, EMP Secure NOK 818,263.
The chart leaves out two things. Options and other non-cash pay, which means the venture-backed software companies pay more than it looks. And consultants hired in through other companies, who do not show up at all.
The 3.7% is measured across the 23 companies that had five or more people in both years, so it compares like with like.
Value creation per employee
This is income minus what the company bought in, divided by the number of employees. It answers a simple question. How much does each person here actually bring in?
Promon leads at NOK 4,215,914, then Junglemap at NOK 3,177,107 and O3 Cyber at NOK 2,998,623. The typical company sits at NOK 1,726,427, so the top is running at more than twice that. Promon is up NOK 610,000 in a year, which is software doing what software should. The money goes up without the number of people going up with it.
The interesting names near the top are the consultancies. O3 Cyber at NOK 3.0 million, Houmb at NOK 2.7 million and Kommando at NOK 2.6 million. Senior people, a small back office, and most of the week spent on work someone pays for.
The big full-service providers sit between NOK 1.8 and 2.1 million. Mnemonic NOK 2,031,280 across 346 people, NetSecurity NOK 2,120,576 across 152.
At the bottom are the young software companies. Secure-Nok NOK 318,000, Secure Practice NOK 738,000, Omny NOK 742,000 and Pistachio NOK 823,000. All four are still building.
Across the market that is NOK 2.37 billion of value creation against NOK 1.36 billion in wages. Wages take 57.2% of it.
Headcount
The 40 companies employed 1,256 people in 2025, against 1,185 a year earlier. That is 71 more, up 6.0%.
The biggest employers are Mnemonic with 346, NetSecurity 152, EMP Secure 103, Telenor Cyberdefence 77, Defendable 69 and Promon 65.
Gritera Security went from 4 people to 17, more than tripling in a year. It stayed profitable while doing it, NOK 1.9 million, and pays the third highest salary in the market.
Orange Cyberdefense Norway went the other way and cut 19 people, down 29%. It still lost NOK 17.9 million on NOK 169 million of income. What each person brings in rose from NOK 1.47 million to NOK 1.76 million.
Final thoughts, and what I expect in 2026
The usual line about this market is that everyone is growing and nobody makes money. The accounts do not say that. 27 of 40 companies made money, the specialists are running double-digit margins, and the loss sits in five companies that are spending on purpose.
Three things I expect next year.
AI pushes demand up, but only for the firms that can actually deliver. Companies are putting AI into production faster than they are securing it, and someone has to close that gap. Plenty of firms will say they do this work. Far fewer can, and that is where the money will go.
The big providers stay on thin margins. That is what it costs to do everything for everyone. Nothing in these accounts suggests it changes in a year.
Growth picks up again. I think 11.7% is closer to a bottom than a new normal. Value creation grew 13.4%, faster than total income, so the real work is growing quicker than the invoices suggest. Add AI demand on top, and 2026 should land above 2025.
About this analysis
All figures come from Brønnøysundregisteret and the companies' filed annual reports, and are kept live at stats.o3c.no, where you can explore every graph across all years, filter by company, and subscribe to be notified when new numbers land.
If you spot an error, a missing company, or you disagree with a read, I want to hear it. This dataset gets better every year because people tell me what I got wrong.