“River helps us focus on what actually matters. They identify and validate the issues, our IT partner helps resolve them, and we don’t have to spend time coordinating everything ourselves. When River tells us something needs attention, we know it’s worth acting on.”
— Gunilla Stussi, IT Manager, Backe
Security That Moves With the Business
Backe is one of Norway’s largest family-owned construction companies, delivering projects across residential, commercial, public, and infrastructure sectors throughout Norway.
With up to 80 active construction sites at any given time, every project becomes its own temporary workplace with people, suppliers, systems, and digital infrastructure. While many organizations relocate offices once every decade, Backe practically does it every week.
When your workplace changes every week, cybersecurity can’t stand still. It has to evolve alongside the business.
River Security has supported Backe since 2020. In 2025, the collaboration was revitalized and expanded, building on years of trust and proven value.
Today, the partnership combines Active Focus, Assumed Breach, and close collaboration with Backe’s IT partner to continuously identify, validate, prioritize, and reduce cyber risk.
Security Is Part of Backe’s Culture
Safety has always been central to how Backe operates.
The same mindset that protects people on construction sites also shapes how the company approaches cybersecurity. Employees are encouraged to stop, question, and verify, while the organization continuously strengthens security through processes, technology, and trusted specialist partners.
With a relatively small IT organization supporting more than 1,300 employees across dozens of constantly changing environments, Backe deliberately works with specialist security partners.
Active Focus enables the IT team to stay proactive by continuously highlighting the issues that matter most, allowing security improvements to happen centrally rather than depending on individual users to spot every threat.
Continuous Security Validation
Through Active Focus, River continuously monitors Backe’s external attack surface and validates exposure.
Rather than relying solely on periodic penetration tests, Active Focus combines attack surface management, continuous security testing, exposure validation, and structured follow-up throughout the year.
As new domains, suppliers, technologies, and internet-facing services become part of Backe’s environment, they are continuously assessed to determine risk and business impact.
The result is a continuously updated understanding of Backe’s external security posture, enabling the organization to identify and remediate meaningful exposures long before they become security incidents.
Looking Beyond the Perimeter
Backe’s security program extends beyond internet-facing assets.
Through Assumed Breach engagements, River validates how security controls perform from the perspective of an attacker who has already established an initial foothold.
These exercises provide valuable insight into attack paths, identity security, privilege escalation opportunities, and the effectiveness of internal security controls.
Together, Active Focus and Assumed Breach provide validation across both external and internal environments.
Confidence Through Trusted Findings
Trust is one of the reasons the collaboration has continued to grow.
Every finding delivered by River has already been validated and prioritized, allowing Backe to focus its efforts where they create the greatest security impact.
When River identifies an issue, there is little discussion about whether it should be addressed, the focus is simply on getting it resolved.
“When River tells us something needs attention, we know it’s worth acting on.”
— Gunilla Stussi, IT Manager, Backe
Red Team Meets Blue Team
One of the biggest strengths of the collaboration is how offensive and defensive security work together.
River continuously validates Backe’s environment from an attacker’s perspective through Active Focus, while Backe’s IT partner uses the same validated findings to prioritize remediation and operational follow-up.
Everyone works from the same picture.
Together, this creates a collaborative security model where River identifies and validates the risks, Backe’s IT partner drives remediation, allowing Backe to stay focused on delivering construction projects instead of coordinating multiple security vendors.
Great Technology. Even Better People.
Backe has great confidence in the technology behind Active Focus and the continuous visibility it provides. The platform delivers exactly what it should, continuous validation, actionable insights, and a clear picture of the organization’s external exposure.
But technology alone doesn’t solve security challenges.
One of the strengths Backe values most is the people behind the platform. River combines deep technical expertise with the ability to explain complex security topics in a way that makes sense, not only for security specialists, but also for IT managers, operational teams, and business stakeholders.
That means less time interpreting technical findings and more time making informed decisions and improving security.
As AI and the threat landscape continue to evolve, Backe sees increasing value in having experienced security specialists who can distinguish real risk from unnecessary noise, explain why something matters, and help the organization focus where it creates the greatest impact.
“The technology gives us confidence. The people make it useful. River has an impressive ability to explain complex security in a way that everyone understands, and that’s what helps us make better decisions. Great technology is important, but having great people behind it makes all the difference.”
— Gunilla Stussi, IT Manager, Backe
Built on Long-Term Trust
The relationship between Backe and River began in 2020 and has continued to evolve.
The expanded engagement in 2025 reflects both the value delivered and the trust established over several years of collaboration.
Today, River remains a trusted security partner, helping Backe continuously strengthen its security posture while making cybersecurity understandable, actionable, and practical.
Facts
Backe is one of Norway’s largest family-owned construction companies, delivering projects across residential, commercial, public sector, and infrastructure markets.
