Toreon

Main service(s)

Toreon is a security consultancy company organised in 3 main pillars: organisation security, product security, and building cyber capacity. Next to those 3 pillars, there are also several specialist teams, in support of the 3 main pillars.

Organisational security

The organisational security pillar is mainly concerned with the GRC side of security. Not surprisingly, this includes building up a security strategy, designing and implementing a security program, running security operations, etc. Toreon often works for the CISO or fulfils the CISO role.

The GRC work is typically aligned on one or more security standards. This can be formally or informally, depending on the needs of the organisation.

These “needs of the organisation” are the cornerstone of everything Toreon does: it always starts from the organisation’s strategy and (helps) build the security strategy and program to support that business strategy. Toreon’s tagline (Business Driven Cyber Security) is not a coincidence.

Product security

The product security pillar entails all activities (offensive and defensive) needed to transform a ‘software building organisation’ into a ‘secure software factory’.

Some example activities are:

• Threat modelling, to identify potential security threats and vulnerabilities
• Coaching and collaboration to enhance the development team’s cybersecurity capacity
• Help organisations improve their software security posture, using OWASP SAMM.
• Simulate actual attacks with pentesting.

In this product security space, Toreon has managed to establish itself as a worldwide subject matter expert. For example: key people in Toreon were some of the first to talk about (now ubiquitous in appsec) threat modelling. Additionally, they have multiple members steering the OWASP SAMM project (SAMM is a comprehensive application security framework). It bears repeating: this truly impressive effort has positioned Toreon as a world-class expert. It comes as no surprise then, that the Toreon client base for this pillar is worldwide.

Building cyber capacity

In 2021, Toreon acquired a majority stake in the Data Protection Institute (DPI). This institute was primarily known as a privacy training institute, but Toreon broadened the scope.

As a first extension, the CISO training was established, to strengthen DPI’s offering with security training. This training is now in full swing and there are regular waves of graduating students.

Later came training sessions around data management, although this training catalogue is still less developed than the other two aspects.

Specialist teams

There are several other teams within Toreon which support the above three pillars, and are equally important to the overall security posture of specific companies. Examples are the OT security team and the cloud security team.

Differentiators

Business driven security

The Toreon tagline is “Business Driven Cyber Security'' and this is not a coincidence. While many security organisations will claim to be business-driven, the proof is in how this is supported throughout the organisation.

In Toreon’s case, they have chosen to feature business-driven security prominently in their tagline. It also consistently comes through in their marketing material and (most importantly) several individuals within Toreon have brought it up to me without prompting.

An environment for employees to thrive in

This is another intangible differentiator, which will be claimed by many organisations. I include it here because of how it was presented to me.

Toreon (again unprompted) explained to me that they have two types of clients: the actual businesses and their (prospective) employees. They presented a company structure in which the latter group is central. Impressively, when I asked too many questions on the business side, Toreon management made a point of also discussing the employee side. This leaves me confident that Toreon spends an above average amount of attention and time on creating an environment where employees are empowered and have ample opportunity for growth.

Future plans and direction

Toreon is steadily building upon its current success.

Company history

Founded in 2014 by Wouter Avondstondt, Sebastien Deleersnyder and Bernhard Dobbels.

In April 2021, Alex Driesen came on board as CEO, after acting as an non-executive board member to Toreon since 2017.

In May 2021, Toreon acquired a majority stake in Data Protection Institute (DPI).