Bring Product Security into focus.
I work with software companies on the security questions that sit between leadership, product, and engineering. Together, we establish what the product needs to protect and turn that into a coherent direction for architecture, delivery, customer conversations, and future decisions.
Worked with engineering teams at
Recent writing
Notes from the work
01
AI has increased fearmongering in security
Fearmongering has always been part of the security landscape. Plenty of vendors lean into hypothetical "what if?" scenarios to sell their tooling, and plenty of orgs give into...
2026-10-26
02
Timeline of PHP2Shell
The two latest vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, have reached mainstream news, so I think it's safe to say that almost everyone will have heard of it.
2026-10-21
03
Proxmox Community Scripts are a bad idea
I've been running Proxmox for quite some time now to host my business-critical infrastructure. This includes services like Nextcloud, Vaultwarden and Authentik, most of which...
2026-09-22
04
AI doesn't eliminate the cost of owning software
I'm deep into reading papers about AI, mostly with regard to secure code generation and trust in AI models. Compared with the enormous amount of dfiscussion around AI...
2026-09-02
A few words from others
“Søren quickly grasped the technical and business context of our project and added value from day one. His strong engineering background and structured thinking made collaboration seamless.”
“Søren provided clear, strategic guidance and valuable resources, making complex challenges easier to navigate. His mentoring and communication skills are a real asset for anyone seeking advisory support.”
About
I’ve spent more than a decade building software and looking closely at how it fails.
That has included multi-tenant platforms used by millions of people, identity systems, application and API security, and the less glamorous work of turning an old pentest finding into something an engineering team can actually fix and verify.
I now work independently with European software companies. I also build RecoveryCodes, which keeps me on the vendor side of the table, where security claims eventually have to meet a real product and a real customer.