About security, weaknesses, and popular shepherd boys on watch

New regulations on computer system security have come into play. Artificial intelligence has multiplied the number of known software vulnerabilities. At the same time, managing operational environments in information technology is becoming increasingly complex. The task is no longer just about identifying and fixing vulnerabilities, but about finding the capacity to fix them. In this new reality, someone needs to monitor the people who monitor the most critical infrastructure.

Our interviewees are Emil Björn Héðinsson, team lead of APRÓ's operations monitoring, and Þröstur Jónasson, known as Spörri, a data specialist at the same company. The topic of discussion is Monitoring & Response, APRÓ's monitoring service, which ensures that companies' professional infrastructure is under continuous expert surveillance and that operational incidents are addressed promptly.

Patient shepherds

Emil and Spörri have decades of experience in the field and say themselves that patience is one of the most crucial elements of the job. They both have a background in sheep herding, which to some extent explains their great composure. Spörri is from Bárðardalur and claims he has never seen a reason to run except after sheep. Emil is an equestrian and also herds sheep, but prefers to let the horse do the running.

"The most important thing in herding is knowing where to head them off, where the flock is going, and anticipating what happens next—who might break away. This provides a great foundation for what we do today. Patience, foresight, and knowing when to hurry," says Spörri.

DORA has arrived, NIS-2 is just around the corner

DORA entered into force in Iceland on January 1st, an EU regulatory framework governing the security and operation of IT systems in the financial market. Icelandic banks, insurance companies, and pension funds must now demonstrate how they and their vendors respond to disruptions and attacks.

The NIS-2 cybersecurity directive, however, has yet to be incorporated into Icelandic legislation, and it will impact far more companies and institutions than most suspect. It extends not only to energy utilities and telecommunications, but also to food production, transport, manufacturing, and public institutions. Companies do not necessarily have to be large to fall under the definitions of NIS-2 and thereby be required to implement the regulations.

Dangerous to delay implementation

Emil says it is risky to wait too long to implement NIS-2.

"The delay is most dangerous for companies that think they don't need to take any action or that they will have room to implement measures later on. The requirements do not solely come from regulatory authorities, but just as much from customers. For instance, banks and pension funds fear that cybercriminals will use service providers to gain access to their systems. That is why these companies have already begun asking vendors: How are your systems monitored, who holds the responsibility, and what happens if something goes wrong in the middle of the night?

As soon as you service a company that falls under these regulations, you are effectively brought into their framework, whether you like it or not. And then it's not enough to say you have it covered. You have to be able to demonstrate it," says Emil.

Known vulnerabilities are increasing

On the technical side, another shift has occurred concurrently. Artificial intelligence is increasingly being used to scan for software vulnerabilities, both by defenders and attackers. As a result, known vulnerabilities are proliferating faster than ever before.

"It's no longer just about being aware of the vulnerability. The need for updates has simply grown far beyond what most can handle. That is where the biggest problem lies today. It is rarely a question of skill or willingness. No one knows better than the IT department itself what needs to be done. They just can't keep up with the tasks without help," says Spörri.

Who monitors those who monitor the infrastructure?

The trend in recent years has often seen companies bringing operations back in-house after a period of extensive outsourcing. Emil says APRÓ approaches monitoring based on that reality.

"We are not replacing technical staff. That is not our methodology. On the contrary, we work alongside the technical teams. Sometimes our role, for instance, consists of monitoring those who are supposed to be monitoring, whether that is an internal team or a third-party service provider. That sounds strange until the first incident arises that no one realized could happen. We regularly catch issues that others have overlooked."

Experts staff Monitoring & Response

Emil emphasizes that APRÓ's Monitoring & Response service is staffed by specialists with deep knowledge of infrastructure, not shift workers merely watching screens. The technology detects anomalies, but it requires expert judgment to assess what demands immediate action.

APRÓ's monitoring spans on-premises environments, cloud services, and hybrid solutions. Emil notes that the scope often takes people by surprise.

"These tasks are not just about databases and their uptime. This is about workflows, scheduled jobs, ETL pipelines, web services, performance, connectivity, and, not least, automated backup recovery testing, which is an explicit requirement for those subject to certain regulatory frameworks."

Audits from the start

A large part of APRÓ's monitoring engagements begins with an audit of the database environment and an assessment report of the current state. Such an audit usually leads to improvement projects and, more often than not, a discussion about system modernizations that have been postponed for years.

"It is incredibly common for the state of IT infrastructure to be based on guesswork. People think they know what is running and what is in use. The first step is simply finding out what is genuinely there. Only then can updates be prioritized sensibly instead of starting with what might be less important," says Spörri.

The support network and a friend on the line

Emil emphasizes that APRÓ's specialists do not just deliver reports and then walk away.

"We want to build relationships and trust. These are personal connections. If there is a desire to leave knowledge behind with the client and make their team self-sufficient in the task, we do that. The goal is to enhance the quality of the customer's service, not to make them dependent on us."

The support network plays a key role here—both APRÓ's internal pool of specialists and collaborations with other IT service providers. "Many assume we are in competition with these companies, but in reality, we work alongside them much more often. Strong friendships have formed there, which are invaluable in this line of work. Being able to call a friend when something unexpected happens is worth more than most tools at our disposal," Spörri adds.

Underestimated management overhead

According to Spörri, people usually underestimate the management overhead: "Staffing a 24/7 watch is not just a payroll cost. It entails shift scheduling, training, vacation cover, documentation of processes, and the risk that comes with knowledge being tied to just one or two individuals. We have established this internally within our team, as well as for numerous clients. It is simply more cost-effective than each company trying to build its own 24/7 operations."

"You are replacing unpredictable call-outs and overtime with a fixed monthly fee. And the biggest efficiency comes from addressing the root cause of problems instead of putting out the same fire repeatedly," Emil concludes.

Monitoring & Response is about peace of mind

With Monitoring & Response from APRÓ, clients receive more than just technical supervision—they get experienced shepherds on watch who anticipate hazards, prevent operational disruptions, and ensure that everyone involved can sleep soundly.

"In the end, Monitoring & Response is all about peace of mind. Turning uncertainty and unexpected call-outs into predictable, reliable operations with APRÓ's specialists as a robust backbone," concludes Spörri.

This article appeared in Fréttablaðið on September 29, 2026