About

Why ArcTech

The person who scopes the work is the person who does it. There is no handover from the senior who won the engagement to whoever is free that month, because there is no bench to hand it to.

The offensive work is done by someone who understands how an exploitation path is assembled, which is a different trade from instructing a tool to attack something and forwarding what comes back. A model matches against public material; the chains worth finding in a bespoke system are not in it.

A fully manual engagement is available on request, with no model of any kind processing your environment and nothing leaving ArcTech's network. Otherwise analysis runs on hardware ArcTech owns and operates in Finland, never a third-party service.

Most testing suppliers stop at the report, and most engineering suppliers were never taught to look at a design the way an intruder does. ArcTech does both, which is why a finding can be closed in the same engagement that found it rather than handed to a third party who has to learn your environment first.

Being small is the reason work outside the specialism is declined rather than attempted. That is a smaller catalogue than a large firm can offer, and a better outcome on the work that is taken.

Everything runs inside the EU. Analysis happens on hardware ArcTech owns and operates in Finland, and nothing from a client environment is sent to a third-party service.

Specialists

Engagements are delivered by a named senior engineer rather than a rotating bench, so you can check who will actually be doing the work before you commission it.

Certifications, professional background and published work: arc.valtberg.com

Track record

Twenty years in IT, the last several concentrated on Azure, identity and application security. The work has been delivered in manufacturing, insurance and financial services, industrial equipment and logistics, on estates ranging from a single product team to identity platforms covering roughly ten thousand users.

Example work

Described by shape rather than by name. Client names and findings are confidential, and remain so after an engagement ends.

For an international insurance business, the cloud, delivery, customer identity and security workstreams of a platform consolidation following an acquisition: deciding at design level how two organisations' infrastructure could become one without opening new paths between them, then building it and closing what the migration exposed.

For a manufacturer operating across Europe, day to day identity operations at roughly ten-thousand-user scale across Entra ID, Active Directory with ADFS and an identity management platform: federation and provisioning repairs, access policy rebuilt, and the automation the client's own team continues to run.

For an industrial equipment vendor, hardening a production platform ahead of a European release: the interfaces that handled remote sessions and user identity, the front end, session handling, and the hosts underneath.

References can be arranged at proposal stage, with the client's agreement.

How engagements work

Work arrives one of two ways: directly from the organisation that needs it, or as a subcontractor to a consultancy that holds the relationship. Both are normal and neither changes how the work is done or who does it.

Engagements are scoped and estimated before they start. Where the scope is genuinely uncertain, and with an unfamiliar codebase it usually is, what is agreed is time rather than a count of closed findings, and the engagement reports honestly on what was completed and what was not.

Confidentiality

Security work means seeing an organisation at its least flattering. Nothing about a client's environment, findings or people is published, used in marketing material, or discussed with other clients. That is why the examples above name sectors rather than companies.

Where a client's own agreement governs, that one applies. Where it does not, the engagement terms cover it in writing.

What ArcTech does not do

A one-person consultancy that claims to do everything is telling you something. ArcTech does not run a monitoring centre, does not staff a red team, does not write compliance documentation or management-system paperwork, and does not test mobile applications, embedded devices or industrial control systems.

Where a piece of work falls outside that, saying so and pointing elsewhere is more use to you than taking it on.

Company

Registered name

ArcTech Solutions Oy

Business ID

2471668-7

VAT number

FI24716687

Registered office

Varkaus, Finland

Working languages

Finnish, English

Delivery

Remote across the Nordics and EU, on-site by arrangement

Who does the work

arc.valtberg.com