What is Ciptor?
Ciptor is a Nordic cybersecurity company that deploys phishing-resistant, hardware-bound authentication (FIDO2 security keys and passkeys) for organisations that must meet NIS2 and DORA. Ciptor covers the whole identity lifecycle, from onboarding and daily login to account recovery and privileged access, and proves it works with adversarial testing.
THE PROBLEM
Your MFA is already beaten.
App codes, SMS and push approvals were a big step up from passwords. Phishing kits caught up. Today they defeat them at scale, without any malware
01 Codes get relayed
Adversary-in-the-middle kits sit between the user and the real login page and pass every code through in real time.
Read more
02 Push gets approved
Repeated prompts at 2 a.m. wear people down. One tired tap gives the attacker a valid session.
Read more
03 Recovery is the back door
A convincing call to the help desk resets everything. Strong login is worthless if recovery is weak.
Read more
04 SMS follows the SIM
Attackers talk a mobile operator into moving your number to their SIM card. Every SMS code then goes straight to them.
Read more
HOW CIPTOR WORKS
Test it. Replace it. Prove it.
|
Step 1 - Red Team Exercise We attack, your SOC defendsAn adversarial test shows exactly how your current login and endpoint defences fail, before an attacker does.
|
Step 2 - Ciptor Shield Hardware-bound login everywhereCertified FIDO2 keys and passkeys for staff, admins, contractors and shared or OT workstations, with secure onboarding and recovery.
|
Step 3 - Evidence Audit-ready for NIS2 and DORA Every requirement mapped to a control and a piece of evidence your board and supervisor can read.
|
TRUSTED COMPONENTS ONLY
If it isn't independently certified, it isn't in the stack.
Ciptor uses FIDO-certified hardware from European and established manufacturers, including NEOWAVE and FEITIAN, and integrates with the identity and security tools you already run.
Microsoft Entra ID - Cisco Duo Security - IBM Verify - Google Workspace - Salesforce - OKTA - HYPR - Meta - e-identitet
CERTIFIED HARDWARE
Three keys, one for each kind of login.
Every key we sell is independently certified and set up to work with the systems you already run. Buy a few to test, or ask us for a volume quote.
FEITIAN BioPass K49 Pro
For administrators and privileged accounts.
Fingerprint security key. Only the registered person can use it, even if the key is lost or stolen.
- USB-C, fingerprint reader
- FIDO2, FIDO U2F, PIV, OTP
- Works with Microsoft Entra ID, Google Workspace, Okta and Windows Hello
Price 599 SEK excl. VAT
FEITIAN ePass K9 / K40
For shared workstations, OT and front-line staff
Tap or plug in. No phone needed, so it works on factory floors, in clinics and at shared desks.
- K9: USB-A + NFC · K40: USB-C + NFC
- FIDO2, FIDO U2F, OATH OTP
- No drivers needed on Windows, macOS or Linux.
Price 329 SEK excl. VAT
FEITIAN C200 OTP token (SHA-256)
For Microsoft Entra ID users without a smartphone
The hardware token Microsoft Entra ID supports with SHA-256. Press the button, read the 6-digit code, sign in. Replaces SMS and authenticator apps where phones aren't allowed or practical.
- Time-based codes (TOTP), SHA-256
- Works as an OATH hardware token in Microsoft Entra ID and Microsoft 365
- No cable, no app, no phone
- Step up to a FIDO2 key when you're ready for phishing-proof login
Price 214 SEK excl. VAT
ZERO ASSUMPTIONS
The CISO series that questions what everyone takes for granted.
Every volume names an assumption, shows the reality behind it, and gives a blueprint to close the gap.
Volume 14 - Token Lifecycle Governance
Managing IT lifecycle risks and the policies that close the gap.
Token lifecycle governance: why the credential that outlives the employee is your most exploitable gap.
Volume 12 - Supply Chain
Your Vendor passed the audit. Their contractor didn't.
Why phishing-resistant login has to extend to every third party with privileged access.
Volume 10 Convergence
The badge entry your SOC will never see.
Physical and logical access must share one signal, or the attack goes unclassified.
Questions
Straight answers
| 1. What is phishing resistant MFA? | Multi-factor authentication where the credential is bound to the real website's address and stored in hardware, so a fake site cannot capture or replay it. FIDO2 security keys and device-bound passkeys meet this bar. SMS, app codes and push approvals do not. |
| 2. Does NIS2 require multi-factor authentication? | Yes. Article 21(2)(j) of NIS2 lists multi-factor or continuous authentication among the cybersecurity risk-management measures essential and important entities must take. Ciptor maps each measure to a control and evidence. |
| 3. Which countries does Ciptor serve? | Ciptor works with organisations in Sweden, Finland, Norway, Denmark, Iceland, Germany, Switzerland, France, Spain, Italy, Turkey, Saudi Arabia, UAE, Bangladesh, Malaysia, Indonesia, Singapore, Thailand, Japan, South Korea, China, Australia, Canada, USA, Colombia, Mexico, Brazil and Argentina. |
| 4. How is Ciptor priced? | Transparent, Scalable InvestmentModels are based on an annual per-user rate alongside required key management. Schedule a 30-minute briefing to review your requirements and receive an actionable, fully scoped quote |
See how your login holds up against a real attack.
Book a 30 minutes briefing with a Ciptor specialist. No slides you have seen before.
