Nuutti Kotivuori

I started in the Finnish security industry of the early 2000s, building VPNs and cryptographic protocols. I went on to co-found companies in the payments industry — including a payment terminal and processing business running a cloud-native, PCI DSS Level 1 certified platform on AWS — and took them through acquisition by a major European payment processor, where I led the integration of a 170-person development hub and later group-level technology strategy across several countries.

That path means I have sat on every side of the table this practice serves: the founder being diligenced, the acquirer integrating what was bought, and the architect accountable for what the slide deck promised. I know which drawers due diligence should open, because mine have been opened.

Along the way: adversarial security thinking and cryptographic protocol work, cloud architecture at certification-grade rigor, embedded systems, and the strategy work of aligning hundreds of engineers behind a technology direction — the full stack from silicon to steering committee.

I'm known for saying it like it is. If something is good, I say so; if something is shit, I say that too — plainly, with evidence, and with an honest view of what it would take to fix. Clients don't hire me to be political; they hire me because I'm not.

The name carries the method three ways: the disclosure schedules of the M&A world, the full-disclosure tradition of the security community, and the plain fact that you get everything I find. Nothing gets held back to seed a follow-on engagement.

Full disclosure: I sign my emails "— Naked". The nickname is older than most codebases I audit, and people deal with it.