A company that buys a security service is buying a promise it hopes never to test. Marketing should describe that promise in terms the client's engineers, lawyers and directors can each check: who answers, how quickly, with what authority, and at which point the client must decide for itself. When a claim cannot survive that reading, I would rather lose the enquiry than win the contract.
Selected leadership work / 01
Selling a NIS2 readiness review instead of a compliance package
When Italy brought the NIS2 directive into its law in autumn 2024, thousands of mid-sized firms became newly in scope.
Security marketing earns trust when it describes what the service will do on the worst night of a client's year, and what it will leave to the client.
I am chief marketing officer of Scudalpe, a Turin-based cybersecurity services company that monitors, tests and responds for 1,340 client organisations. Most are manufacturers and logistics businesses with 100 to 2,000 employees in northern Italy and the canton of Ticino. Revenue in 2025 was €81.2 million, and 470 people work from our security operations centres in Turin and Verona and our offices in Milan and Lugano. I lead 36 marketing colleagues through four heads, with a programme budget of €4.3 million. Ninety-two partner resellers and managed service providers originated 46 per cent of our new detection-and-response contract value last year, so much of my work is equipping other companies to describe our service accurately.
I began in 2000 in Stockholm, writing reseller price lists for a distributor of networking and firewall equipment. I grew up in Turin with a Swedish father and an Italian mother, and wanted to work in his country before settling. Later roles at a Milan distributor and a Bologna backup-services company taught me the difference between selling a box and selling a commitment. A firewall can be demonstrated on a table. A response service is judged months later, often at three in the morning, by people who never read our brochure.
The decisions I would put before a board are those where accuracy cost us something measurable. We sold a readiness review rather than a NIS2 compliance package and lost much of a large partner's business for a year. We removed 34 client logos from our website because we lacked current written consent. We stopped marketing detection services to firms under 100 employees, where global vendors offered a cheaper and adequate alternative. Each choice reduced a number that someone in the company valued. Each also narrowed the gap between what we said and what a client later experienced.
236 readiness reviews and no compliance promise
When NIS2 reached Italian law in autumn 2024, we declined to package compliance. Enquiries reached 1,420 against a plan of 2,400. By September 2025 we had completed 236 fixed-fee reviews, and 71 of those clients had added monitoring.
Written consent behind every client logo
In 2022 our website showed 48 client logos. Written consent existed for 19, and five of those firms had left. We cut the display to 14, then rebuilt it to 26 by 2025, each with a consent record naming where the logo may appear.
An AI claim reduced to three published figures
Our triage model closed 63 per cent of low-severity alerts in 2025 under rules our analysts approve. We publish that figure, the median time to analyst review for high-severity alerts and the share of all alerts a person examines, instead of claiming autonomous protection.
Current focus
I am rewriting our partner certification so that access to co-marketing funds depends on using claims both companies can evidence, and preparing, with the clients' agreement, our first published account of incidents where our own detection was late.
Conversations I welcome
I would welcome a first non-executive seat with an Italian or Swiss mid-sized company that depends on digital operations or partner channels, with eighteen days a year available, subject to my chief executive's consent and a conflicts review.
The leadership record
Trusted with consequential decisions.
In the boardroom
Fondazione PontevigileNon-executive director (unpaid) · 2021–present
Formation
Laurea in business economicsAteneo Varsellino · 2000
Postgraduate certificate in information-security governanceAteneo Varsellino · 2016
We hired Matteo expecting to restrain him. Instead he spent his first winter on night shifts with our analysts and came back asking us to remove sentences we had written ourselves. He argues hard, then puts the losing side's case in the board paper as fairly as his own.
Alberto FenzaroloCo-founder and chief executive, ScudalpeThe full record ↗
Contact
I would welcome a first non-executive seat with an Italian or Swiss mid-sized company that depends on digital operations or partner channels, with eighteen days a year available, subject to my chief executive's consent and a conflicts review.
