Matteo Lindholm · Chief Marketing Officer · Europe
Customer trust as a matter for directors
My contribution to a board
A board increasingly hears about customer trust and cyber risk only when something has gone wrong. I would help directors examine both earlier and in ordinary terms. My experience is that the claims a company makes to customers, partners and regulators are a form of risk: a promise in a partner's brochure or a sentence about AI on a website can become an obligation or a dispute. I would ask how such claims are approved, who checks that operations can deliver them, and what the company would say if a client tested them on its worst day. I can also read a security report as a marketer who has spent twelve years among analysts, which helps when management presents cyber risk as a technical update rather than a business decision. My limits are clear. I have not been a director of a company, I am not a lawyer or an auditor, and I would need to learn a new company's markets before offering views on its strategy. I would begin as a committee member and earn any further role.
Judgement in practice
01
Separating a regulatory obligation from a product we wished to sell
When NIS2 became Italian law, our partners and sales team wanted a product called compliance. I asked who would carry the obligation if a client's board relied on our package and a regulator later disagreed. The answer was the client's management body, which meant the product name invited a belief we could not support. A board faces the same question whenever management proposes to market a regulatory change: is the company selling help, or selling a conclusion it cannot own? I would ask for the claim, the evidence behind it and the view of whoever would answer for it. I would also want the commercial cost of caution stated honestly. In our case it was €2.6 million of bookings and a partner's business for a year, and the board deserved to see both figures before agreeing.
02
Asking what a growth measure leaves out
After the 2022 investment, the board asked for client numbers and partner-sourced contract value each quarter. Both were reasonable. When we stopped marketing to firms under 100 employees, client numbers fell while contract value and margin rose, and one investor director initially read the change as a loss of momentum. I prepared a paper showing first-year churn by company size alongside the headline measures, and the board changed the indicator it watched. On another board I would ask the same thing of any growth figure: what does it count, what does it hide, and which decision would it lead us to make wrongly? I would not assume that management had chosen a misleading measure. More often a measure that was right at one stage of growth stays on the board pack after the business has moved on.
My first year on a board
I would spend the first months learning how the company earns trust and where it could lose it. That means reading recent customer complaints, partner agreements and the last two years of risk reports, then asking the chair which questions the board finds hardest to answer. I would visit at least one site and one major partner with management's agreement, and listen in on customer calls if the company allows it. During the first budget cycle I would compare the growth plan with the capacity of the teams that must deliver it, because promises made in marketing usually outrun operations before they outrun cash. I would ask to see one incident exercise or its report, since a board learns more from a rehearsal than from a dashboard. By the end of the year I would ask the chair and one executive for direct feedback on whether my questions helped or merely added work, and adjust accordingly.
Conflicts and their management
My conflicts are concentrated and fairly easy to map. Scudalpe sells security services to mid-sized companies in northern Italy and Ticino, works with 92 partners and monitors tools made by many vendors. A manufacturer in Piedmont could easily be a client, a prospect or a partner's customer. Before accepting a seat I would ask Scudalpe's general counsel and the prospective company secretary to check client, partner and vendor relationships, and I would decline if a link were material. I also hold confidential knowledge about incidents at client companies. That knowledge would never travel to another board, even as an anonymous example, without the client's permission. If a board discussed buying security services, I would leave that discussion regardless of whether Scudalpe was bidding. Time is the other constraint. Eighteen days must cover preparation and committee work as well as meetings, and our quarter-end and partner conference dates would be shared with the chair in advance.
My independence statement
My independence depends on who a company buys from and sells to, so I would map any prospective company's links to Scudalpe, its partners and the vendors whose tools we monitor before saying anything else. I hold a 0.4 per cent shareholding in Scudalpe from the 2022 management plan. I would disclose these interests to the chair and accept the board's own assessment under Italy's Corporate Governance Code or the Swiss equivalent.
Board and committee exposure
Presented to the Board or a committee
Scudalpe
Board of directors; quarterly growth and brand report
March 2022–present
As chief marketing officer I present a quarterly growth and brand report to the seven-member board and answer directors' questions on partner terms, regulatory claims and AI wording. I am not a director of Scudalpe.
Served as a director
Fondazione Pontevigile
Board of directors; programme committee member
June 2021–present
Unpaid director of a Turin charity teaching online safety in secondary schools. I sit on its programme committee, which approves school curricula and evaluates their results.