Insight
4 min read
When a security consultant takes on a new client, the process typically starts with weeks of manual analysis: working through documents, sorting findings, drafting reports and mapping everything to the applicable compliance frameworks. Leslie Clement and Erie Berhitu know that process from the inside. Both spent years working as CISOs and security consultants before founding Clember in 2023, based in Utrecht.
Their platform automates exactly that preparatory and administrative work. Consultants upload client documents and connect their existing security tools to the platform; Clember then generates a structured overview of the client's cybersecurity posture, including mappings to frameworks such as NIS2, ISO, GDPR and CIS. What normally takes weeks should, in this way, be available within minutes.
Clember is fully bootstrapped, with no external investors. The company explicitly positions itself as EU-first, which is relevant in the cybersecurity market given the growing body of European regulation around data processing and digital resilience.
Security consultants spend a significant portion of their time on work that adds little value for the client: collecting, sorting, formatting and reporting. The actual strategic advisory work, the reason clients hire a consultant in the first place, only comes into play once that groundwork is complete.
Clement and Berhitu experienced this themselves for years in practice. Clement works as a virtual CISO and combines roles as Global Privacy Officer, certified Data Protection Officer and Chief Strategy Officer. Berhitu has a comparable background as a security consultant and CISO. That shared experience was the direct motivation for building Clember: a tool they would have wanted to have themselves.
The decision not to pursue venture capital is notable in a market where AI security startups typically raise large funding rounds. Bootstrapping gives the founders greater control over product development and the company's direction, but it also requires early customers to see value quickly and be willing to pay for it.
The core of Clember is relatively straightforward to describe: consultants bring in their client data, the platform analyses that data and presents a structured picture of the cybersecurity situation, mapped to relevant compliance requirements. In practice, this means findings are automatically benchmarked against standards such as NIS2, ISO 27001, GDPR and the CIS framework, frameworks that serve as the primary reference for many Dutch and European organisations.
Clember also integrates with existing security tools that consultants already use, so no separate data pipeline needs to be built. The platform is therefore intended as a layer on top of existing workflows, not a replacement for the tooling consultants already know.
The result is that a consultant spends less time building a baseline analysis and can move more quickly to the conversation with the client about priorities, risks and measures. Risk tracking and reporting are largely automated.
One of the well-known names that Clember has already brought on board is Northwave Cyber Security, a Dutch company specialising in managed security services. Northwave has integrated the platform into their Managed Security & Privacy Office, a service through which they continuously monitor and manage the security and privacy posture of their clients.
The integration is aimed at more consistent reporting and scalable service delivery. For Northwave, this means in practice that consultants within the MSPO team spend less time manually compiling status overviews and more time advising clients.
The early adoption by an established Dutch security firm like Northwave gives Clember a reference in a market where trust and reputation carry significant weight. Security consultants are by nature critical of tools that gain access to sensitive client data.
Clember targets a specific segment: advisory firms and security teams that need to produce analyses based on client documents and existing tools. This is a different market from the large automated security monitoring platforms aimed at enterprise IT departments. The focus on consultants as the primary user means the platform accounts for variable client contexts and shifting compliance requirements from one engagement to the next.
The EU-first positioning aligns with growing demand from European organisations looking to align their cybersecurity processes with NIS2, the European directive on network and information security that was transposed into national legislation in 2024. For consultants guiding clients through that transition, a tool that maps findings directly to NIS2 requirements has practical utility.
For the Dutch and European AI scene, Clember is an example of a vertical AI application in which domain knowledge is central. The founders did not build a generic AI product, but used their own sector experience as a starting point. That pattern, former practitioners automating their own workflow, is an approach that is appearing with increasing frequency in the European B2B market and has become a recognisable model for investors and other founders alike.
CuspAI, founded in 2024 and operating from Amsterdam and Cambridge, uses generative AI to design new materials that can be discovered up to ten times faster than through traditional methods. The company has raised $130 million to date and works with partners including ASML, Meta and Hyundai.
Rotterdam-based Crownstone is building an indoor positioning system using Bluetooth modules mounted behind power outlets that draw power from the electrical grid. The system localises people and objects at room level and targets applications in healthcare, safety and building management.
The Dutch healthcare and health sector counts 78 active startups in 2026, a large share of which deploy AI for diagnostics, hospital logistics and home care. Funding is concentrated among a handful of players; broad adoption and regulation remain the principal bottlenecks.
