As the threat ecosystem evolves quickly, safeguarding our defenses with appropriate strategies is unignorable. Through expert-led conversations, ExtraMile by SecureITWorld empowers you with the right information and the confidence to adopt robust security measures that keep your organization resilient against cyber threats.
In today's Q&A session, we are delighted to welcome Hannaleena Pojanluoma, the CEO of the leading endpoint data protection provider, Jetico. With 30 years of excellence, the company has been serving across government, defense, and enterprise markets. It has been a trusted partner for the US Department of Defense for data encryption and protection measures for years.
Our guest, Hannaleena, holds expertise across marketing, sales, and technology. She joined Jetico in 2015 and has been a key contributor to the company's growth ever since. Hannaleena has led Jetico to advance security solutions while offering greater visibility into sensitive data alongside AI-assisted data discovery. Throughout the discussion, she shared her professional experience over the years and on endpoint data protection.
Hannaleena highlights the risks of adopting AI to improve data discovery alongside Jetico's AI-powered data classification. She additionally sheds light on the changing needs of cybersecurity customers and how Jetico is addressing them.
Join us to explore how modern businesses are embracing advanced data protection measures.
1. You stepped into the CEO role after years in sales and marketing. What did that experience teach you about where cybersecurity companies lose customers?
Hannaleena. My background in sales and marketing gave me a very good view of what customers actually value, because I spent years listening to their requirements, objections and frustrations before moving into the CEO role.
Of course, price and functionality matter, but one of the biggest lessons was about trust. In cybersecurity, customers rely on vendors to help protect highly sensitive information, so trust has to be earned through transparency, a clear understanding of customer needs, responsive support and reliable products.
Sophisticated technology alone is not enough if customers do not feel confident in the company behind it.
2. Encryption is broadly understood today, yet sensitive data still gets exposed. Where do you think companies are getting data protection wrong?
Hannaleena. Encryption is essential and provides a strong foundation for data protection, especially for data at rest. But it is only one layer.
Once a device is running and data is being accessed, organizations also need controls over who and what can reach sensitive information. They need to know where that data is, protect it while in use and securely erase it when it is no longer needed.
Effective data protection therefore relies on multiple layers working together - from encryption and data discovery to access control and secure erasure.
3. Why are endpoint data protection and compliance crucial for modern businesses? How does Jetico excel in this domain, empowering businesses with robust data protection measures?
Hannaleena. Sensitive information is one of a company’s most valuable assets, which is why protecting it has become such a central business and regulatory priority. Compliance provides a framework to make sure that protection is applied consistently to data at rest, in transit and in use.
Endpoints are a critical part of that protection because they are where sensitive information is often created, accessed, processed and stored. If that layer is weak, a significant part of the organization’s data remains exposed.
Jetico brings more than 30 years of experience working with government, defense and other organizations operating under very strict security requirements. Many of the practices now becoming standard expectations in cybersecurity are areas we have been addressing for decades, and we bring that experience to the solutions we develop for businesses today.
4. AI can improve data discovery, but it can also create unexpected privacy risks. Where do you draw the line on using AI with sensitive data?
Hannaleena. For us, the line is control over the data. Once sensitive information is shared with an external AI system, it may no longer be possible to reclaim or remove it from what the system has learned.
That is why we distinguish between private, locally run AI and external AI services. Our own AI capabilities are optional and run locally, so sensitive information does not need to leave the controlled environment.
5. Jetico recently moved toward AI-powered data classification. What problem did you see that made AI worth adding to a mature security product?
Hannaleena. I would describe our approach as AI-empowered rather than AI-powered. The underlying data discovery technology does not depend on AI; AI is an optional extension that makes a complex task easier.
Traditional data discovery works well when you know what to look for – for example, a specific credit card number or a recognizable number pattern. The challenge comes when sensitive information is defined more by context and is therefore harder to describe with fixed rules.
AI helps identify more complex patterns and understand context by recognizing similarities across documents, including organization-specific content. This use of AI reduces the manual work needed to classify sensitive data while keeping the technology optional.
6. Jetico’s latest access-control strategy uses a default-deny model. What has changed in the threat ecosystem that made traditional trust models inadequate?
Hannaleena. The meaning of “trusted” has changed. Traditional security models often relied on identifying known malicious behavior and blocking it, but today threats can be created and customized much faster, including with the help of AI.
At the same time, risk does not come only from malware. Legitimate applications, automated processes, AI assistants or authenticated users may still access data they should not.
That is why default deny has become increasingly relevant: protected data remains inaccessible unless a user or application has been explicitly approved. BestCrypt Data Shelter applies this principle at the data level, closely aligning with Zero Trust.
7. Regulations such as NIS2, DORA, and the EU Data Act keep expanding. How can companies turn compliance requirements into meaningful operational improvements?
Hannaleena. The wrong approach is to treat compliance as a checklist that appears once a year before an audit. It is much more useful to see it as a continuous process.
Regulations provide direction, but organizations still need to translate requirements into their own risks and everyday practices. A practical approach is to start with a manageable set of risks and ask simple questions such as: Where is our sensitive data? Who and what can access it?
Cybersecurity is never static, so compliance should not be seen as a finish line. When it leads to better visibility, stronger controls and auditable processes, it becomes a driver for better security rather than simply a regulatory obligation.
8. Jetico serves customers across government, defense and enterprise markets. Which customer demand has changed your product decisions in recent years?
Hannaleena. One major change has been the growing demand for visibility and demonstrability.
Compliance has made data protection a broader business responsibility, not something that belongs only to IT. Organizations need to show that policies are being applied and communicate results to different stakeholders.
That has influenced our development significantly. We have made our core technical controls manageable from a central console, with KPI dashboards and clearer, more accessible reporting. Together, these capabilities give organizations greater visibility across their environment.
Data discovery is not only about finding sensitive information; it can also help demonstrate that security policies are working. If a scan finds no sensitive data outside the locations or protections defined by policy, that result becomes evidence that the controls are being applied as intended.
9. After spending a significant time in cybersecurity, what is one industry assumption about data protection that you strongly disagree with today?
Hannaleena. I would challenge the idea that protecting the perimeter, or relying on one strong control such as encryption, is enough.
Not every risk comes from outside. Sensitive data can also be exposed by trusted users, legitimate applications and processes operating within the environment.
Effective data protection therefore needs several layers across the full data lifecycle – from discovery and protection to access control and secure erasure.
Discover More In-depth Interviews:
