Cyber audit
A technical and organisational assessment: exposure, gaps against frameworks, sticking points and priorities. A report management can read, linked to an action plan.
On quotation
The firm · Galyct Pro’s human backup
The firm behind Galyct Pro
The Galyct firm steps in when the need goes beyond using the platform on your own: audit, risk analysis, continuity, compliance, crisis or governance. The software and the firm share the same name because they follow the same doctrine.
Understand the risk. Take back control. Stay the course.
Scoped interventions, on quotation · no guaranteed result · we never ask for your access codes.
01 · SOFTWARE & FIRM
A clear boundary: the software steers, the firm reinforces
Galyct Pro does not set the tool against people, it links them. The platform carries the day-to-day load; the firm steps in as needed, where field experience and an outside view are required.
Day to day · on your own
The Galyct Pro software
You steer on your own, every day, in a unified cockpit, with the Mistral AI assistant (France/EU) under human oversight.
- Risk mapping & EBIOS RM scenarios
- Incident management: crisis cell, playbooks, log
- ISO 27001 · NIS 2 · DORA · GDPR compliance (72 h)
- Connectors, watch, analysis and evidence register
As needed · on quotation
The firm, on an engagement
When the situation goes beyond what a tool covers: human expertise, framed by an engagement letter and a quotation.
- Audit, EBIOS RM carried out with you
- Forensics & establishing evidence
- Crisis management on site or remotely
- Outsourced CISO / DPO, information security governance
The firm builds on your data already structured in the platform: no re-entry, the engagement starts on solid ground.
02 · THE ENGAGEMENTS
What the firm takes on
Eight families of engagements, always on quotation, sized to your organisation. No commitment to a result: a commitment to method, traceability and usable deliverables.
EBIOS RM
ANSSI’s risk analysis method, carried out with your teams: risk sources, feared events, strategic and operational scenarios, treatment plan.
On quotation
Forensics & evidence
Digital investigation carried out without destroying traces: collection, preservation and analysis of the material, a timestamped file you can defend before the insurer, the regulator or the court.
On quotation
Crisis management
Human reinforcement at your side during the incident: running the cell, trade-offs, communication and incident log, to take back control without improvising.
On quotation · dedicated crisis line
Remediation
After the incident or the audit: controlled rebuilding, hardening, verification of fixes and tracking of the evidence of correction, until a sound posture is restored.
On quotation
Outsourced CISO / DPO
A part-time security or data protection function: regular steering, committees, trade-offs and relations with your stakeholders, without recruiting full time.
On quotation · recurring
Information security governance
Security policy, roles and responsibilities, executive dashboard and multi-year trajectory: set up governance that lasts, not a dead binder.
On quotation
Continuity (BCP / DRP)
Business impact analysis (BIA), critical activities, RTO/RPO, recovery scenarios and exercises (ISO 22301): prepare and test recovery before a disaster forces it on you.
On quotation
03 · WHEN TO CALL ON THE FIRM
Four moments when the software is not enough
The platform covers day-to-day steering. The firm steps in when the stakes, the urgency or the workload go beyond what you can handle alone.
A crisis exceeds your internal resources
Ransomware, intrusion, leak: you open the cell in the software, but you want experienced human reinforcement at your side to make decisions under pressure.
An investigation by the book is needed
Insurer, regulator, litigation: the situation calls for a forensic investigation carried out according to best practice, which preserves the evidence. Its weight before a court or an insurer then remains for them to assess.
An obligation binds you
NIS 2, DORA, customer audit, call for tenders: you must demonstrate a credible approach and want an outside view to structure it and attest to it.
You have no in-house CISO
No dedicated security skills, or a workload that does not justify a full-time position: an outsourced function steers the trajectory alongside you.
04 · HOW IT WORKS
From first contact to deliverable, a scoped engagement
No grey areas: scoping, a quotation, an engagement letter, deliverables. The platform serves as a common foundation throughout the intervention.
01First contactYou describe your need or your situation. In a crisis, the dedicated line bypasses everything else.
02ScopingObjective, scope, urgency, constraints and expected deliverables: we qualify before we quote.
03Quotation & engagementA clear quotation and an engagement letter: workload, schedule, commitments and explicit limits.
04InterventionOn site or remotely, with your teams, backed by the platform, without ever asking for your codes.
05DeliverablesReport, evidence, action plan: usable, linked to decisions, added to your cockpit.
06Follow-upEvidence of correction, indicators and trajectory: the software takes over again day to day.
05 · WHAT WE DO NOT PROMISE
An honest firm also says what it does not guarantee
A serious service states its limits. What the firm commits to: a method, traceability and usable deliverables, never a magic result.
No guaranteed result
An engagement reduces exposure and informs decisions: it does not make an incident impossible. No result is guaranteed, and a limited analysis never proves the total absence of risk.
No attribution without evidence
No one is named as responsible without sufficient technical or contextual evidence. What cannot be demonstrated is presented as a hypothesis or a limit, not as a fact.
We never ask for your codes
The firm asks for no passwords, no bank codes and no access that a legitimate third party would not require: every access needed is governed by the engagement, with your approval.
No decorative report
A deliverable serves a decision, a remediation or a piece of evidence. Being listed on Cybermalveillance.gouv.fr is not a state certification: we never present it as one.
06 · REFERENCES
Organisations supported, in every sector.
Every case remains confidential. Here are the sectors we have already supported and three typical engagements, anonymised, each with its limit.
Healthcare, medical practicesConstructionHospitalityRetail and luxuryAutomotiveSecurity and automationCultureSMEs and micro-businesses
Construction · audit and steering
Infrastructure audit for an SME
Devices, email systems, security policies, awareness training. Deliverable: a prioritised remediation plan.
Limit: the audit ranks the priorities; implementation remains the organisation’s responsibility.
Healthcare · compliance
Medical practice: security, compliance, training
Security audit, compliance work on health data, staff training.
Limit: compliance has to be maintained over time; it is never achieved once and for all.
Security · network
Deploying a hardware firewall
Installation of a French hardware firewall and network hardening for an SME.
Limit: a firewall reduces exposure; it replaces neither updates nor vigilance.
A cyber crisis in progress?
Suspected intrusion, ransomware, compromised critical account, data leak: stabilise without destroying the evidence. The firm opens a crisis cell with you and keeps the thread of decisions. A dedicated line, separate from sales enquiries.
The Galyct ecosystem
The firm, within a coherent whole
Galyct publishes the Galyct Pro platform and carries out the firm’s human engagements: the software and the expertise share the same brand, the same methods and the same foundation, hosted in France with Scaleway. You never switch from one world to another. Datashield Risk Consulting (SAS) is the legal entity: it contracts and answers for professional ethics.
Full details of the firm, the team and all the services are on the ecosystem’s website.
Going further
Explore the software side
- The platform in detail: the six linked capabilities
- Use cases: the console in action
- By role: CIO, CISO, DPO, management
- Frameworks: ISO, NIS 2, DORA, GDPR
- Pricing: Essentiel €99/month, passes €490
The software to steer. The firm for engagements.
Start by touring the cockpit with sample data, or describe your engagement needs directly. No commitment, your data processed in the European Union.