Clarify
Identify the assets, processes, data, accounts, providers and dependencies that the business really relies on.
Galyct Pro module · Manage risk
Map and prioritise cyber risks
The module brings together assets and dependencies, EBIOS RM scenarios, the impact/likelihood assessment, existing measures and residual risk. Budget decisions and the treatment plan can be attached to each scenario.
Understand the risk. Take back control. Stay the course.
Inspired by EBIOS RM (ANSSI) · hosted in France with Scaleway · Mistral AI (EU).
01 · WHY
Risk analysis must come before purchases, projects and trade-offs.
Without a structured reading of risk, an organisation often invests in what looks reassuring, not in what actually protects the business. The module brings cyber risk up to the level of management language: impact, continuity, accountability, compliance, budget and trajectory.
Qualify
Link feared events to credible scenarios: fraud, outage, leak, tampering, extortion, compromise or service disruption.
Decide
Prioritise treatments according to business impact, likelihood, existing measures, cost, lead time and accepted residual risk.
02 · WHEN TO START
The approach is useful as soon as a cyber decision has to be justified.
Justifying, funding, defending or aligning a decision with a business stake: each trigger opens the right scoping.
Before a cyber budgetIAM, backups, EDR, monitoring, BCP/DRP→
Before a sensitive projectCloud, ERP, outsourcing, new provider→
After an audit or incidentFrom technical findings to business scenarios→
Before an insurer or customer reviewDocument control, gaps, trajectory→
For BCP / DRP / BIAContinuity, critical dependencies, recovery priorities→
For governance or complianceA common basis for the committee, the DPO, the business units→
03 · THE METHOD
An approach inspired by EBIOS RM, in five workshops.
The method is framed to remain usable. It can be complete for a strategic scope or lighter when the aim is to produce a decision-ready reading quickly.
1Business scopingObjectives, scope, essential assets, critical processes, stakeholders and expected decisions.
2Risk sourcesInternal, external, human, technical, physical and regulatory threats, and threats linked to providers.
3Risk scenariosFeared events, plausible attack paths, vulnerabilities, existing measures, likelihood and impacts.
4Risk treatmentAvoid, reduce, transfer or accept, then prioritise measures, owners, budgets, lead times and evidence.
5Residual riskAssess what remains, confirm whether it is acceptable, organise follow-up, review and new trade-offs.
→Management decisionThe residual risk is put to a decision: reduce, accept, transfer or treat as a priority.
04 · MATRIX & ROSI
Two readings that make the trade-off sustainable.
The matrix ranks. ROSI puts a figure on the effort. Together, they turn an intuition into a defensible decision.
Rank
Impact × likelihood matrix
Each scenario is placed according to its business impact and its likelihood. The zones that stand out guide the priority: what really threatens the business comes before what merely reassures.
- Business impact: shutdown, fraud, data loss, notification, breach of contract
- Likelihood adjusted for existing measures
- Zones of acceptable risk, risk to reduce or unacceptable risk
Put a figure on the effort
ROSI & documented trade-offs
Return on security investment (ROSI) links a measure to the risk it reduces. The cyber budget stops being comfort spending: it becomes a trade-off that is ranked, costed and documented.
- Cost, lead time and protective effect of each measure
- Prioritisation by urgency, feasibility and dependency
- A decision you can explain after the fact, with the budget to back it up
05 · THE OUTPUT
The output is not a table: it is a trajectory you can decide on.
The result must enable management to understand what threatens the business, what is already under control, what remains exposed and what requires a budget, a decision or a deliberate choice to forgo.
Business impact
What the event would actually change: shutdown, fraud, data loss, inability to serve, notification obligation, breach of contract.
Residual risk
What remains after existing measures, and what the organisation accepts, reduces or temporarily postpones.
Prioritised trade-off
Actions ranked by urgency, feasibility, cost, dependency, protective effect and responsibility.
05 · MATURITY
Where do you really stand?
The module places your organisation on a readable maturity scale, from exposed to resilient, and shows the way from one rung to the next.
Maturity scale
ExposedNo visibility, no plan
ControlledFirst safeguards in place
SteeredRisks tracked & decided on
ResilientCrisis prepared, evidence kept
06 · DELIVERABLES
Material that the committee, IT, the DPO and the business units can use.
The deliverables are designed not to stay in a binder: they support decisions, budgets, action plans and follow-up.
Executive summary
Key messages, major risks, expected decisions, critical gaps and proposed trajectory.
Asset / dependency map
Essential assets, supporting assets, flows, providers, accounts, data and critical processes.
Risk scenarios
Strategic and operational scenarios, conditions for them to occur, impacts and existing measures.
Prioritisation matrix
Ranking by impact, likelihood, level of control, urgency, effort, lead time and residual risk.
Treatment plan
30/60/90-day measures, owners, expected evidence, closure criteria and dependencies.
Committee material
Short version for management, cyber committee, insurer, strategic customer, DPO or legal.
“An executive’s job is not to eliminate risk. It is to make decisions that are proportionate, documented and owned, despite uncertainty.”
Managing risk does not mean aiming for zero risk. It means producing a structured, reasoned and actionable reading at a given moment, and revising it when an incident, a change to the information system or a new business stake alters the exposure.
07 · WHAT WE DO NOT PROMISE
A risk analysis does not remove the risk.
It guarantees neither the absence of vulnerabilities, nor the absence of compromise, nor the total removal of risk: no result is guaranteed. It produces a structured, reasoned and actionable reading at a given moment, to be revised when an incident, a change to the information system, a new dependency or a new business stake alters the exposure. What we stand behind: usable findings, traceable decisions and a trajectory that is followed through.
See risk steering in your context.
A 30-minute live demo on your assets and your scenarios, or start on your own with the free executive diagnosis. No commitment.