One cell per crisis
Ransomware, compromised account, data leak: each crisis has its own space. Roles brought together, communications and switchovers recorded, scope shared by the whole team involved.
Operational management · the cockpit in action
Follow a cyber action from its initial signal to its closure.
Once a signal has been qualified, Galyct Pro lets you link it to a risk or an incident, assign an action, track its status and keep the material that justifies the decision and the closure.
Understand the risk. Take back control. Stay the course.
Hosted in France with Scaleway · Mistral AI (EU), under human oversight · no guaranteed result: we reduce exposure, we do not promise zero risk.
01 · THE OPERATIONAL LOOP
Six stages, a single thread that never breaks
Operational management is not a succession of tools, it is a loop. Every signal from the field becomes an analysis, a priority, an action, then defensible evidence. You come in at the relevant stage; the others follow, without re-entry.
- 1ObserveYour connected tools (EDR, firewalls, backup, intelligence) report their signals: the “Signals” view brings them together, sorted and filtered on your exposure.
- 2AnalyseLinks, email headers, domains, IOCs and vulnerabilities qualified; automated analysis in Europe, under human oversight.
- 3PrioritiseThe cockpit correlates assets, risks, alerts and obligations: the next decision becomes visible, not buried.
- 4ActAssigned actions, owners, deadlines, playbooks and remediation tracked end to end.
- 5ProveFacts, hypotheses and decisions linked: a defensible file for management, audit, insurer or regulator.
- 6HoldContinuity, exercises, lessons learned and trajectory: the organisation learns and holds steady over time.
The principle: nothing is entered twice, nothing gets lost between two stages.
02 · THE CRISIS CELL
Take back control without destroying the evidence
In a crisis, the first casualty is traceability. We open a dedicated cell, bring the roles together and keep the incident log: while you stabilise, the cockpit keeps the thread of decisions, for the insurer, the regulator and legal.
Timestamped playbooks
Operational playbooks (BEC, ransomware, exfiltration), timestamped, assigned and scored: critical steps, evidence requirements and SLAs. You take back control without improvising.
Decision log & evidence
Every decision, hypothesis and action is recorded, timestamped and exportable. The log distinguishes established facts from weak signals: what we know is never confused with what we suppose.
Regulatory clock
Schedules and notifications in real time, including notification of a GDPR breach to the CNIL within 72 hours: the right people alerted at the right time, without letting a critical deadline slip.
03 · THE INCIDENT LOG
What the team really sees during a crisis
Extract from a cell’s log, example case: compromise of an email account (BEC). Each line is timestamped, attributed and defensible after the fact.
- 09:14 Alert receivedConnectorUnusual login on a management account reported from Entra ID. Event opened, crisis cell created.
- 09:22 QualificationFactHeaders of two emails analysed (SPF/DKIM/DMARC): spoofing confirmed, IOCs added to the case and matched with an incoming MISP indicator.
- 09:31 DecisionTraceableForced account reset and revocation of sessions. Decision recorded, owner: IT administrator.
- 09:40 HypothesisWeak signalPossible malicious forwarding rule, to be checked. Marked as a hypothesis, not as an established fact.
- 10:05 Deadline set72 hImpact analysis opened: if personal data is affected, the CNIL notification clock is started and tracked.
A real illustration of the principle, fictitious data. Resolution is judged case by case: no result is guaranteed.
04 · ASSIGN & TRACK ACTIONS
Every action has an owner, a deadline, a status
A decision without an owner or a deadline is not a decision. The cockpit turns every trade-off into a tracked action: who does what, by when, where things stand, in a crisis or not.
- Isolate the suspect workstation from the networkIT administratorTodayIn progress
- Notify management & the DPOCISO+2 hIn progress
- Check the Acronis backupsManaged service provider+4 hTo do
- GDPR impact analysisDPO+24 hTo do
- Lessons learned & remediation planCISO+7 dScheduled
Owners & roles
Actions assigned to a real person, according to their role (admin, editor, member). Everyone sees what is theirs to do, without losing the overall view.
Deadlines & SLAs
Visible deadlines, automatic reminders, regulatory deadlines set: no deadline slips because “nobody had noticed it”.
Status & proof of closure
Each action closes on evidence of correction. Tracking becomes a register that the committee, the audit or the insurer can use.
05 · WHAT COMES IN FROM THE FIELD
Your own tools feed the cockpit, read-only
You bring your instances; Galyct reads them and never controls them. EDR, firewalls, backup and intelligence report to the same place, filtered on your exposure, without an intelligence database outside the European Union and without a Galyct agent to deploy on your workstations.
EDR / XDR
CrowdStrike, SentinelOne, Microsoft Defender, HarfangLab, Sophos: detections and health of the workstation fleet, read-only.
Firewalls
Stormshield, Clavister: network alarms (filtering, IPS) are reported to the cockpit and the crisis cell.
Backup
Acronis: the status of jobs and restoration tests, backup that is monitored, not assumed.
Intelligence
MISP and CERT-FR watch: the indicators and bulletins relevant to your context, linked to your scenarios.
“The customer brings their own instance”: read-only connection, nothing to install on workstations. New connectors are added in waves. See all the connectors →
AND ONCE THEY COME IN
Three views that embody the loop
Signals do not pile up: they are sorted, attached to the fleet and become decisions. Three cockpit views, fed by your connectors, visible today with sample data.
Signals
The consolidated feed from all your tools, sorted by severity and by source. In one click, a signal becomes a tracked remediation action, or opens the crisis cell.
Fleet & agents
The health of your fleet at a glance: workstations at risk, tamper protection disabled, machines not seen, aggregated from your EDRs and firewalls.
Incident centre
The triage command post: crisis status, critical signals to decide on, recent timeline, to decide before acting in the cell.
06 · HOLDING STEADY OVER TIME
After the crisis, continuity: the loop closes
Taking back control is not enough: you must restart, learn and be ready next time. Continuity closes the loop and feeds risk steering once again.
01RestartBCP / DRP (ISO 22301), critical activities and RTO/RPO per activity: a steered recovery, not an improvised one.
02DocumentIncident case and evidence register linked to decisions: defensible before a committee, an insurer or a regulator.
03LearnStructured lessons learned: what worked, what was missing, what we fix, without pointing fingers.
04PreventThe lessons learned feed the risk scenarios and the next exercises: the organisation moves up a level of maturity.
07 · WHAT WE DO NOT PROMISE
Steering an incident also means setting its limits
Serious operational management states its limits. What we deliver: usable findings, traceable decisions and a trajectory that is followed.
No zero risk
The aim is to reduce exposure and keep the thread of decisions, not to guarantee that an incident is impossible: no result is guaranteed.
No attribution without evidence
No one is named as responsible without sufficient technical or contextual evidence. What cannot be demonstrated remains a hypothesis, never a fact.
AI assists, people decide
Automated analysis, in Europe, speeds up qualification; the decision remains human and supervised. We never ask you for your codes or your passwords.
A deliverable serves a decision
Log, case file, lessons learned: every trace serves a remediation, a piece of evidence or a trade-off. Otherwise, it has no place in the console.
A cyber crisis in progress?
Suspected intrusion, ransomware, compromised critical account, data leak: stabilise without destroying the evidence, and get support. We open a crisis cell and keep the thread of decisions.
See operational management in your context.
Tour the cockpit freely with sample data, or request a 30-minute live demo. No commitment, your data processed in the European Union.