Executive summary
A short reading of major risks, business impacts, trade-offs and priority decisions, which an executive committee can understand.
Expert engagements · the firm · on quotation
Engagements carried out by the Galyct firm
Some situations call for human intervention beyond the software. The firm carries out audit, risk analysis, continuity, governance, outsourced CISO/DPO and crisis management engagements, on a scope defined in the quotation.
Understand the risk. Take back control. Stay the course.
French firm · scoped engagements · deliverables you can defend before a committee.
On quotation
Scoping
6
Services
30/60/90
Trajectory
01 · SOFTWARE + FIRM
The software steers. The firm carries out the engagements.
Two complementary answers, under one French brand. You remain in charge of the decision; we provide the tool and, when needed, the experts.
On your own
The Galyct Pro application
You steer day to day, with AI: diagnosis, risk governance, incident management and compliance, on a unified console hosted in France with Scaleway.
- Unified cockpit & decision-making data visualisation
- ISO / NIS 2 / DORA / GDPR frameworks
- Connectors & timestamped evidence register
Engagements on quotation
The firm’s experts
When expert hands are needed: audit, EBIOS RM, continuity, governance, outsourced CISO / DPO, crisis management and remediation. Scoped engagements, a clear scope, usable deliverables.
- Cyber audit & EBIOS RM analysis
- BCP / DRP / BIA · information security governance
- Outsourced CISO / DPO · crisis & remediation
02 · THE ENGAGEMENTS
Six services delivered by experts, on quotation
Each engagement is sized to your organisation during scoping. The price depends on the scope, never on a catalogue: we talk about what is at stake for you first.
Cyber audit
Measure the real exposure and prioritise what protects the business. Identities, email, workstations, backups, external exposure, governance, with a 30 / 60 / 90-day plan.
Talk to an expert →EBIOS RM analysis
ANSSI’s risk analysis method, in 5 workshops: security baseline, risk sources, strategic and operational scenarios, treatment, to link scenarios and decisions.
Talk to an expert →BCP / DRP / BIA
Clearly distinguish impact analysis, continuity and recovery. Critical assets and processes, degraded modes, indicative RTO / RPO, a plan that works when the day comes.
Talk to an expert →Information security governance & compliance
Structure roles, policies, committees and indicators. RACI, risk register, incident procedures, GDPR and action tracking: documentation that reflects real practices.
Talk to an expert →Outsourced CISO / DPO
Set up a cyber and data function that can be steered, without oversizing it. The CISO steers security, the DPO supports GDPR compliance: roles clarified, committees prepared, evidence kept.
Talk to an expert →Crisis & remediation
Take back control without destroying the evidence. Qualification, crisis cell, decision log, notifications, then tracked remediation with closure criteria and lessons learned.
Talk to an expert →03 · THE METHOD
A structured, readable and proportionate approach
Each engagement follows the same logic: scope, understand, verify, prioritise, report. Findings are worded to enable action, not just to state facts.
1ScopingObjectives, constraints, scope, contacts and business criticality.
2Collection & interviewsInventory, access, backups, procedures, providers, past incidents.
3Targeted checksNon-destructive checks, consistency of measures, exposure, evidence.
4PrioritisationRisk, impact, probability, effort, dependencies and remediation sequence.
5ReportingExecutive summary, detailed findings, trajectory and expected decisions.
6Moving to actionTracked remediation, or handover to the Galyct Pro software for ongoing steering.
04 · THE DELIVERABLES
Decision-oriented deliverables
The report must be usable by management, IT, the DPO, legal, the insurer, a committee or a remediation provider.
Register of findings
Classified findings, dated evidence, scope, risk level and associated recommendations.
Prioritisation matrix
Quick wins, structural projects, dependencies, urgency, effort and likely owner.
30 / 60 / 90-day plan
A pragmatic trajectory to regain control without spreading resources too thin.
Committee material
A readable version for the CEO, CFO, management committee, insurer or stakeholders.
Bridges & follow-up
Links to hardening, BCP/DRP, governance, outsourced CISO, or to the Galyct Pro software for ongoing follow-up.
05 · MATURITY
A graded reading to know where to focus the effort
The aim is not to penalise, but to make visible the path between current exposure and the expected level of control, on the same scale as the cockpit.
Maturity scale
ExposedMeasures missing, implicit or dependent on key people.
ControlledMeasures in place but incomplete, rarely tested or poorly documented.
SteeredResponsibilities, procedures, indicators and corrections tracked over time.
ResilientMeasures tested, evidence available, continuity worked through, trade-offs owned.
06 · OUR COMMITMENTS
Four principles, on every engagement
What does not change, whatever the service or its size.
Independence
No third-party products to sell. Our recommendations serve your interests.
Confidentiality
Strict discretion and partitioning, particularly on sensitive cases.
Evidence & rigour
Documented, defensible findings, useful before a committee, an insurer or a judge.
No over-promising
We also say what we do not guarantee. Total security does not exist.
“Cybersecurity is not just a matter of tools: it is a series of decisions that you must be able to explain after the fact.”
This is the firm’s reason for being: turning a doubt or an obligation into a workable scope, then into traceable decisions. The Galyct Pro software keeps them alive over time: the engagement sheds light, the tool steers, the responsibility remains yours.
07 · WHAT WE DO NOT PROMISE
Each service states what it does not guarantee
A serious engagement sets its limits. What we commit to: usable findings, traceable decisions and a trajectory that is followed through.
No zero risk
No engagement guarantees the absence of compromise or vulnerability. The aim is to reduce uncertainty and assess exposure objectively. No result is guaranteed: we commit to method and rigour.
No attribution without evidence
We do not name a culprit or a cause on the basis of an assumption. A finding is dated, documented and defensible, or it is not stated.
No exhaustive compliance by default
An intrusive penetration test is scoped separately; GDPR or sector-specific compliance requires a precise scope. We do not certify exhaustive compliance by default.
Never your codes
Our experts will never ask you for your passwords or your personal access codes. Checks are carried out within a defined framework, with your explicit authorisation.
A cyber crisis in progress?
Suspected intrusion, ransomware, compromised critical account, data leak: stabilise without destroying the evidence, and get support. The firm opens a crisis cell and keeps the thread of decisions.
See Galyct Pro in your context.
A 30-minute live demo to understand how the software steers and where the firm steps in. No commitment. An engagement to scope? Talk directly to an expert.