A report secures nothing. Acting on it does.
The tools are installed. The risk is almost never measured.
of EU enterprises suffered an ICT security incident with consequences in 2023. Source: Eurostat, ICT usage survey in enterprises.
of small European enterprises use strong password authentication. The basic tools are there. Source: Eurostat, 2024.
only carry out an assessment of their ICT risks. Seven out of ten do not know where they are exposed. Source: Eurostat, 2024.
Understand where you stand, fix what matters, make it last.
Understand where you stand
A review of your infrastructure, your policies and your operations. Penetration testing, access controls, prioritised findings. You leave with an ordered list, not a 200-page document.
Already have an audit? We start from there.
No need to redo the analysis. We take the existing recommendations, prioritise them with you, and help you implement them: configuration, access, MFA, backups, policies, documentation, and coordination with your IT provider.
Make it last
Once the main gaps are closed, we help you hold the level you have reached and adapt the measures as your company changes. Regular review of access, backups and critical components.
Training and awareness
Give your teams the reflexes to spot and stop attacks. Awareness program, phishing simulations, data-protection best practices.
Compliance and certifications
NIS2, GDPR, ISO 27001, SOC 2, CyFun. From gap analysis to policy documentation, through to support on the day of the audit. We will also tell you what falls outside our scope.
Security policies
Creating or rebuilding your internal policies: password management, encryption, remote access, BYOD. Tailored to your organisation, not a generic copy-paste.
Incident response
A complete response plan: preparation, detection, containment, eradication, recovery. To limit the damage when something gets through. Four-hour response for clients on a support contract.
Resources on cybersecurity
Recent articles to go further on the topic.
The AI Act: rules written before ChatGPT, revised without a new assessment
American start-ups capture 61 % of global AI funding, European ones 6 %. The usual conclusion is that Europe shot itself in the foot by regulating. The valid criticism is narrower: the impact assessment underpinning the AI Act dates from 2021, before generative models, and the July 2026 reform received none at all. What actually applies to a small business, and what does not hold up.
Cyber Resilience Act: what becomes mandatory on 11 September 2026, even for products you already sold
One date always comes up about the Cyber Resilience Act: 11 December 2027. But a first deadline arrives much sooner. From 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents, including for software that has been sold for years. Here is what that means in practice, and what you need in place by then.
Where should you start?
First conversation, no strings attached. Whether you already have an audit report or nothing at all, we look together at what deserves to be dealt with first, and tell you honestly what can wait.