Advice & decision-making
Galyct Pro · businesses. Governance, risk analysis, continuity, crisis management, so that the decision comes before the crisis.
Discover Galyct Pro →The firm · Galyct
A cyber firm built around real cases.
Galyct works on incidents, investigations, governance and compliance matters. Galyct grew out of this work: first as in-house tooling to assess, trace and report on cases better, then as an ecosystem open to individuals and businesses.
01 · OUR PURPOSE
Putting evidence and decisions back at the centre.
Faced with a cyber incident, a fraud or a doubt, the first mistake is to act too fast (erase, reinstall, pay) and destroy what would have made it possible to understand and to defend yourself. Galyct exists to prevent that.
The method
Assess, secure, direct
We assess the situation methodically, secure the evidence, then determine the path that genuinely fits. Nothing is decided on an assumption, and no irreversible action is taken before the urgency and severity have been framed.
- Managing an organisation with Galyct Pro
- Helping an individual with Galyct Perso
- The firm stepping in directly on sensitive cases
The firm at a glance
One house, one doctrine
- Founded on 5 February 2024: a cyber risk management consultancy.
- Founded by Hans Mourette: 10 years of cyber expertise, president of the firm.
- Public reference: listed on Cybermalveillance.gouv.fr.
02 · THE ECOSYSTEM
Three expressions of one doctrine
What links our engagements is not a range of tools, but a doctrine: the CODEX. One house, three ways in: advice, investigation, assistance.
Investigation & establishing the facts
The firm. Digital evidence, forensics, established facts, so that nothing is decided on an assumption.
Have a case assessed →Assistance & people
Galyct Perso · individuals. Supporting victims, the human side of an incident, helping those who have been hit get back on their feet.
Discover Galyct Perso →
03 · THE FOUNDER
Hans Mourette
Hans Mourette founded the firm on 5 February 2024. With 10 years of cyber expertise, he is president of the firm and puts rigorous evidence and clear decisions at the centre of every case.
Founder & presidentHe carries the expertise and answers for the firm’s ethical framework.
The founder’s 10 years of experienceHands-on practice, from risk to incident handling.
Firm founded on 5 February 2024The legal entity that contracts and invoices the engagements.
Public referenceA firm listed on Cybermalveillance.gouv.fr.
04 · THE DOCTRINE IN PRACTICE
Four principles that guide every case
These principles put into practice the CODEX, our doctrine of digital risk, which treats cybersecurity as a governance discipline that serves decisions, facts and people.
Assess before acting
No irreversible action until the situation, the urgency and the severity have been framed.
Prove, always
Digital evidence must be preserved and documented: that is what protects you in any formal process.
Decide clearly
Findings that management can understand, and so can a lawyer or an insurer.
Keep things confidential
Sensitive cases handled with discretion, compartmentalisation and ethical rigour.
05 · WHY GALYCT
We were looking for a name. We found a way of acting.
Some predators impose their presence through sheer size. And then there is the Galictis: a small ground-dwelling mustelid, compact, agile, curious, remarkably attentive to its surroundings. It explores. It searches. It goes where others do not look. It stops, observes, detects, then continues on its way.
This way of moving through a territory is more like us than a spectacular animal placed on a logo. Because in cybersecurity, what really protects an organisation is not seeing more data: it is spotting what matters, understanding what it means, and acting in the right place.
The value does not lie in the quantity of information collected, but in the ability to understand what it means for the organisation.
Searching where others do not look
A major risk does not always arrive with a red alert. A backup that no longer works, an over-privileged account, a supplier whose criticality nobody had measured, a crisis procedure that has become obsolete, a dependency known to only one person. Taken separately, each one seems secondary; put together, they map out the real territory of risk.
Understanding the territory
Risk is not measured in the abstract. The same vulnerability can be almost harmless on a secondary workstation and critical on the system that lets you produce, invoice and serve. That is why Galyct does not start with technology but with the organisation: its activities, its assets, its people, its suppliers, its dependencies, its requirements, its continuity capabilities. Then it connects these elements.
Precision rather than agitation
A cybersecurity platform should not become one more machine for producing alerts. We do not want a leader to open Galyct and discover twenty-seven additional problems, but to know what matters, why it matters, and what needs to be done now. And when everything seems calm, the system keeps that knowledge of the territory up to date: no alert does not mean no vigilance.
Knowledge that does not stay in a single head
In many organisations, cybersecurity still rests on a few people who know where the weak spots are, why a given supplier is critical, why a given decision cannot wait. Unstructured, that knowledge becomes a risk in itself. That is also NARA’s role: it does not replace the expert, it uses what Galyct already knows about the organisation to analyse, explain and support decision-making. Expertise remains human, but it becomes available.
Seeing relationships, not just events
An incident never exists on its own. It concerns an asset; that asset supports an activity; that activity may depend on a supplier; that supplier may itself be a weak point. A decision leads to an action, an action must be trackable, and some decisions must be provable. That is the chain Galyct makes visible, from the signal to its business consequence.
And that azure eye?
The Galictis that represents Galyct is not a naturalistic reproduction: it carries a transformation. Its azure eye marks the boundary between the animal and the system, the digital layer we have added to it. It stands for augmented perception: no longer seeing an asset, a risk, a supplier or an incident separately, but understanding the links between them. The Galictis explores its environment; Galyct builds an understanding of it.
Galyct is not an acronym
And we are not going to invent one. Galyct comes from Galictis. The name was shortened, transformed, taken out of its zoological register to become the name of a system. That transformation is deliberate: it tells exactly what we wanted to build, a tool born of a logic of observing and exploring territory, designed to move through that of organisations, their data and their risks. A Galictis turned cybernetic.
GALYCTSee sooner. Understand what matters. Act in the right place.
06 · HOSTING & HONESTY
Our foundation: European, and with no overpromising.
We would rather say what we do, and what we will not do. That is the foundation of a relationship of trust.
Our foundation
Location, by design
- Designed, developed and hosted in France, with Scaleway/Online (an SAS governed by French law).
- Strict confidentiality: compartmentalisation and ethical rigour.
- A single point of contact, never a call centre.
Our honesty
What we do not promise
- A best-efforts obligation: we commit to the method, the preservation of evidence and the clarity of the file; the outcome (bank, insurance, courts) belongs to the third parties who decide.
- We will never ask for your passwords or your codes.
- No sales pitch: the first conversation is for assessing, not for selling.
07 · THE DOCTRINE
Cybersecurity is not a technology. It is a governance discipline.
Everything the firm does derives from the CODEX, our doctrine. Three expressions of one mission: advice and decision-making (Pro), investigation and establishing the facts (the firm), assistance and people (Perso).
Download the Executive edition freely (the essentials in twenty minutes) or read it online. The complete Founding edition is distributed on a controlled basis.
08 · FEES & SERVICES
The firm publishes its fees
Recurring engagements on a fixed monthly fee, crisis arrangements on an annual basis, audits and expert work per project. Everything else is on quotation, but always framed and costed before work begins.
Outsourced CISO · fixed monthly fee excl. VAT
Framing
€1,490 /month
Structure governance without bringing it in-house: a roadmap, a direction, a rhythm.
- Cyber roadmap
- Quarterly committee
- Dedicated contact
Most popular
Management
€2,790 /month
A part-time CISO: monthly risk management, tracked compliance, decisions backed by tools.
- Monthly risk management
- Tracked compliance (NIS 2 / ISO)
- Management reporting
Extended
€5,290 /month
A reinforced, multi-site arrangement: greater presence, compliance and crisis management.
- Reinforced presence
- Crisis management included
- Executive reporting
| Service | Package & scope | Fees excl. VAT |
|---|---|---|
| Outsourced DPO | Essentiel: register, advice, quarterly review | €290/month |
| Outsourced DPO | Management: requests, light DPIAs, awareness | €490/month |
| Outsourced DPO | Extended: declared DPO, full management, reinforced presence | €790/month |
| Crisis retainer | On-call SLA of 4 business hours, pre-built playbooks | €1,990/year |
| Crisis retainer | Mobilisation SLA 2 h · 24/7, annual exercise | €5,900/year |
| Compliance audit | NIS 2, DORA, ISO, mapping & compliance plan | from €4,900 |
| Risk analysis | EBIOS Risk Manager, scenarios & treatment plan | from €7,900 |
| Awareness & training | Sessions for executives & teams, crisis exercises | €950/day |
| Forensics & digital evidence | Investigation, expert work, usable report | on quotation |
| Managed crisis | Crisis unit run from start to finish by the firm | on quotation |
| ISO 27001 certification | Full support through to certification | on quotation |
Time-based engagements: day rate €950 (€1,250 for expert work). Emergency within 48 h: +30%. Fees exclude VAT; every engagement is framed and costed before it starts. Request a quote →
A case to entrust to the firm?
Assessment, digital evidence, crisis or a sensitive case: tell us about your situation. First conversation free, confidential and with no commitment.