Cybersecurity & Identity Access Management
Specialised in Identity & Access Management, we secure your systems against current threats with a proactive approach. IAM is our core business, not a line added to a catalogue.
What we do
Identity & Access Management
Governance of identities and entitlements: who has access to what, since when, and on whose decision. Access reviews, account lifecycle from joiner to leaver, privileged accounts, and automation of access requests where volume justifies it.
Security and compliance audits
An assessment against a framework, whether ISO 27001, NIS2 as transposed in Luxembourg, or DORA for the financial sector. You get findings ranked by risk, separating what is fixed in weeks from what needs a budget.
Protection of critical infrastructure
Segmentation, hardening, remote and third-party access management, monitoring of sensitive access. Priority goes to the paths an attacker actually takes, not to the length of a control list.
How we work
-
1
Understand what exists
No useful recommendation comes out of a generic template. We start with directories, critical applications and entitlement processes as they are practised, not as they are written.
-
2
Rank by risk
A report listing a hundred gaps without ranking them never gets acted on. We separate immediate exposure from debt, and we size the effort.
-
3
Implement and measure
We stay for implementation, with indicators that say whether exposure is actually falling: orphan accounts, entitlements never used, time to revoke when someone leaves.
What you get
- Map of identities, roles and entitlements
- Audit report ranked by risk
- Costed and sequenced remediation plan
- Segregation of duties matrix
- Exposure tracking indicators
Frequently asked questions
Are you tied to an IAM vendor?
No. We work with the tool you have or the one you choose. Our value is in entitlement governance, which stays the weak point whatever product is installed.
What does NIS2 compliance require?
It depends on whether you qualify as an essential or important entity, determined by sector and size. Registration with the ILR is the starting point. We help establish that qualification before discussing measures.
Do you run penetration tests?
That is not our trade and we do not claim it. We frame the need, work with specialists, and take on the remediation that follows, which is usually the neglected part.
Let's talk about your project
Tell us about your situation and we will come back with a first reading and the questions that matter.
Contact us