All your GRC, driven from a single tool
ISO 27005 risk analysis, multi-framework compliance and action plans — from risk to decision. Sovereign, hosted in Europe.
Nine disciplines, one platform
9 modules · 1 platformRisk analysis
ISO 27005, steps 1 to 5
The five ISO 27005 steps run with AI: scoping and security baseline, risk sources, strategic and operational scenarios, then risk treatment. TARS proposes three to five scenarios per asset; your expert validates and adjusts the score.
- ISO 27005
- EBIOS RM v1.5
- 4×4 matrix
- MITRE ATT&CK
- Dual AI / expert scoring
Asset mapping
assets, flows, dependencies
An inventory of your assets — applications, servers, data, suppliers — with their classification and dependencies. Flows and interconnections are shown in 2D and 3D, and feed the risk analysis directly.
- DICP classification
- CMDB
- Azure · Google Workspace
- 2D / 3D view
AI audit & pentest
intrusion testing
Automated intrusion testing: discovery of entry points, confirmation of flaws through controlled exploitation, and reconstruction of the full compromise path with its business impact.
- Black / grey / white box
- OWASP Top 10
- XSS · SQLi · JWT
- Compromise path
Awareness
phishing & training
Simulated phishing campaigns and e-learning modules to measure, then raise, your people's vigilance, with results tracked team by team.
- Phishia
- Simulated phishing
- E-learning
- Scoring by team
IAM
identities and access
Identity and access governance: entitlement reviews, privileged accounts, joiners and leavers. Gaps found are pushed into your action plan to be fixed and followed up.
- Entitlement review
- Privileged accounts
- Least privilege
- Azure · Google Workspace
Business continuity
BCP / DRP
Business continuity and disaster recovery planning: impact analysis, recovery objectives, crisis scenarios and exercises. Your plan stays aligned with your risk analysis.
- BIA
- RTO / RPO
- BCP / DRP
- Crisis exercises
Compliance
NIS2, ISO 27001, DORA
Multi-framework auditing with controls pre-filled by TARS from your documentation. Galea tracks the gap to target and assembles the evidence file for your auditors.
- ISO 27001
- NIS2
- DORA
- GDPR
- HDS
CTI
threat intelligence
Intelligence on the threats that concern you: dark web monitoring, credential leaks and your organisation's digital exposure, with alerts as soon as a signal appears.
- Dark web
- Credential leaks
- OSINT
- Real-time alerts
Steering & reporting
metrics and reports
Dashboards and metrics to steer your programme: action plan progress, residual risk, compliance. Board-ready reports in one click.
- Board reporting
- PPTX export
- PDF · XLSX
- Residual risk
Select a module to see what it does.
All your cyber in a single platform
The nine modules work on one shared data foundation. To feed it, GALEA Cyber plugs into your IT estate three ways: sign-in through SSO, application feeds through an authenticated API, and reuse of the exports you already produce.
OVHcloud France · nothing to install · updates and security handled · live within days.
SMBs, mid-market, public bodiesYour datacentre or private cloud · isolated data · works in air-gapped environments · guided deployment.
Critical operators, highly regulated sectorsSign-in — SSO
What GALEA retrievesYour users enter GALEA with their directory accounts and their roles, with no extra password to manage.
Application feeds — authenticated API
What GALEA retrievesMicrosoft Graph returns your users, entitlements and tenant configuration; Qualys and Rapid7 return vulnerabilities, attached to the relevant asset and fed into the risk analysis and the action plan.
File reuse
What GALEA retrievesYour existing exports, taken as they are: group policies in XML and the PingCastle report feed the asset map and the security baseline.
Every connection is set up with you, with no agent to deploy. Another tool to plug in? The connector is built on request, and file imports bridge the gap meanwhile.
What you concretely get
Three examples of deliverables produced directly by Galea — an exact reflection of what your teams handle day to day.
Interactive 4×4 risk matrix
Overview of your scored risks, clickable and filterable by entity or framework.
Centralised risk register
All your risks in one place, with owner, treatment status and history.
Exported ISO 27005 report
A PDF ready to present to your executive committee, defensible to auditors and insurers.
Your security, put to the test
Two modules to test under real conditions: your people against phishing, your applications against an attacker.
Phishing campaigns
Awareness module- Ready-to-run simulation campaigns from a template library
- Immediate awareness: the employee who falls for it is trained on the spot
Automated pentest
Audit / AI pentest module · Online shop · demonstration environmentjuiceshop.local:3000
Whole site · 82 entry points
Exploit real impact
Black box · no prior information
anon → user → admin
Reflected injection in the site search.
The attacker's code runs with the victim's rights.
Act in their name, read their data, change their password.
- IDOR
/rest/basket - Out-of-band SSRF
/profile/image/url - Forgeable JWT
/rest/basket/106 - Business logic · pricing
/api/Users - Authentication bypass
/rest/user/login
+ 10 more critical findings
Expert support
beyond the tool
Galea is more than a platform. Our Phishia team supports your people — initial audit, training, operational follow-up — to turn the rollout into a measurable success.
ISO 27005
ISO 27005 is the international standard for information security risk management: it structures the analysis into 5 workshops.
Galea implements it in full and automates the most time-consuming parts — AI scenario generation, suggested scores, identification of security measures.
How Galea implements each step
ISO 27005 structures risk analysis into 5 successive workshops. Galea automates each of them and generates the expected deliverables.
Scoping and security baseline
- Import of existing IT inventory
- Automatic categorisation of business values
- Identification of associated supporting assets
- Assessment of initial security baseline
- Business values table
- Supporting assets map
- Security baseline assessment
- Documented study scope
Risk sources
- Pre-loaded RS catalogue by sector
- Attacker motivation, capability and activity
- RS/TO pairs assessed automatically
- Retained / not retained with justification
- List of assessed RS
- Retained RS/TO pairs
- Attacker profile
- Threat map
Strategic scenarios
- AI generation of 3–5 scenarios per pair
- Path: Recognise → Enter → Find → Exploit
- Severity assessment G1–G4
- Likelihood V1–V4
- Documented strategic scenarios
- Strategic heat map
- Assessed feared events
- Identified business impacts
Operational scenarios
- Automatic mapping to known adversary techniques
- Targeted supporting assets identified
- Graphical modelling of attack paths
- Full detail shown in a demo
- Detailed operational scenarios
- Attack path graph
- Mapping to attack frameworks
- Operational risk matrix
Risk treatment
- AI recommendations ranked by G·P·D·R
- Governance, Protection, Defence, Resilience
- Residual risk estimation
- ROI-prioritised treatment plan
- Risk treatment plan
- Documented residual risk
- Full ISO 27005 report (PDF)
- Executive board summary
Severity and likelihood
Severity scale
Negligible impact on missions
Notable impact, manageable
Strong impact on essential missions
Endangers the organisation
Likelihood scale
Unlikely, significant resources required
Realistic with moderate resources
Probable, standard resources sufficient
Very likely, scenario already observed
Ready to secure your organisation?
Join the companies that trust Galea to drive their cyber-résilience. 30-minute demo.
Already a customer? Go to the platform