ISO 27005 :2022
The international reference standard for cyber risk management, natively implemented and AI-automated in Galea.
The ISO 27005 risk management approach
From scope identification to risk treatmentThe international risk standard
ISO 27005 is the international standard for conducting cyber risk management. It structures the analysis into clear phases and produces a comprehensive view of the threats facing your organisation.
Galea fully implements ISO 27005:2022 and automates the most time-consuming parts: AI scenario generation, score suggestions, and security measure identification.
How Galea implements each step
Scoping and security baseline
Definition of scope, business values, supporting assets and existing security baseline.
- Import of existing IT inventory
- Automatic categorisation of business values
- Identification of associated supporting assets
- Assessment of initial security baseline
- Business values table
- Supporting assets map
- Security baseline assessment
- Documented study scope
Risk sources
Identification and characterisation of risk sources (RS) and their targeted objectives (TO).
- Pre-loaded RS catalogue by sector
- Attacker motivation, capability and activity
- RS/TO pairs assessed automatically
- Retained / not retained with justification
- List of assessed RS
- Retained RS/TO pairs
- Attacker profile
- Threat map
Strategic scenarios
Construction of strategic scenarios. AI generates realistic attack paths.
- AI generation of 3–5 scenarios per pair
- Path: Recognise → Enter → Find → Exploit
- Severity assessment G1–G4
- Likelihood V1–V4
- Documented strategic scenarios
- Strategic heat map
- Assessed feared events
- Identified business impacts
Operational scenarios
Breakdown into technical action sequences. MITRE ATT&CK mapping.
- Automatic MITRE ATT&CK mapping
- Adversary techniques contextualised
- Targeted supporting assets identified
- Attack path visualisation
- Detailed operational scenarios
- Attack path graph
- Mapped MITRE techniques
- Operational risk matrix
Risk treatment
Security measures prioritised according to the G·P·D·R model.
- AI recommendations ranked by G·P·D·R
- Governance, Protection, Defence, Resilience
- Residual risk estimation
- ROI-prioritised treatment plan
- Risk treatment plan
- Documented residual risk
- Full ISO 27005 report (PDF)
- Executive board summary
Concrete scenarios, ready to act on
In minutes, Galea generates realistic attack scenarios for each of your assets, scored and linked to known adversary techniques. Here is a preview — the full analysis awaits you in a demo.
Ransomware via targeted phishing on the finance ERP
Risk source: organised cybercriminal group → Target objective: financial extortion
The attacker gathers public information on employees, sends a booby-trapped email aimed at the accounting team, gains initial access, then pivots to the core of the financial IT estate before encrypting the data and demanding a ransom. Galea reconstructs the full chain, mapped to known adversary techniques.
Severity and likelihood
Severity scale
Negligible impact on missions
Notable impact, manageable
Strong impact on essential missions
Endangers the organisation
Likelihood scale
Unlikely, significant resources required
Realistic with moderate resources
Probable, standard resources sufficient
Very likely, scenario already observed
Start your ISO 27005 analysis
Galea guides you through each phase.
Ready to secure your organisation?
Join the companies that trust Galea to drive their cyber-résilience. 30-minute demo.
Already a customer? Go to the platform