GALEA Cyber, the sovereign GRC
platform driven by AI
The expertise of a cyber consultancy in a single tool. AI-automated ISO 27005 risk management approach, 8 compliance frameworks, a sovereign platform hosted in France.
From your IT context, Galea produces your analyses.
Galea absorbs your environment and challenges, then produces actionable risk scenarios and compliance deliverables — in a fraction of the time of a consulting firm.
- Vulnerability scanners Qualys · Rapid7
- Azure · Google Workspace
- CMDB
- Events & logs
- Document corpus
- Audit reports
- Architecture documents
- Business context
65 prioritised actions, tracked over time
Your risk matrix, kept current on its own
Severity × likelihood: your scenarios placed automatically on the 4×4 ISO 27005 matrix. Filter in one click, follow how risk drifts over time.
Flaws proven, not merely listed
Galea maps your entry points, confirms each flaw through real exploitation and reconstructs the full compromise path — from injection to session theft, with the business impact attached.
Steer your compliance on every front
Audit several regulatory and normative frameworks at once. Galea computes your coverage rate in real time.
ISO 27001:2022
Information security management system. The 93 Annex A controls come pre-loaded, with scoring by domain and tracking of the Statement of Applicability.
NIS2
European directive on the security of network and information systems. Classification by category (essential / important), a 24-hour early warning and 72-hour notification obligation, and mandatory cybersecurity measures.
DORA
Digital Operational Resilience Act. European regulation on the digital operational resilience of the financial sector. Penetration testing, third-party ICT risk management and incident reporting.
HDS & GDPR
French health data hosting certification and the General Data Protection Regulation. Records of processing, impact assessments, tracking of data subject rights and mandatory HDS certification.
Eight years of field work, not promises
Galea is published by Phishia, a cybersecurity firm that has been operating for eight years.
The Phishia teams have delivered more than 400 cybersecurity and compliance projects.
163 organisations are supported today by Phishia and Galea.
Your data stays in France.
So does our AI.
In an uncertain geopolitical climate, where your risk and compliance data sits is a strategic question. Galea guarantees that nothing leaves European soil — neither your data nor the AI models that analyse it.
Galea's data is hosted in France, at OVHcloud in Roubaix, whose services are certified to ISO 27001, HDS and ISO/IEC 27701 — the standard for managing personal data protection. No Galea data is transferred to the United States.
TARS, Galea's AI agent, runs on models from Mistral AI, a French company, hosted in France. Galea depends on neither OpenAI, Google nor Amazon to analyse your data.
Galea was designed in Europe for the European framework, not adapted from an American product. GDPR compliance is native to it, not bolted on afterwards.
AI in the service of ISO 27005
Galea runs on a sovereign analysis engine, powered by a European AI specialised in cybersecurity, which automates the five ANSSI workshops, generates contextual risk scenarios and preserves the methodological rigour of EBIOS Risk Manager.
The five ANSSI workshops, automated
& baseline
sources
scenarios
scenarios
treatment
Three to five scenarios per asset, with risk sources, attack paths and MITRE ATT&CK techniques
The AI suggests an initial score on the 4×4 matrix; the expert adjusts it with justification. Full traceability
Action plans matched to your sector and maturity, classified using the G·P·D·R model
Galea computes the expected annual financial impact of each risk, combining likelihood of occurrence with potential losses along the modelled attack paths.
Expert support beyond the tool
Galea is more than software. With our Phishia support service, a team of cybersecurity engineers guides you through your GRC programme: initial audit, configuration, training and quarterly reviews.
A Phishia consultant runs the five steps with you, drawing on Galea's AI
Training sessions: using the platform, cyber good practice, phishing simulation
A review of your posture every three months, with reports prepared for your board
Initial audit, five guided ISO 27005 steps, team training, four quarterly reviews, certification preparation, priority support.
Work out your savings with Galea
Estimate what your cybersecurity costs today, and see how much you could save.
Galea prices excl. VAT, billed annually (two months free). Optional modules à la carte, from €100 to €1,000 per month.
Ready to secure your organisation?
Join the companies that trust Galea to drive their cyber-résilience. 30-minute demo.
Already a customer? Go to the platform