What we do
Senior, hands-on work, not a slide deck.
Cyber Solutions helps organisations improve cybersecurity, secure delivery, ICT risk evidence and controlled adoption of AI. The work is assessment, architecture, implementation and operational enablement: practical controls, automated repetitive work, and evidence teams can sustain after we leave.
Founder-led by Iulian Datcu, working with regulated organisations, technology providers and SMEs in Luxembourg first, and across the EU. The work is performed by the founder: a limit as much as a promise, and a real concentration risk rather than a talking point, which is why the contact page says how we manage it before anyone asks.
Four areas, one operating model
Every area has the same shape: a point where the work stops for a person.
Cybersecurity
Threat detection, vulnerability management and testing, security operations, infrastructure and platform security.
Human approval point: before a change reaches production.
ICT risk and resilience
Operational resilience, continuity, third-party and control evidence, in the context of NIS2 and DORA.
Human approval point: before a risk is accepted.
DevSecOps and secure delivery
Secure software delivery, CI/CD, source and infrastructure security, cloud and platform engineering.
Human approval point: before a pipeline gains new authority.
AI governance
AI risk management, EU AI Act considerations, guardrails, human oversight and traceability, without losing audit evidence.
Human approval point: before an agent acts without review.
Routine decisions run. Consequential ones wait.
The step that carries consequence stops with a named person, and leaves a trace. That is the difference between automation that saves time and automation you have to explain afterwards.
In practice
NIS2, DORA and the EU AI Act, as working evidence
In Luxembourg, the NIS2 law of 5 May 2026 has been in force since 10 May 2026, and DORA has applied since 17 January 2025. The question a supervisor asks is no longer whether you have a policy. It is whether you can show the measure working: a control you cannot evidence is, to a supervisor, a control you do not have.
For financial entities, DORA is no longer a project but a reporting cycle you are inside of, and the article 28 register of information has to be a by-product of how you manage contracts, not a separate artefact assembled once a year. For AI, the inventory and oversight work does not depend on the deferred dates: we map where AI already touches your processes and make the oversight leave a record instead of living in someone's memory.
We work inside your environment and your change process, not beside it. Where a control can be automated and evidenced automatically, it is: the check moves into the pipeline, the pull request and the infrastructure definition, so that the fast path is also the safe one. Which decisions may run without a person is decided per engagement, in writing, and it is the first artefact we produce.
We do not give legal advice, and we do not represent you before a supervisor. Wherever the engagement allows it, evidence stays in your own systems and repositories, and the exit is written into the scope at the beginning: the work is finished when your team can run and evidence it without us.
Contact
Start with a conversation.
The quickest route to us is email or phone. Technical, operational, and regulatory perspectives. Never legal advice.
Prefer the long version? Watch The night nothing happened: one night over Luxembourg, told as a film. Sixteen chapters, about two minutes.
Regulation notes
Or start from what is on your desk.
The practitioner pages: dated, sourced, and written for engineers and risk officers rather than for search engines.