EU cybersecurity · compliance · AI governance
Security that holds up to attackers and to auditors.
NG Cybersecurity helps European companies find and fix real vulnerabilities, comply with NIS2, ISO 27001 and the EU AI Act, and lead security with confidence — with a senior, independent team based in the EU.
- EU company · Estonia
- Senior, independent team
- ECSO member network
- Certified ethical hackers
- Remote across the EU
What we do
Six services. One goal: a business that is secure and provably compliant.
Offensive security and EU regulation are usually sold by different firms. We bring them together, so every finding becomes an action and every control is tested for real.
01 — OFFENSIVE
Penetration Testing
Web, mobile, API, network and AI/LLM testing by certified ethical hackers, with clear, prioritised remediation.
02 — STANDARD
ISO 27001 Consulting
From gap analysis to certification: a practical ISMS that fits how your company really works.
03 — REGULATION
NIS2 Compliance
Find out if NIS2 applies to you, close the gaps in Article 21 measures and get ready for supervision.
04 — AI GOVERNANCE
AI Act Compliance
Inventory and classify your AI systems, set up AI governance and meet your obligations under the EU AI Act.
05 — LEADERSHIP
CISO as a Service
A senior security leader on demand: strategy, risk, compliance and reporting to the board — without a full-time hire.
06 — AI STANDARD
ISO 42001 Consulting
Certify how your company governs AI with ISO/IEC 42001 — the international standard for AI management systems.
START HERE
Not sure where to start?
Tell us about your situation. In a 30-minute call we will help you identify your priorities — no commitment.
Is your company affected?
EU regulation now makes cybersecurity a board-level duty.
NIS2 and the AI Act apply across the EU, with significant fines and personal accountability for management. Most mid-sized companies — and the suppliers that serve them — are now in scope.
DIRECTIVE (EU) 2022/2555
NIS2 Directive
Medium and large organisations in 18 critical sectors must implement risk-management measures and report significant incidents within 24 hours.
REGULATION (EU) 2024/1689
EU AI Act
Every company that develops or uses AI has obligations. Transparency rules apply from August 2026; high-risk requirements follow in December 2027.
ISO/IEC 27001:2022
ISO 27001
The international standard your clients and auditors recognise — and the most efficient backbone for meeting NIS2.
NIS2 · ART. 21(2)(d)
Supply chain pressure
Companies in scope must assess the security of their suppliers. Being able to prove it is now a commercial advantage.
Why NG Cybersecurity
A partner that does the work, not just the report.
01
Offence + compliance
Our ethical hackers test the controls our consultants design. You get compliance that works under real attack conditions.
02
EU-native
We work daily with EU regulation and its national transpositions. Your data and our team stay in the European Union.
03
Senior & independent
No products to sell. You talk directly to the specialists doing the work, at a fraction of Big Four rates.
04
From diagnosis to delivery
We prioritise, implement and stay with you until the measures are in place — and stay in place.
How we work
Clear steps, from first call to lasting security.
Understand
We learn about your organisation, your clients, your regulatory exposure and what worries you most.
Assess
Pentesting, gap analysis or risk assessment to establish where you really stand.
Prioritise
A roadmap ranked by risk and effort, so budget goes where it matters most.
Deliver & support
We implement with your team and remain available as your security partner.
Selected work
Real projects, real outcomes.
CASE · PENETRATION TESTING
Securing a SaaS and e-signature platform
CASE · AI GOVERNANCE
Safe AI adoption for a food distributor
FAQ
Frequently asked questions
Does NIS2 apply to my company?
It applies to medium-sized and large organisations (generally 50+ employees or more than €10 million in annual turnover) in the sectors listed in the directive — energy, transport, health, digital infrastructure, ICT services, manufacturing, food and others. Some entities are covered regardless of size. Suppliers are affected indirectly, because companies in scope must manage supply-chain security. Check NIS2 scope.
How often should we run a penetration test?
At least once a year and after any significant change, such as a new application, a cloud migration or a new integration. Many standards and clients expect annual testing as evidence of due diligence.
How long does ISO 27001 certification take?
For a mid-sized company it usually takes 6–12 months, depending on scope, existing controls and the time your team can dedicate.
What does the EU AI Act require from companies that only use AI?
Deployers have obligations too: AI literacy for staff, transparency when people interact with AI, and stricter duties for high-risk uses such as recruitment or credit scoring. The first step is an inventory and classification of your AI use cases.
Do you work outside Spain and Estonia?
Yes. We work remotely with companies across the European Union and travel on-site when an engagement requires it.
Next step
Let’s find out where you really stand.
Tell us about your company and what you need. A specialist will reply within one business day.