The Luxembourg Cybersecurity Ecosystem

A Foreword from Mr Franz Fayot, Minister of the Economy

A trusted cybersecurity ecosystem for a flourishing digital economy

We are on the eve of creating ultra-connected human societies, based increasingly on mobile technologies, the growing use of cloud computing solutions and the continued development of the Internet of Things. While welcoming new opportunities, we also expose ourselves to multiple new risks, with an augmented dependency on the availability and reliability of data.

This phenomenon highlights the increasingly transversal responsibility of policy and decision-makers and the growing importance of businesses and citizens called to take part in shaping tomorrows society. The digital transition requests each of us to grow into a more accountable and informed user of technology.

Europe calls for the creation of sovereign products and services that guarantee these values. Luxembourg, with its IT and cybersecurity ecosystem, is answering this call in multiple ways.

New challenges, requesting innovative cybersecurity services and products lie ahead of us, while we continue to consolidate security in existing networks and systems. Cooperation, national and international, will play an ever-important role.

In order to achieve an inclusive, flourishing and trusted digital economy, the Ministry of the Economy especially promotes best practices among businesses and the implementation of informed governance via a collaborative risk management approach.

I am pleased to endorse the mapping 2020 of the national cybersecurity ecosystem. It is another proof of the success of continuous cooperation taking place at the level of our partners in education and research, the public & private partnerships, the authorities and regulators, and of our local companies & start-ups.

It is their expertise and their commitment, embedded in the national cybersecurity strategy coordinated by the Interministerial coordination committee for cyber prevention and cybersecurity, that creates the fabric of the trusted cybersecurity ecosystem we proud ourselves with in Luxembourg.

Mr Franz Fayot

Minister of the Economy

The emergence of the Luxembourg cybersecurity ecosystem started about 20 years ago: The Grand-Duchy of Luxembourg, under the lead of the Ministry of the Economy and following the OECD guidelines “Towards a culture of security,” has considerably invested in cybersecurity and thus created a competitive, dynamic, and growing ecosystem. Cybersecurity is a cross-industry sector and throughout the years, it has become a pillar of the national development strategy and the economy.

Cybersecurity is a key component in the country’s efforts to promote all aspects of the digital transformation and develop its data-driven economy. Digitisation revolutionises the way to conduct business; it offers enhanced capabilities and allows delivering solutions with unmatched speed and flexibility, while often reducing overall costs and environmental impacts.

In 2020, we can proudly say that there are 310 active members of the Luxembourg Cybersecurity Ecosystem. Below, you can see the recent Luxembourg Cybersecurity Mapping which presents a complete overview of all relevant cybersecurity players in the Grand-Duchy at present.

The interactive dashboard of the Market Mapping

The three main characteristics of the Luxembourg Cybersecurity Ecosystem are:

It is a steadily growing ecosystem: it has been growing for 20 years and has accelerated over the last 5 years (50% of companies have less than 5 years); it is also attractive for start-ups (65% of the new players since 2019 are start-ups).
It is diversified: within the ecosystem, one-quarter of the 310 companies have cybersecurity as core business. The rest of the companies offer other services/solutions beyond cybersecurity. This means that cybersecurity has been integrated as a focus area (e.g. insurance providing dedicated solutions for cybersecurity) among non-IT traditional businesses. That is the real strength of the Luxembourg Ecosystem.
It offers a complete solutions portfolio: the ecosystem covers almost an exhaustive portfolio of the cyber risk management value chain (58 out of the 60 ECSO categories are offered by providers in Luxembourg), with a focus on identification and protection solutions.

As cybersecurity spending and investments will grow, the focus of businesses is to embed cybersecurity within their activities to make them more resilient and future-proof. This will make our ecosystem to grow further, and we as SECURITYMADEIN.LU will pursue our efforts, not only to raise awareness but also to support businesses to benefit from the local expertise. The market mapping will not only promote the national ecosystem among Luxembourg businesses but also at the European level (via the European project on Cyber Valleys).

It is a key element to build a trusted and secure environment for a sustainable and competitive economy, as well as to address the technological sovereignty we are aiming for. The focus is also on regionalisation and the importance to have technical solutions coming from within the EU.

As a result, and thanks to its strong ecosystem, Luxembourg ranks 2nd worldwide and 1st among the EU Member States in Cisco’s 2019 Digital Readiness Index. Besides, the Grand Duchy ranks 11th in the Global Cybersecurity Index.

Born to Be Alive

By definition, an ecosystem is a living system. This one is particularly dynamic and open to newcomers.

Are you a Luxembourg-based company with cybersecurity services?
Then, you should join the CYBERSECURITY LUXEMBOURG ecosystem and benefit from business and visibility opportunities in the country, and abroad!

You can register HERE

Past & Present of the Ecosystem

SECURITYMADEIN.LU has launched the concept of the cybersecurity ecosystem 3 years ago to feature the local cybersecurity community providing users central and easy access to all relevant actors and initiatives of the Luxembourg cybersecurity ecosystem.

Since then, it has grown considerably, to find out your way in this prolific forest, you’ll need a map. This is what Luxinnovation and SECURITYMADEIN.LU has designed, in order to make the whole sector more visible and to better know who’s who and who is doing what. The first mapping has been officially presented on Monday, October 14, 2019, at the Cybersecurity Competence Center (C3), in the presence of the Deputy Prime Minister and Minister of the Economy, Étienne Schneider. Download the Cybersecurity Mapping 2019 Edition flyer

Depicting the different actors of the public and private sector, as well as their specialisation, this mapping was developed jointly by the Market Intelligence Team of Luxinnovation, the national agency for the promotion of innovation, and by SECURITYMADEIN.LU mandated since 2010 by the Ministry of the Economy to promote and strengthen information security in Luxembourg.

Governance & National Strategy

On 13 December 2017, the Government decided to bring together key players to set up an inter-ministerial committee in charge of cybersecurity coordination at the national level. The committee consists of members of the main state entities involved in national cybersecurity, and the committee is chaired by the High Commissioner for National Protection.

The third national cybersecurity strategy has been announced by the Prime Minister, Minister of State, Mr Xavier Bettel, in January 2018. This document illustrates the Government’s intentions in response to the changes and challenges that characterise a digital environment in constant change.

The strategy has been developed by a task force under the leadership of the High Commissioner for National Protection (HCPN: Haut-Commissariat à la Protection Nationale). The task force is composed of representatives of the State’s Information Technology Centre, the Governmental Computer Emergency Response Centre (GOVCERT), the National Agency for the Security of Information Systems (ANSSI), the Media and Communication Unit, the Ministry of the Economy, the Ministry of Foreign and European Affairs, the Directorate of Defence, the State Intelligence Services and the Grand Ducal Police Force.

In line with the “Digital Lëtzebuerg” initiative, the strategy seeks to strengthen public confidence in the digital environment, in order to allow citizens to enjoy it to the fullest. It is also aimed at enhancing the security of information systems, improving the ability to identify cyber-attacks, protecting critical digital infrastructure and raising stakeholders’ awareness of resilience.

The third national cybersecurity strategy covers the 2018-2020 period and adheres to the following three guidelines:

Strengthen and build public trust and confidence in the digital environment
Protect the digital infrastructure to ensure the availability of essential information technology-related services
Promote the economy by creating an environment conducive to the development of companies

While ANSSI and GOVCERT serve the public sector, SECURITYMADEIN.LU considers the support and service of the private sector to be its most important task. SECURITYMADEIN.LU is the cybersecurity agency for the Luxembourg economy and municipalities: its three departments (C3, CASES, and CIRCL) help achieve its goals.

It also organises the collection, information gathering and information management of crucial services provided by the ecosystem, maps their availability within the ecosystem and enhances potential collaboration among them. It also promotes, in collaboration with Luxinnovation, the ecosystem within the Greater Region and in Europe.

The cybersecurity ecosystem has been created according to the above-mentioned national strategy with a specific legal framework with the following entities:

The Ecosystem Mapping Methodology

The Cybersecurity Luxembourg Ecosystem Mapping gives all the key insights about the local market and its key components such as the number of companies active in the field, and the public entities in charge of the various regulations which apply to the sector (GDPR, NIS, etc.).

As the first step, a database of the Luxembourg ecosystem members was built by the Market Intelligence Team of Luxinnovation (LXI-Market Intelligence). The used data sources can be seen as follows:

Then, the ecosystem members have been reviewed and classified by SECURITYMADEIN.LU using the ECSO (European Cyber Security Organisation) cybersecurity market radar:

As part of this step, SECURITYMADEIN.LU identified those members of the ecosystem whose core business was (and still is) related to cybersecurity. In addition, the solutions provided by the ecosystem members have also been classified.

As the final step, the ecosystem has been analysed by LXI-Market Intelligence and SECURITYMADEIN.LU

The platform provides a clear classification of standardised services types, which will be mapped the services provided by companies. This will allow a complete listing of available expertise and knowledge and will also enable the identification of gaps and help with the promotion both nationally and internationally.

The mapping helps investors, service providers, IT integrators, financial investors and the general public to quickly grasp a picture of the available players and their products and services in the field of cybersecurity.

This yearly work is driven by two public entities: Luxinnovation, the agency responsible for promoting innovation in the national economy, and SECURITYMADEIN.LU the platform in charge of the promotion of the cybersecurity with the private sector and municipalities.

The Cybersecurity Luxembourg Ecosystem Mapping is used to create an online platform to promote cybersecurity and national companies active in the field.

A Strong Market Sector

When the mapping of cybersecurity firms took place, the following two listing criteria were considered:

The company should have a legal entity in Luxembourg.
It should provide at least one cybersecurity service or solution.

Eighty companies (26% of the ecosystem) have been found with core business (i.e. their main revenue comes from cybersecurity-related activities) was related to cybersecurity whereas seventy-five companies (24% of the ecosystem) have been identified as start-ups.

The remaining 230 entities include insurance companies, lawyers, IT consultants, etc. providing at least one cybersecurity solution/service.

The figures of the ecosystem are remarkable:

310 companies are listed in the ecosystem
24 % are start-ups
26 % are focused on cybersecurity as a core business
50 % of the enterprises are less than 5 years old
1000 jobs have been created by the sector

With exponential growth, almost half of the current companies having cybersecurity as core business was created over the past 5 years.

A Broad Scope of Services

As pointed out above, 310 Luxembourg companies, offering at least one cybersecurity service or solution, were identified in the mapping. This number covers both highly specialised service providers and companies such as IT consultants, lawyers, and insurance firms whose service offering includes a cybersecurity aspect.

Companies offer a diversified solutions portfolio, including solutions for each stage of the cyber-risk management value chain. The main focus is on risk identification and system protection. The 7 types of most frequently offered services (out of 57 types of solutions in total), which represent 61% of the national market, are:

Governance, risk, and compliance;
Identity and access management;
Data security;
Asset management;
Penetration testing;
Awareness and training;
Backup and storage;

On average, companies provide 5 cybersecurity solutions. The importance of the governance and risk & compliance solutions can be explained by the high number of companies targeting the finance and banking sectors. It is also important to mention that GDPR boosted data security services within the ecosystem.

The top solutions on the national market are as follows:

Luxembourg offers a diversified solutions portfolio, yet focused mainly on the risk identification and systems protection markets:

The Role of Small Businesses

Small enterprises are at the heart of the core cybersecurity ecosystem, they show great innovation and growth potential. Start-ups are indispensable players of the ecosystem: they represent 24% share of the number of companies (75 companies altogether) and 36% of them have cybersecurity as a core business.

The criteria used to define a start-up were as follows:

< 5 years old
< 100 employees worldwide
Have an innovative product, service or business model

Among the 80 companies having cybersecurity as core business, 79% have fewer than 10 employees. On average, a company having cybersecurity as core business employs 12 people. Size of the companies having cybersecurity as the core business is as follows:

The growth of the ecosystem has been strongly supported by start-ups. There are 27 start-ups having cybersecurity as a core business in the ecosystem. In total, the core business ecosystem represents almost 1000 employees (957 employees is the exact number estimated by LXI, based on most recently available figures from Editusdata and the Luxembourg Business Register).

The Specialisation of Start-ups

In total, 43 different types of solutions are delivered by start-ups
The top 3 solutions cover 54% of the solutions provided by the start-ups
Start-ups offer in average 3 to 4 types of services or solutions
In total, 18% of the cybersecurity solutions of the entire cybersecurity ecosystem (i.e. 310 companies) are delivered by start-ups
55% of start-ups are or have been hosted in a Luxembourg incubator

The top 3 solutions provided by start-ups are as follows:

Discover the key insights of the Luxembourg cybersecurity ecosystem by downloading the brochure:

A Dedicated Brand and Platform for the Future

Under the high patronage of the Ministry of the Economy, the CYBERSECURITY LUXEMBOURG initiative was launched under Minister Étienne Schneider to foster and enhance public-private cooperation in cybersecurity aligned with and integrated into the national cybersecurity strategy.

CYBERSECURITY LUXEMBOURG is led and driven by key national cybersecurity stakeholders: HCPN and SECURITYMADEIN.LU, and actively supported, by the national agency for innovation and the promotion of Luxembourg’s expertise internationally: Luxinnovation.

This national brand was created to foster, promote and give common visibility to the cybersecurity ecosystem. It can be used by all members and stakeholders of the cybersecurity ecosystem to promote their events or campaigns, in compliance with the graphic guidelines.

We hope this new brand will be endorsed by all stakeholders of the market to promote the Luxembourg expertise in cybersecurity at national as well as international level.

A dedicated platform (http://www.cybersecurity-luxembourg.com/) depicting all the players and relevant actors will follow and be available online before the end of the year. This web portal will become the central and neutral place for the ecosystem where relevant news, services and information about cybersecurity in Luxembourg can be found.

Stay tuned for news and don’t hesitate to get in touch with any request.

Why Should You Join the Ecosystem?

Cybersecurity is key to successfully steering the digital transformation of our economy – and your business. The last 20 years, the Grand-Duchy has invested substantially in and has created a competitive ecosystem for cybersecurity.

SECURITYMADEIN.LU, in close collaboration with Luxinnovation, has developed a coordination framework to promote the Luxembourg cybersecurity ecosystem, making sure that, throughout the year, you will obtain the visibility you need and thus be able to optimise business opportunities.

Our online platform will provide information about public and private organisations, their services, activities, news and events. We would be delighted for you to be part of this initiative!

Being part of the ecosystem means you are well informed and your voice can be heard throughout the ecosystem. Do not forget: business is all about making connections, proper cybersecurity is a guarantee for a continuous and sustainable IT business, without which business itself is now inconceivable.

You can register HERE