Fit 4 Cybersecurity: your co-financed cyber diagnosis

In a digitalised economy, cyber attacks take many forms: phishing, ransomware, malware, denial of service or social engineering. Their consequences can be serious, financially, operationally and reputationally, to the point of jeopardising the very survival of the company.

Data unavailability disrupts operations, non-compliance with regulations exposes you to fines and some attacks can directly lead to legal proceedings against the company manager, who may be held personally liable in the event of proven negligence.

How do you know if you are well prepared against cyber attacks? And what actions should you take to be as well protected as possible? This is exactly the objective of the new Fit 4 Cybersecurity support programme launched by Luxinnovation, in collaboration with the Luxembourg House of Cybersecurity (LHC). The LHC plays a central role in addressing this security challenge and acts as a pillar of cyber resilience in Luxembourg. Its work focuses on developing innovation, skills, collaboration and capacity building in the fight against cyber risks.

The "Fit 4" programmes: an expert diagnosis for each transformation challenge

For a company, the first difficulty is often knowing where to start: what are its real vulnerabilities, and which actions should be taken as a priority? These are the questions answered by the Fit 4 Cybersecurity programme, the latest addition to the "Fit 4" family of programmes managed by Luxinnovation. These support and co-financing schemes, backed by the Ministry of the Economy, help to strengthen the productivity, competitiveness and resilience of companies. The range also covers digitalisation (Fit 4 Digital), sustainability (Fit 4 Sustainability), operational performance (Fit 4 Performance) and AI (Fit 4 AI).

For Fit 4 Cybersecurity, the principle is the same as for all the others: a private consultant approved by Luxinnovation carries out an in-depth diagnosis, then submits a detailed and costed action plan with concrete recommendations. "These programmes provide a structured assessment, conducted by experts, allowing a company to know precisely where it stands, which actions to prioritise and how to implement them," says Mario Grotz, CEO of Luxinnovation. Between 2024 and 2025, more than 120 companies have benefited from these programmes.

The programme is open to Luxembourg companies of all sizes, subject to eligibility conditions, including a valid business permit and an economic activity as their main occupation. It offers co-financing of up to 70% for small businesses, with aid amounts capped at EUR 100,000 per project. In addition, administrative procedures are now simplified and largely handled by Luxinnovation.

Fit 4 Cybersecurity: identifying your flaws and knowing how to fix them

The Fit 4 Cybersecurity programme, which draws on the expertise of the LHC, allows for an in-depth assessment of all relevant dimensions of cybersecurity: code, architecture, physical security, organisation and more. It helps to identify gaps and strengthen cybersecurity to protect the business, its reputation and customer trust.

The mission of the approved consultant has two components:

1. An "In-Depth" Cybercheck diagnosis, which identifies the flaws and priorities on which to intervene, complemented by one or more in-depth analyses such as physical security, architecture, backup efficiency, configuration, source code, organisation, compliance with standards and regulations (GDPR, ISO 27001) and penetration testing.
2. A costed action plan, with summaries of risks and personalised recommendations. It estimates the necessary investments and the solutions adapted to the company's context.

How to participate?

The process takes place in five stages:

1. The company conducts the Light Cybercheck, which highlights key vulnerabilities that need to be analysed in more detail.
2. It chooses an approved expert and sends Luxinnovation the necessary documents. Luxinnovation submits the grant application on its behalf.
3. The consultant carries out the diagnosis with the company.
4. Within 6 months, the consultant presents their analyses and recommendations when the action plan is submitted.
5. The company requests payment of the subsidy once the action plan has been submitted.

And after the diagnosis?

The diagnosis provides a basis for taking action. Implementing the recommendations can give access to other aid from the Ministry of the Economy or to the SME Packages managed by the Chamber of Commerce and the Chamber of Skilled Trades and Crafts, which offer SMEs a government subsidy reimbursing 70% of eligible costs.