Gilles Tooling strengthens its cyber resilience with Room#42

For over 20 years, the Luxembourg-based company Gilles Tooling (located in Grevenmacher, in the east of the country, along the Moselle) has specialised in designing and developing motorcycle accessories that meet the highest standards, setting itself apart through a commitment to innovative engineering.

The company's products are now sold worldwide, to private riders as well as leading motorcycle manufacturers. The company works in close partnership with some of the industry's most renowned brands, including BMW, Yamaha, KTM and Suzuki.

Cybersecurity as a business priority

For such an SME, which has 62 employees, cybersecurity is not an afterthought, even if on the surface, it may seem very far from the concerns of the asphalt and the roar of enginest. Gilles Tooling considers this to be a crucial concern, embedded at the highest level of the organisation.

The company had already taken concrete steps to reduce its attack surface before turning to Room#42, the cyber crisis simulation infrastructure operated by the Luxembourg House of Cybersecurity (LHC).

Yet awareness of the threat landscape pushed the team to go further. "Since the likelihood of a successful cyberattack is very high, it was important for us to simulate this scenario so we could respond as effectively as possible, minimise the damage and get back up and running as quickly as possible," explains Oliver Gritzo, IT System Administrator at Gilles Tooling.

A realistic simulation to test the limits

Room#42 is a dedicated cyber crisis exercise facility that places participants in a live incident scenario, mimicking the stress, confusion and urgency of a real attack. For the Gilles Tooling team, the three-hours session in which 5 people participated proved to be a turning point.

This experience was very realistic and showed us just how helpless one can feel. Oliver Gritzo, Gilles Tooling

"This experience was very realistic and showed us just how difficult such a situation is, how helpless one can feel, and how important it is to work together as a team and do the right things from the very beginning," recalls Mr Gritzo.

Beyond the emotional intensity of the exercise, the session provided structured, actionable outputs. The creation of an incident timeline and the subsequent prioritisation of responses were among the most valuable takeaways, giving the team a clear framework to apply when it matters most.

Lessons learned, plans updated

The Gilles Tooling team did not let the experience remain theoretical. In the weeks following this Room#42 session, they began integrating the lessons directly into their Incident Response Plan. The focus is twofold: increasing organisational resilience before an attack occurs and optimising the response if one succeeds.

This approach reflects a mature understanding of modern cybersecurity, one that accepts the inevitability of threats and focuses energy on preparation, detection and recovery, not solely on prevention.

A trusted partnership with the Luxembourg Digital Innovation Hub

The Room42 session was facilitated through the Luxembourg Digital Innovation Hub (L-DIH), which connects Luxembourg companies with tools, expertise and infrastructure to support their digital and technological development.

For Gilles Tooling, the relationship with the L-DIH has been consistently positive. "The collaboration with the DIH stakeholders and their staff was always positive and professional. It helped us take a major step forward in the area of IT security," says Mr Gritzo. "We would also like to continue taking advantage of these opportunities in the future to keep improving."

SMEs can rebuild their confidence and approach cybersecurity as a pathway to greater resilience and progress. Denis Strobel, Luxinnovation

This ongoing engagement reflects the L-DIH's role not just as a one-time service provider, but as a long-term partner in building digital capability across Luxembourg's business ecosystem.

“A cyberattack should not be seen as a source of shame, but as a signal to take action,” complete Denis Strobel, Manager Digital Solutions at Luxinnovation. “With the L-DIH’s supportive guidance and the practical lessons offered by Room#42, SMEs can rebuild their confidence and approach cybersecurity as a pathway to greater resilience and progress.”

Key takeaways for Luxembourg companies

The Gilles Tooling experience illustrates several important lessons for SMEs and mid-sized companies considering cyber crisis preparedness:

• Cybersecurity must be treated as a strategic priority, with management-level buy-in;
• Simulation exercises reveal gaps that theoretical planning alone cannot expose;
• A structured incident timeline is a practical, high-value output of any crisis exercise;
• Partnerships with organisations such as the L-DIH and LHC open doors to specialised infrastructure that would otherwise be out of reach;
• Resilience is built iteratively: each exercise and each update to an Incident Response Plan reduces risk.

“One of the most common misconceptions among SMEs is that they are too small to attract the attention of cyber criminals,” warns Anitha Arulrajakumar Information Security Analyst at the Luxembourg House of Cybersecurity. “In reality, organisations across all sectors face a growing number of cyberattacks, while advances in AI are lowering the technical barriers to launching increasingly sophisticated attacks.”

SMEs can also provide an entry point into larger organisations through supply-chain relationships, making their security posture relevant beyond their own business. “It is therefore essential for SMEs to prioritise cyber resilience and crisis-management preparedness. This preparedness should extend beyond tabletop exercises to include practical testing of response capabilities. Such testing helps organisations identify gaps, strengthen their processes and become better equipped to respond when a cyber incident occurs.”