“Cybercrime has become highly organised,” Keith Cutajar Founder and Director at CY4 Ltd asserts from the outset. “Attacks are often outsourced to specialised groups, with what can only be described as the advanced development of highly sophisticated cyber weaponry, particularly in the context of ongoing geopolitical conflicts. We have observed the landscape shift, with cyberthreats escalating considerably, requiring timely and expert support to safeguard a company’s most valuable resource – data.”

Over the years, Mr Cutajar has built a robust reputation assisting businesses through CY4 Ltd, with their cyber security, providing expert advice in Malta’s judicial environment, as well as investigating and supporting cyber threats locally as well as at an international level.

“Over the past months we have been actively involved in incident investigations, including ransomware attacks orchestrated by organised threat actors. In some cases, this has led to reverse-engineering malicious software, providing critical insights into how attacks are structured and how they can be mitigated,” Mr Cutajar continues to explain.

This exposure to real-world threats feeds directly into the intelligence CY4 provides its clients on a more day-to-day basis. The company supports international operations, particularly for businesses headquartered in Malta with offices overseas, offering a consistent security framework across jurisdictions. “In certain high-risk environments, including critical infrastructure, systems are monitored continuously, with alerts triggered at regular intervals to ensure immediate response.”

However, while larger companies will often have entire teams dedicated to their cyber welfare, smaller outfits may struggle to dedicate enough resources to this very real threat. That is where Fractional CISO (Chief Information Security Officer), or CISO-as-a-service comes into play, with CY4 being equipped to provide the necessary peace of mind of a full service at the fraction of the cost.

“We are fully aware that few companies can realistically afford to build a complete in-house expert-led cyber security function. That is where we come in, with a tailored-to-size response set-up, designed to their risk profile and regulatory obligations,” Mr Cutajar explains.

CISO takes full responsibility for a company’s information security posture, from coordinating software and hardware updates to designing policies, managing cyber risks, and responding to incidents when they occur.

Unlike traditional IT companies, CY4 doesn’t sell infrastructure systems, ensuring no conflict of interest. Its sole focus is cyber security, a deliberate delineation which proves to be essential. “There is often a conflict of interest when the same provider is responsible for both IT and security,” Mr Cutajar notes. “Security and IT systems, though they need to collaborate with each other, are required by design to be independent and segregated from each other, for both to function at the best of their capabilities,” Mr Cutajar furthers.

Through a flexible outsourcing model, CY4 offers clients access to a full range of cyber security functions, typically bundled in hours, structured around their needs and budget. These can be consumed across a wide range of services, including policy development and review, staff training, cyber simulation exercises, penetration testing and vulnerability assessments, incident response and regulatory reporting, data recovery during cyber incidents, infrastructure reviews, and ongoing threat intelligence.

CISO offers full protection and immediate expertise, without the burden of employing a full-time executive role within the team. “We know too well how difficult it is to identify and attract the right talent to our companies. HR doesn’t grow on trees, and employing new team members comes its own risks. Furthermore, they will likely be specialised in one field, and unprepared in another, requiring the company to make further expenses outsourcing specific services,” Mr Cutajar illustrates. For many organisations, particularly small and medium-sized enterprises, the model offers a compelling alternative to hiring internally.

CY4 provides full peace of mind from day one. Rather than reacting to issues as they arise, CY4 works with clients to develop structured plans of action, aligned with their operational realities. “Every company has its own dynamics,” Mr Cutajar explains. “We start by understanding who they are, how they operate, and what their risks look like. Trust is fundamental throughout the process.”

The service is particularly relevant in highly regulated companies. Frameworks such as NIS2 and DORA are raising the bar for cyber security compliance across sectors, especially for banks and other regulated entities. Yet, as Mr Cutajar points out, the need extends to anyone who operates a computer that’s connected to the internet. “Any company that runs an IT system is exposed. The question is not whether you need security, but how you implement it effectively.”

Mr Cutajar remains closely connected to the legal and investigative dimensions of cyber security, continuing to practise in the Law Courts. This dual perspective gives him precious exposure to the latest trends in cybercrime, which in turn is translated into intelligence for the benefit of CY4 clients.

“Our work as technical experts in Malta’s Law Courts keeps us on the frontline. We see how cases evolve, how regulations are applied, and where the real risks lie. There are no surprises.”

His expertise has also been recognised at a European level, recently delivering a keynote address on cyber security and artificial intelligence at a conference attended by Financial Intelligence Units from across Europe, hosted in Malta.

For clients, however, the value of CY4’s CISO-as-a-service lies in removing the administrative burden associated with recruitment, leave management, ongoing training and a myriad of other matters, allowing companies to focus on their core business, while maintaining a robust security posture.  Hours can be scaled up or down, carried forward, or adjusted as needs change, offering a level of flexibility that traditional structures will struggle to match.

For more information about CY4 and its CISO-as-a-service visit https://cy4.mt/