ORNISEC

What ORNISEC does

ORNISEC is a French cybersecurity consulting and audit firm founded in 2020 by Ayoub Sabbar and headquartered in Orgères, Brittany (with operational offices in Saint-Grégoire, French Polynesia, and Morocco). The company delivers a portfolio of professional services across consulting (EBIOS RM governance, ISMS implementation, security policy development), technical and organizational security audits (penetration testing across IT/OT, architecture/configuration/code audits, Red Team operations), CISO-as-a-Service and coaching, regulatory compliance support (NIS-2, DORA, ISO 27001, HDS, LPM, RGPD), crisis management and incident response, and security awareness training. In March 2024 ORNISEC launched CALIDRA, an AI-powered, fully managed cybersecurity awareness platform offered as a subscription/managed service to complement its project-based revenue.

ORNISEC operates with approximately 40+ collaborators and reports more than 400 projects delivered annually with +100% year-over-year revenue growth. Its customer base spans critical-infrastructure operators and public entities — airports (Beauvais, Nantes Atlantique, Nice Côte d'Azur), airlines (Air Austral, Air Calédonie International), government bodies (Government of New Caledonia, Guadeloupe Port Caraïbes), healthcare (ASIP Santé), and energy (EDT ENGIE) — delivered through direct enterprise field sales and through public procurement frameworks, notably Lot 3 AMOA Cyber of the CANUT purchasing center across four French regions.

The company's primary differentiators are regulatory: it holds the ANSSI PASSI qualification across all five scopes (including PASSI LPM authorizing audits of OIV/national security systems), the PACS qualification (one of only two French firms qualified across all four scopes), and ISO/IEC 27001:2022 certification. It was selected for the 5th promotion of the French government's ETIncelles program in 2024 and was shortlisted for the EY Prix de l'Entrepreneur de l'Année. ORNISEC is structured as an SARL, founder-owned with no disclosed external funding.

Name

ORNISEC

Legal name

Ornisec SARL

Website

https://ornisec.com

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

11–50 employees

Short description

ORNISEC is a French cybersecurity consulting and audit firm serving critical-infrastructure operators and public entities across aviation, healthcare, energy, and government. It offers ANSSI-qualified PASSI/PACS audits, penetration testing, CISO-as-a-Service, regulatory compliance, and the CALIDRA AI awareness platform.

Ownership category

akta.pro rank

Product category

Cybersecurity Services

NAICS

Other Scientific and Technical Consulting Services (54169), Management, Scientific, and Technical Consulting Services (5416)

SIC

Services-Management Consulting Services (8742)

akta.pro primary industry

Cybersecurity & Identity Consulting (BPAHAEAG)

akta.pro secondary industries

Governance, Risk & Compliance (GRC) Advisory & Assessments (BPAKAHAH), Enterprise Security Strategy & Program Advisory (BPAKADAA), Executive/Board Security Advisory & Risk Briefings (BPAKADAK)

Keywords

• Cybersecurity consulting services
• Penetration testing services
• Security audit services
• CISO as a service
• Cybersecurity training awareness

Headquarters

HQ city

Rennes

HQ country

France

HQ region

Europe

Offices4 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Others

Revenue model

1. Cybersecurity Consulting Services: High-value consulting services including governance, risk management, SMSI support (ISO27001, HDS, etc.), security policy development, and CISO coaching and support.
2. Security Audits and Penetration Testing: Technical and organizational security evaluations including penetration testing (internal, external, OT/ICS), architecture audits, configuration audits, code audits, and Red Team operations.
3. Training and Awareness Programs: Security awareness programs including phishing simulations, workshops, QCM assessments, e-learning modules, and SSI training for various profiles (CISO, IT Admin, industrial teams, developers, project managers).
4. Calidra SaaS Platform: AI-powered security awareness platform offered as a managed service with fully personalized content.

Pricing tiers

Go-to-market motion2 records

Distribution channels2 records

Marketing channels6 records

Core offering

ORNISEC delivers cybersecurity consulting and audit services to organizations, including governance and risk management (EBIOS RM), technical and organizational security audits (penetration testing, architecture, configuration, code, Red Team), outsourced CISO function (Accompagnement RSSI), regulatory compliance (NIS-2, DORA, ISO 27001, HDS, LPM), crisis management and incident response, and security awareness training. It also operates CALIDRA, an AI-powered cybersecurity awareness platform offered as a managed service.

Product overview

ORNISEC is a cybersecurity consulting and audit firm offering a comprehensive portfolio of professional services. The core offering consists of cybersecurity consulting, security audits and penetration testing, CISO as a Service, training and awareness programs, regulatory compliance services, and crisis management. The portfolio also includes CALIDRA, an AI-powered cybersecurity awareness platform launched in 2024 that provides fully customizable training content as a 100% managed service. All services are delivered by ANSSI-qualified consultants with expertise across multiple security domains.

Differentiator

Problem solved

Functional benefit

Products and services

• Cybersecurity Consulting Services Comprehensive cybersecurity consulting engagements including security governance, risk management using EBIOS RM, ISMS implementation (ISO 27001, HDS), security policy (PSSI) development, and security homologation, delivered to organizations that need structured cybersecurity programs.
• Security Audits and Penetration Testing Technical and organizational security evaluation services including penetration testing (internal, external, OT/ICS), architecture audits, configuration audits, code audits, organizational and physical audits, and Red Team operations, delivered to organizations requiring independent security validation.
• CISO as a Service (Accompagnement RSSI) Outsourced CISO/RSSI function providing coaching, operational security management, integration of security in projects, definition and implementation of the SSI roadmap, application of security policy, security expertise, and reporting/follow-up of SSI projects for organizations that lack an internal CISO.
• Regulatory Compliance Services Compliance support for legal, normative and contractual obligations including Security Assurance Plan, LPM, RGPD, NIS-2 Directive, ISO 27001, ISO 22301, HDS, RGS, DGAC, 3CF and Part-IS, for organizations in regulated sectors.
• Crisis Management and Incident Response Cybersecurity crisis management support including incident and cyber crisis management, compromise research, forensics, BCP/DRP implementation, and execution of cybersecurity crisis exercises, for organizations needing structured incident response capability.
• Training and Awareness Programs Cybersecurity awareness program development and implementation including phishing simulation, awareness workshops, QCM assessments, e-learning modules, and SSI training tailored to various profiles (CISO, IT Director, S&R administrator, industrial teams, developers, project managers).
• CALIDRA AI-powered cybersecurity awareness and training platform providing fully customizable content, a 360-degree awareness strategy, and evolving AI-generated training material adapted to each organization's specific needs; offered as a 100% managed service operated by ORNISEC's expert teams.
• Phishing Simulation Phishing attack simulation service to test and train employees on recognizing malicious emails, with reporting on susceptibility rates, for organizations that need to measure and improve human-layer security posture.

Quantifiable outcome

• 400+ annual projects completed
• +1 more outcomes

Named customers10 records

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

AI capability2 records

Feature3 records

Partnerships

Four partnerships are on record, tiered national and regional.

• CANUT (Centrale d'Achats du Numérique et des Télécoms)nationalChannel Partner/ Reseller/ Distributor · 1 May 2025ORNISEC is holder of lot 3 AMOA Cyber for CANUT, covering regions Brittany, Centre-Val de Loire, Normandy, and Pays de la Loire. This public procurement framework allows government entities to contract directly for cybersecurity services including audit, consulting, RSSI assistance, and compliance support.
• Tavita CybersecurityregionalStrategic or Co-development Partner · 1 June 2024Partnership with Tavita Cybersecurity to deliver cybersecurity training in French Polynesia. ORNISEC experts traveled to Tahiti to conduct training sessions covering penetration testing, security awareness, S&R security, and CISO training for Polynesian professionals and future experts.
• CEEBEXregionalStrategic or Co-development PartnerPartnership with CEEBEX, a cybersecurity training organization created to address training needs in Brittany. Ayoub Sabbar discussed this initiative with ANSSI Director General Vincent Strubel during European Cyber Week.
• Alliance pour la Confiance Numérique (ACN)nationalStrategic or Co-development PartnerORNISEC participated in the Salon des Maires et Collectivités Locales as an exhibitor within the Alliance pour la Confiance Numérique (ACN) stand, representing the digital trust ecosystem.

Scale indicators5 records

Recent moves7 records

Expansion highlights6 records

Direct peers

• Wavestone: French-listed pure-play consulting firm with a large cybersecurity and digital trust practice serving French and European enterprises and public entities. Closely comparable to ORNISEC in target customers, regulatory expertise, and ANSSI-aligned service portfolio, but at significantly greater scale.
• Advens: France-based cybersecurity pure player offering SOC, consulting, audit, and managed detection services. Directly comparable to ORNISEC as a French PASSI-qualified cybersecurity services firm targeting mid-market and enterprise customers, including public-sector clients.
• Almond: French cybersecurity services firm specializing in audit, consulting, and managed security for sensitive environments including defense and OIV. Comparable to ORNISEC in regulatory positioning (ANSSI qualifications), target verticals (critical infrastructure, public sector), and service portfolio breadth.
• Devoteam: European IT and cybersecurity consulting firm with a dedicated cyber trust & risk practice. Comparable to ORNISEC in advisory-led, ANSSI-aware cybersecurity services across mid-market and enterprise French clients, with similar positioning around cloud and compliance mandates.

Broad incumbents

• Orange Cyberdefense: Subsidiary of Orange operating a large MSSP/SOC and cybersecurity consulting business across Europe. Overlaps with ORNISEC in audit, advisory, and managed security services, but at substantially greater scale and with a broader international delivery footprint.
• Thales: Global defense and digital security group with a major cybersecurity division covering consulting, audit, identity, and OIV-grade services in France. Comparable to ORNISEC in regulatory standing and ability to serve critical national-security clients, though operating as a much larger portfolio player.
• Capgemini: Global IT services firm with a sizable cybersecurity practice covering consulting, audit, and managed security. Overlaps with ORNISEC in regulated industries (aviation, government, financial services) and NIS-2/DORA readiness engagements, though cybersecurity is one practice within a broader portfolio.
• Sopra Steria: Major European IT services group with a cybersecurity division active in France's public sector and regulated industries. Overlaps with ORNISEC in audit, compliance, and SOC-related services for government and OIV clients, but with much broader delivery capacity.
• Atos: Global digital services firm with a significant cybersecurity portfolio including audit, advisory, and managed security for European governments and critical infrastructure. Comparable to ORNISEC in regulated French customers and OIV exposure, though operating at far greater scale.

Emerging players

• Sekoia.io: French cybersecurity SaaS provider offering an extended detection and response (XDR) platform. Not a direct consulting competitor, but a relevant French cybersecurity peer targeting overlapping regulated clients; useful benchmark for product-led growth potential beyond ORNISEC's consulting base.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• LinkedInlinkedin.com/company/ornisec
• Xx.com/ornisec

Compliance4 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about ORNISEC