Someone is asking
A customer, an insurer or an auditor wants evidence.
- One score out of 100, mapped to NIS2, DORA and ISO 27001
- A risk heatmap and a 30/60/90-day plan
- Written for the board, not only for IT
- No AI conversation required
Dominix finds where AI and cyber exposure actually sits, closes the gaps against the deadlines that apply to you, and keeps oversight in place afterwards. Fixed scope, fixed price, and senior people on the work itself.
Based in Luxembourg. Built for Europe.
Each is sold on its own. Nothing here obliges you to buy the next one.
Dominix vCAIO is executive AI leadership on retainer — a standing seat in your leadership meetings and a written position on every AI decision taken, without the cost of a full-time Chief AI Officer.
Every engagement ends with artefacts you can hand to a regulator, an insurer, a customer or your own board — and reuse next year.
NIS2 and customer questionnaires, answered with a score rather than a shrug.
DORA reaches the ICT suppliers of EU financial entities, not only the entities themselves. Their obligations arrive as your contract terms.
An essential sector under NIS2, with obligations that reach the operator and the supply chain alike.
EASA Part-IS has applied to this cohort since 22 February 2026, with full effectiveness required within eighteen months.
Dominix Solutions is a Luxembourg practice in AI governance and cyber assurance. We help organisations find their risk, close the gaps that carry a date, and keep their assurance current — without the overhead of a large consultancy engagement.
Based in Luxembourg, working across the EU regulatory perimeter. We are a small team by design: the person who assesses you is the person who presents the findings. Every package carries a scope cap, set at what we can deliver properly in the days quoted rather than at what would be convenient to sell.
No. Assessments and governance work are led by the founder; the technical side — cloud estate, infrastructure, hands-on security testing — is led by our CTO. We are small on purpose, which is why every package carries a scope cap and a fixed price, and why the person who assessed you is the one in the room when the findings are presented, instead of a partner who sold the work and an analyst who wrote it.
Where an engagement is larger than that model can carry properly — a multi-site estate, or a deadline that needs several workstreams at once — we say so at the scope call and either phase it or decline it. Declining work we cannot do well is cheaper for both of us than discovering it in week three.
On continuity: everything we produce is a document you own. Reports, evidence packs and the scoring method are yours and transferable to any other firm. Nothing is locked inside a tool only we can open.
A discovery scan is EUR 2,900. A CyberClarity Score is EUR 4,500. A single-framework gap analysis is EUR 6,000. Every package is fixed scope and fixed fee, with the scope cap stated in the proposal before you sign.
Within two weeks of signature for most engagements, and faster where a contractual or regulatory date is already fixed. Tell us the date you are working to.
Not for a gap analysis or a governance baseline — those run on documents, interviews and configuration evidence. Vulnerability assessment and penetration testing do require scoped access, agreed and authorised in writing beforehand.
Yes, and most of the work is remote. On-site days are included where the scope needs them — a site walk-through, a board session, an evidence review that cannot travel.
You own the report and can hand it to anyone, including another firm to remediate. If you would rather we fixed it, remediation is sold in fixed five-day blocks, and a retest confirming the fixes landed is EUR 1,600.
A first call is a conversation, not a sales call. Twenty minutes, no preparation needed. We work out which question you actually have — and say so if none of our offers answers it.