When information security expert Cédric Mauny arrived in Luxembourg in 2003, cyber security was still a niche discipline. Early on he stumbled across CLUSIL, a club of information security experts. “It was a way to meet people and exchange ideas,” he recalls. “There were also working groups that allowed me to learn about ISO 27001 standards at the time.”
Of the people he met then, today many are colleagues, partners or, like Pascal Steichen (today CEO of the Luxembourg House of Cyber Security, well-known figures within Luxembourg’s cyber security landscape.
In 2026, CLUSIL, as the association is today known, celebrates its thirtieth anniversary. Its focus over the last three decades reflects shifts in an industry which is reaching maturity.
“At first we focused on technical security,” recalls Mauny. “Most fraud came from internal sources, and securing internal systems technically was crucial.”
Since then, Luxembourg has constructed data centres, the Internet is a critical tool for work and, thanks to generative AI, threats are daily, making cybersecurity an essential pillar of any activity in Luxembourg. “Even top management recognises the importance of securing information, which is interesting,” adds Mauny.
Mauny is the fifth president of the association. A polite and gregarious man, who feels more comfortable speaking in his native French, he balances this voluntary role alongside his day job as strategic advisor on cybersecurity for Proximus, Luxembourg’s leading telecommunications and digital services provider.
That’s right. At a time when cybersecurity is recognised as a strategy national concern, one of its key pillars relies on unpaid work. Thankfully, today’s cyber experts are no strangers to change and crisis management. CLUSIL’s dedicated working groups have helped prepare members for trends like cryptography, and regulatory changes such as DORA, NIS2. The platform meanwhile has campaigned for the use of cybersecurity to support the achievement of GDPR requirements. Each regulatory change or trend has forced CLUSIL to reinvent how it connects to end users be they experts or the general population. “Awareness is essential because somehow humans remain the weakest link targeted by attackers,” he says.
In mid-2025, the club ran an experiment in which they scattered 250 USB sticks around Luxembourg. The result: 39 were picked up and accessed, suggesting human curiosity continues to trump cyber awareness. “The best way to access a system is to ask for a password, not technical hacking,” Mauny sighs.
As cyber risks increase, Luxembourg will need more skilled professionals. CLUSIL has partnered with educational initiatives like the Cyberrus Erasmus Mundus Joint Master Degree, a European programme training top-tier cybersecurity experts. It also mentors students, for instance through the Women4Cyber programmes and Cybersecurity BTS at Lycée Guillaume Kroll. “We also offer one-year memberships to students graduating from cybersecurity programmes, giving them a foot in the door,” he says. He sees CLUSIL as one of several players in Luxembourg driving action now to ensure skilled workers for tomorrow.
“If today there are no 10-year-olds interested in ICT or security, it means that in ten years there will be no one graduating from school who can work in this field,” says Mauny.
At 30 CLUSIL has recognised it cannot act alone. It will contribute recommendations for the next national cybersecurity strategy to guide the country and ensure security by design. And while it already works closely with players like ICTLuxembourg, in the coming years it will focus on bringing initiatives, associations and companies together to strengthen security across Luxembourg. Because cybersecurity, Mauny insists, is not a constraint on growth, but a condition for it.
