PwC Luxembourg

Our Recruitment Days are back! 👀 Looking for your next internship? Join us on 8 & 9 October at our Luxembourg office, where you could receive an offer in just 48 hours Register to the event here! https://lnkd.in/dgGkW6d7

Get the latest jobs and industry news

Cloud transformation is often misunderstood as a simple migration exercise. In reality, it is about redesigning workloads for what comes next: AI, real-time data and more resilient architectures. The organisations that I see winning are changing infrastructure and, at the same time, they are shifting operating models with a product mindset, cost discipline and automated operations. It becomes a different organisation, not just a different platform. In regulated environments, cloud strategy should start first with ambition. The key question is what do you want to be able to do that you can't do today? From there, the real decisions follow: what cannot be compromised, how to stay in control and how to ensure reversibility from day one. Governance, cost control and AI readiness shouldn't be treated as afterthoughts. On sovereignty, Europe is clearly entering a new phase of maturity. It is now a boardroom topic, procurement approaches are evolving and trusted local options are developing alongside the major platforms. With agentic AI, I think cloud becomes even more critical. These systems rely on elastic, auditable infrastructure, and their unpredictable compute appetite raises the stakes for cost discipline. If you are exploring what this means for your organisation, let’s connect! PwC Luxembourg

Security and governance are often perceived as barriers to innovation. I'd argue 𝘁𝗵𝗲𝘆 𝗮𝗿𝗲 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗲𝗻𝗮𝗯𝗹𝗲𝗿𝘀, 𝘄𝗵𝗲𝗻 𝗱𝗼𝗻𝗲 𝗿𝗶𝗴𝗵𝘁. Too often, security without governance becomes a never-ending game of whack-a-mole: controls get implemented, gaps get closed, and yet there is always another issue waiting. 𝗚𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝗶𝘀 𝘄𝗵𝗮𝘁 𝘁𝘂𝗿𝗻𝘀 𝗿𝗲𝗮𝗰𝘁𝗶𝘃𝗲 𝗳𝗶𝗿𝗲𝗳𝗶𝗴𝗵𝘁𝗶𝗻𝗴 𝗶𝗻𝘁𝗼 𝗮 𝗰𝗼𝗵𝗲𝗿𝗲𝗻𝘁 𝗱𝗲𝗳𝗲𝗻𝗰𝗲. It starts with treating governance as a conversation, not a constraint: one that connects risk to strategy and security to what actually matters for the business. Attack surfaces keep expanding, and defenders are structurally one step behind. 𝗕𝗹𝘂𝗲 𝘁𝗲𝗮𝗺𝘀 𝗰𝗮𝗻𝗻𝗼𝘁 𝗱𝗲𝗳𝗲𝗻𝗱 𝗲𝘃𝗲𝗿𝘆𝘁𝗵𝗶𝗻𝗴, and treating every issue as equally urgent often disperses efforts while leaving the most critical risks insufficiently addressed. A clear strategy and rigorous risk assessment help focus attention where it matters most. At the same time, 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗰𝗮𝗻𝗻𝗼𝘁 𝗿𝗲𝘀𝘁 𝗼𝗻 𝗮 𝗼𝗻𝗲-𝗺𝗮𝗻 𝗖𝗜𝗦𝗢 𝗮𝗿𝗺𝘆. It requires tone from the top and the embedding of security principles early. That's the only way to build a genuinely resilient environment over time. Curious how to move from tick-box compliance to something that actually builds resilience? Let's talk. 👇

Too often, cybersecurity conversations start with a comforting assumption: “𝑾𝒆’𝒓𝒆 𝒄𝒐𝒎𝒑𝒍𝒊𝒂𝒏𝒕, 𝒔𝒐 𝒘𝒆’𝒓𝒆 𝒔𝒆𝒄𝒖𝒓𝒆.” But compliance is only a static snapshot of controls at a point in time, while attackers operate continuously. What matters is not whether controls exist, but whether they can withstand 𝐫𝐞𝐚𝐥 𝐚𝐝𝐯𝐞𝐫𝐬𝐚𝐫𝐲 behaviour. The same mindset appears during offensive security missions. Many organisations assume they are not a target and place strong trust in security tools to detect and stop attacks. In reality, 𝐦𝐨𝐬𝐭 𝐚𝐭𝐭𝐚𝐜𝐤𝐞𝐫𝐬 𝐥𝐨𝐨𝐤 𝐟𝐨𝐫 𝐨𝐩𝐩𝐨𝐫𝐭𝐮𝐧𝐢𝐭𝐲 𝐚𝐧𝐝 𝐞𝐚𝐬𝐞, and while detection often exists, it is rarely effective or truly operationalised. The shift is to treat offensive security as a decision engine, not a checkbox activity. A mature programme is not about running more tests, it is about continuously simulating adversaries, validating detection and response, and translating findings into clear business risk that drives action. 𝐔𝐥𝐭𝐢𝐦𝐚𝐭𝐞𝐥𝐲, 𝐭𝐡𝐞 𝐨𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞 𝐢𝐬 𝐭𝐨 𝐝𝐞𝐦𝐨𝐧𝐬𝐭𝐫𝐚𝐭𝐞 𝐫𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐨𝐧 𝐚𝐧 𝐨𝐧𝐠𝐨𝐢𝐧𝐠 𝐛𝐚𝐬𝐢𝐬. If you are exploring what this means for your organisation, let’s connect! PwC Luxembourg

📢 Luxembourg has officially transposed the European NIS2 Directive (EU 2022/2555) into national law, reinforcing the country’s approach to cybersecurity and cyber resilience across the economy. Published on 6 May 2026 and in force since 10 May, the new framework reflects the growing importance of structured cybersecurity governance as organisations face increasingly complex and sophisticated threats. 👉 Read all the details here: https://lnkd.in/dRht_Tu7 | Frederic Chapelle | Maxime Pallez