‘Those who fear technology become its victim’ – CY4 CEO Keith Cutajar

Keith Cutajar is one of Malta’s most experienced cybersecurity and digital forensics specialists. As CEO of CY4, which offers a comprehensive suite of cybersecurity tools and Tier 3 Digital Forensic and Incident Response (DFIR) services, he focuses on strengthening Malta’s defences against increasingly sophisticated cyber threats. Now driving CY4’s international growth while consolidating its position in the Maltese market, Keith is intent on safeguarding critical data for businesses nationwide.

Keith Cutajar’s road to founding a highly specialised cybersecurity firm began with a blend of information technology (IT) security and investigation. He earned a Master of Science in cybercrime, cyber terrorism and forensics, a field he was drawn to after a deeply personal experience.

“My sister died in a car crash, and that was my first encounter with the investigative and forensic procedures in Malta,” he explains. “It clicked that forensics fundamentally reverse-engineers a problem. Rather than thinking about a product from inception to delivery, in forensics you work backwards from the problem to understand how it started. I knew that approach would be extremely useful in cybersecurity, so it became my niche.”

Since establishing CY4, Keith has shifted his focus from the hands-on technical work he loves to the operational demands of leadership. “As CEO, I gravitate more towards the administrative, organisational and business development sides of the business, which I still enjoy,” he admits.

Nevertheless, he remains closely involved on the technical side, drawing on his experience as a court expert. “I have worked on a number of court cases, which continue to help me hone my analytical and problem-solving skills,” he adds. This forensic mindset also directly informs his leadership: “It has taught me how to troubleshoot and react quickly when faced with a problem in the company and, where possible, prevent issues altogether.”

Operating in such a delicate sector brings pressure. As CEO, Keith confides there are a few things that keep him up at night, primarily “ensuring CY4 delivers top-quality service from submission to delivery, and one that stays ahead of cyber threats, which evolve by the millisecond, not days or months.” He also maintains focus on the challenges of managing a team within the heavily regulated environments in which CY4 operates.

The work still energises him, not least because of the constant change inherent in the sector. “Cyber forensics is a fascinating area. It’s never the same for too long,” he shares. “Even when investigating threats and incidents that may seem similar, we still find something new.”

Keith founded CY4 in January 2023 to formalise his work and experience within a dedicated entity. The company has rapidly positioned itself as a leader in Malta by offering a highly tailored, technical suite of services. “The vast majority of CY4’s business is custom-built for individual clients; reselling third-party products is a small portion of what we do,” he says.

Since its inception, CY4’s steady sales growth has been matched by team expansion, enabling the company to consistently offer high-quality services. Key drivers include a significant investment in employee skills and training, and a rigorous approach to compliance. The regulatory environment, including adherence to NIS-2 (the EU’s updated cybersecurity directive) and maintaining ISO (International Organization for Standardization) and DORA (Digital Operational Resilience Act) standards, underpins CY4’s strategy. “Fortunately, regulations exist; without them, many would neglect security,” he notes. “These regulations drive awareness, which is sorely needed, and encourage companies to invest in protecting their data.”

Alongside top-line growth and a broader services mix, CY4 has diversified its client base to reduce client concentration risk. “We must avoid over-reliance on a single customer,” Keith remarks. “We’ve been able to broaden our list of clients in no small part due to our strong reputation, which we’re building mostly via word of mouth.”

One major obstacle faced by CY4 is the high expense of maintaining Tier 3 DFIR services, particularly the licensing of highly security-cleared tools. “The problem is that we license these products for a number of clients in Malta, and given the country’s small market size, cost-sharing is difficult,” Keith explains. To scale efficiently, CY4 is expanding its international operations. “We’re increasingly outsourcing our Tier 3 expertise to foreign entities. The overseas market is there – in Europe, there are only about 20 to 30 Tier 3 set-ups like ours.”

Locally, the market still presents hurdles. “In terms of cybersecurity, we’re lagging behind as a market, as a country,” Keith states, clarifying that too many business and industry professionals assume they will never be targeted and therefore undervalue information security. “It’s like having your home and belongings fully insured, but then leaving the front door open. Anyone can get in, whenever they want.”

This gap creates opportunities for CY4, especially among small and medium-sized enterprises (SMEs). “While many companies believe they will never be on a hacker’s radar and that information security is only for ‘big’ players, it’s really not the case. We have clients with budgets from €500 through to €100,000-plus,” he reveals.

Keith stresses that everyone is vulnerable to cybercrime – technology can fail, and the human element remains a critical risk. “Staff awareness of the dangers of cyber threats is still lacking,” he notes. “We often investigate incidents triggered by someone clicking a link or opening an attachment.” The danger is augmented by increasingly sophisticated attacks enabled by artificial intelligence (AI).

With AI reshaping both cyberattacks and defences, Keith believes the response must be equally adaptive. To counter this emerging threat, he advocates “fighting fire with fire”, stressing the importance of using tools with AI modules that can detect malicious payloads. “Having people stare at dashboards, watching logs, will not reliably surface threats,” he says. “You need automated detection mechanisms because software operates at millisecond speed, so our countermeasures must match that pace to catch fast-moving cyber threats.”

To address the cyber forensics needs of the local market, CY4 is launching two new initiatives: a Cyber-Threat Intelligence (CTI) subscription service and a new Security Operations Centre (SOC) offering. “CTI will help anticipate and detect incidents before they happen by gathering and customising intelligence from threat actors on darknet forums,” he explains. The SOC partnership will provide a Malta-to-Malta DFIR capability across Tiers 1, 2 and 3. This new Malta-based offering is crucial because international providers often charge double or triple local rates and, equally importantly, using a local SOC ensures that data remains in Malta.

Looking ahead, Keith aims for growth with greater stability. “I hope to encounter fewer ups and downs,” he says. Rather than diversifying, he intends to “deepen focus on CY4’s core offerings, maintain service quality and partner with overseas companies to expand international presence.” In addition, CY4 is positioning itself for the future by consistently anticipating challenges and adapting in line with technological change. “As long as we evolve at the same pace as technology, CY4 will remain relevant,” he remarks.

Ultimately, Keith urges greater vigilance and readiness by investing in information security. He sounds a note of caution: “Be adaptable; do not fear new technologies. If you’re afraid of technology, you’ll become its victim,” he warns. “I prefer to provide proactive services rather than reactive ones. Responding too late to a cyberattack can mean loss of data and, in some cases, ruin – companies being liquidated and people losing their jobs. That outcome is disastrous – both financially and reputationally.”

This article is part of the serialisation of 50 interviews featured in MaltaCEOs 2026 – the sister brand to MaltaCEOs.mt and an annual high-end publication bringing together some of the country’s most influential business leaders.