1. Home
  2. Blog

Advancing Smart Healthcare and Cyber-Resilient Infrastructures

XGL (Xgility) is an innovative solutions provider and research-oriented IT company headquartered in Dublin, Ireland. Bringing together a highly skilled and diverse team of researchers, consultants, and IT specialists, XGL delivers a comprehensive range of services and solutions tailored to the needs of both industry and research partners. The company is distinguished by its agility, technical expertise, and forward-looking approach to technology adoption.

XGL’s core competencies span software development, IT outsourcing, AI-driven decision support systems, cybersecurity expertise, IT consulting, training, and advanced data and document management. Building on its innovation-driven approach, the company is also exploring emerging technologies such as virtual agents and large language models (LLMs) to enhance digital services, automation, and human–machine collaboration. By combining cutting-edge research with hands-on experience in the deployment and management of complex IT solutions, XGL supports organizations in their digital transformation journeys. With a strong emphasis on reliability, scalability, and adaptability, XGL has established itself as a trusted partner capable of addressing diverse technological and business challenges.

Beyond its service portfolio, XGL actively participates in research and innovation through EU-funded projects, where it contributes to the advancement of IT infrastructures, interoperability, and digital resilience. Its longstanding involvement in European research initiatives highlights the company’s ability to bridge the gap between academic innovation and industrial application, translating research outcomes into market-ready solutions through a strong commitment to research-to-market dissemination.

Within the CyberNEMO project, XGL plays a pivotal role by leading Task 5.1: Open Data Management Plan & Trials Set-up and Task 5.4: Smart Healthcare Critical Infrastructures Validation, where it provides guidelines for data management in CyberNEMO and supports the MUP pilot with technical expertise. In addition, XGL contributes to Task 3.2: Intrusion Prevention/Detection/Mitigation DSS (IPDM-DSS) and Task 3.4: Privacy Protection Enforcement (PPE). The company also leads the development of a semantically enhanced Countermeasures Repository, designed to identify and match countermeasures against emerging and existing critical infrastructure threats.

Through its expertise in cybersecurity, AI-driven solutions, and emerging virtual agent technologies, XGL reinforces the collaborative and interdisciplinary character of CyberNEMO. The company remains dedicated to driving innovation, enabling digital transformation, and delivering high-quality IT solutions that create long-term value for stakeholders across both research and industry.

Read More

Mapping Cyber Vulnerabilities to MITRE ATT&CK for Critical Infrastructure Threat Detection

How CyberNEMO is bridging the gap between risk visibility and intelligent response

In today’s hyperconnected world, Europe’s critical infrastructures (CIs) — energy, transport, healthcare, and manufacturing — form the backbone of our digital society. Yet these same systems are among the most vulnerable targets. 

From ransomware attacks that paralyse hospitals to supply chain breaches rippling through industrial control systems, one reality stands out: we cannot defend what we cannot understand. 

Why Vulnerability Mapping Matters

Traditional vulnerability scanning stops at detection — identifying weak points without explaining how they might be exploited. But true cyber resilience requires context. 

By mapping vulnerabilities to the MITRE ATT&CK framework — the global reference for adversarial tactics, techniques, and procedures (TTPs) — defenders can see how attackers think and operate. Each vulnerability becomes a narrative of potential attack paths, not just a static CVE entry. 

By correlating technical weaknesses (CVE/CVSS) with ATT&CK techniques, CI operators can: 

  • Prioritise what matters most — focusing on vulnerabilities exploited by active adversaries.
  • Enhance detection logic — linking vulnerabilities to ATT&CK techniques like privilege escalation, lateral movement, or data exfiltration.
  • Enable AI-driven threat prediction — modelling how small weaknesses could evolve into full-scale attack chains.

Embedding AI Closer to the Threat Surface

CyberNEMO’s approach brings AI intelligence directly to the edge, transforming how vulnerabilities are monitored and analysed in distributed systems. 

By embedding AI in IoT gateways and edge devices, threat detection becomes continuous, adaptive, and privacy-preserving. These local models evolve with each new observed attack, strengthening defences autonomously and enhancing cross-domain resilience. 

This shift — from centralised analysis to distributed intelligence — is key to protecting the complex, hybrid environments that define modern critical infrastructure. 

From Zero Trust to Full-Stack Protection

As CI systems increasingly span IoT–edge–cloud architectures, the attack surface expands. MITRE ATT&CK provides a shared taxonomy for identifying and analysing threats across layers — whether it’s an IoT device communicating with a suspicious domain (ATT&CK T1071) or an insider escalating privileges (T1068). 

When integrated with Zero Trust principles, ATT&CK mapping enables defenders to: 

  • Dynamically verify every entity and data flow.
  • Feed contextual intelligence into security enforcement engines.
  • Apply risk-based adaptive access control, tightening security automatically when certain attack techniques are detected.

Together, these approaches move organisations from reactive defence to proactive, intelligent protection. 

Collaboration and Knowledge Sharing

Mapping vulnerabilities to MITRE ATT&CK isn’t just a technical process — it’s a collaborative intelligence effort. 

CyberNEMO is shaping a distributed European sharing platform that empowers CI operators, CERTs, and CSIRTs to:

  • Exchange ATT&CK-aligned threat data in real time.
  • Maintain interoperability across domains and sectors.
  • Strengthen Europe’s collective cyber resilience.

By aligning on a common threat language, Europe’s CI defenders can respond faster and smarter — together. 

Building a Culture of Cyber Sustainability

Ultimately, mapping vulnerabilities to MITRE ATT&CK helps organisations do more than just patch; it helps them learn, adapt, and evolve. 

By connecting the technical (AI, Zero Trust, machine learning pipelines) with the human (awareness, collaboration, and shared intelligence), CyberNEMO fosters a culture of cybersecurity for sustainability — one that endures and grows stronger over time. 

The Path Forward

CyberNEMO’s work on vulnerability-to-ATT&CK mapping marks a crucial step toward AI-empowered, collaborative cyber defence across Europe’s critical infrastructure. 

It bridges the gap between visibility and action, turning fragmented vulnerability data into a living intelligence fabric that evolves with every threat. 

Because in this new era of cyber-physical convergence, context is the ultimate defence.

Read More

Cybersecurity for Smart Healthcare

Medical University of Plovdiv, Bulgaria was established in 1945. It includes the Faculties of Medicine, Dental medicine, Pharmacy, Public Health, a Department of Languages and Specialized training, a medical college and six University Hospitals. Facilities include laboratories, clinics and units for diagnostics and treatment, research activities and training of students. Every year both Bulgarian and foreign students are trained at the Medical University of Plovdiv. Medical University of Plovdiv is organizing and leading the postgraduate specialization in all medical specialties and is also providing education at above 10 Master and 30 PhD programs.


MUP does not has IT specialists that are involved into the information systems managing therefore MUP works in collaboration with XGILITY LIMITED (XGL) which is actively contributing its expertise to the CyberNEMO project. The team involved in CyberNEMO project is dealing with Smart Healthcare Critical Infrastructure – examines real-world vulnerabilities across hospitals, medical centres, and national healthcare data flows, where cloud, edge, and IoT devices all play a role in processing and storing sensitive health information. MUP is leading a trial focused on: Authentication and authorization protection, ensuring that unauthorized users cannot access or manipulate sensitive patient records, financial claims, or hospital logistics.
The main objective is to ensure healthcare system resilience, where hospitals, ministries, and practitioners share knowledge on threats, zero-day vulnerabilities, and mitigation practices to strengthen collective defense.

Read More

Maggioli: Evolving Through Digital Innovation

Company Profile and Evolution

Maggioli’s history spans over a century, originating as a publishing and printing company. This foundation in knowledge dissemination set the stage for a significant evolution towards digital, which began in 1988 with the establishment of the Maggioli Informatica Business Unit. This marked the company’s strategic entry into the Information and Communications Technology sector, focusing on the development of software, services, and projects for Digital Transformation.

Today, Maggioli is a major player in the ICT market. The Group employs over 3,000 people across more than 70 offices in Italy and abroad, with a technical-commercial presence in Spain, Greece, Belgium, and Colombia. This international scale supports a large and diverse client base of over 45,000 customers. A majority of these clients (72%) are in the public sector, giving the company extensive experience in serving governmental and administrative bodies.

Digital Transformation represents the core of Maggioli’s business, accounting for 86% of its activities. The Group’s consolidated turnover for 2024 is projected to exceed €400 million, reflecting a consistent growth strategy.

Focus on Research and Development

Research and Development is a central component of Maggioli’s strategy. The company has a team of over 100 people dedicated to R&D, located primarily in Italy and Greece. This team is currently engaged in over 30 active research projects across various innovative domains.

Among these dedicated research areas is Cyber and Physical Security, which aligns directly with the objectives of the CyberNEMO project. This focus on security complements the company’s broader expertise in areas such as Smart Cities, Industry 4.0, and Sustainable Energy, positioning Maggioli at the forefront of European innovation initiatives.

Maggioli’s Role in CyberNEMO

Within CyberNEMO, Maggioli holds a significant leadership role, guiding the overall strategy for the development of the project’s core security technologies.

The company’s responsibilities include leading the practical development of the project’s frontline cyber defenses, such as cloud-native intelligent firewalls and secure domain name systems. Additionally, Maggioli is responsible for the work on Explainable Artificial Intelligence (XAI). This research is critical for ensuring that the advanced AI tools developed in the project are transparent and trustworthy for security operators in real-world scenarios.

Maggioli’s established expertise and dedicated R&D capabilities provide a strong foundation for its contributions to the CyberNEMO project.

Read More

XGL in CyberNEMO

XGL (Xgility) is an innovative solutions provider and research-oriented IT company headquartered in Dublin, Ireland. Bringing together a highly skilled and diverse team of researchers, consultants, and IT specialists, XGL delivers a comprehensive range of services and solutions tailored to the needs of both industry and research partners. The company is distinguished by its agility, technical expertise, and forward-looking approach to technology adoption.

XGL’s core competencies span software development, IT outsourcing, AI-driven decision support systems, cybersecurity expertise, IT consulting, training, and advanced data and document management. Building on its innovation-driven approach, the company is also exploring emerging technologies such as virtual agents and large language models (LLMs) to enhance digital services, automation, and human–machine collaboration. By combining cutting-edge research with hands-on experience in the deployment and management of complex IT solutions, XGL supports organizations in their digital transformation journeys. With a strong emphasis on reliability, scalability, and adaptability, XGL has established itself as a trusted partner capable of addressing diverse technological and business challenges.

Beyond its service portfolio, XGL actively participates in research and innovation through EU-funded projects, where it contributes to the advancement of IT infrastructures, interoperability, and digital resilience. Its longstanding involvement in European research initiatives highlights the company’s ability to bridge the gap between academic innovation and industrial application, translating research outcomes into market-ready solutions through a strong commitment to research-to-market dissemination.

Within the CyberNEMO project, XGL plays a pivotal role by leading Task 5.1: Open Data Management Plan & Trials Set-up and Task 5.4: Smart Healthcare Critical Infrastructures Validation, where it provides guidelines for data management in CyberNEMO and supports the MUP pilot with technical expertise. In addition, XGL contributes to Task 3.2: Intrusion Prevention/Detection/Mitigation DSS (IPDM-DSS) and Task 3.4: Privacy Protection Enforcement (PPE). The company also leads the development of a semantically enhanced Countermeasures Repository, designed to identify and match countermeasures against emerging and existing critical infrastructure threats.

Through its expertise in cybersecurity, AI-driven solutions, and emerging virtual agent technologies, XGL reinforces the collaborative and interdisciplinary character of CyberNEMO. The company remains dedicated to driving innovation, enabling digital transformation, and delivering high-quality IT solutions that create long-term value for stakeholders across both research and industry.

www.xgility.eu

Read More

Netcompany SEE & EUI in CyberNEMO

Netcompany SEE & EUI is a leading European IT Solutions and Services company with proven expertise in conceptual system architecture and system design, advanced application development and integration / communication services, information portal management, communication services, and project management, offering innovative and added-value solutions of the highest quality to a wide range of international and national public and private organizations.

Furthermore, Netcompany SEE & EUI based on its expertise is responsible for undertaking and coordinating the activities of CyberNEMO cybersecure federated ZT architecture definiton. At the same time, Netcompany SEE & EUI leads the activities of the Cybersecurity & Privacy by Collaboration Work Package having the responsibility to design and implement Strategies & Tools for cooperative remediation and mitigation such as the Knowledge Sharing, risk Assessment, threat Analysis and incidents Mitigation (SAAM) framework. Lastly, Netcompany SEE & EUI leads the Exploitation activities of CyberNemo aiming to ensure effective communication and outreach of project results, focusing on engaging stakeholders and identifying opportunities to exploit project outcomes.

Read More

Eclipse Foundation in CyberNEMO

The Eclipse Foundation provides our global community of individuals and organizations with a mature, scalable, and business-friendly environment for open source software collaboration and innovation. The Foundation is home to the Eclipse IDE, Jakarta EE, and over 415 open source projects, including runtimes, tools, and frameworks for cloud and edge applications, IoT, AI, automotive, systems engineering, distributed ledger technologies, open processor designs, and many others. The Eclipse Foundation is an international non-profit association supported by over 350 members, including industry leaders who value open source as a key enabler for their business strategies. In the context of community building, sustainability and open source, the Eclipse Foundation has two decades of experience managing the governance of complex technology initiatives and multi-vendor organizations, making it the ideal organization to help manage projects where academia and the private sector converge. Its commitment to transparency, vendor-neutrality, and industrial-friendly ecosystem makes the foundation an ideal starting point for an open source project. The Eclipse Foundation has 10 years of involvement in EU research programs. We help organizations to successfully create, publish, and sustain their open source software platform, making the results of the research projects available for commercial or public exploitation.

In CyberNEMO, Eclipse is leading the work package dedicated to the dissemination, communication and exploitation, with particular focus on a specific task aimed to implement the CyberNEMO open source strategy, fostering active engagement with developer communities and early adopters. Working closely with CyberNEMO consortium innovators, the task focuses on identifying relevant open source assets, developing a community-building strategy, and establishing good open source practices.

Read More

Smart Farming Meets Cybersecurity – CyberNEMO’s Role in Securing the Agri-Food Chain

As agriculture embraces digital transformation, the integration of IoT sensors, drones, blockchain, and AI is revolutionizing how food is produced, processed, and delivered. However, this digital leap also introduces new vulnerabilities. The CyberNEMO project is addressing these challenges through a dedicated trial focused on smart farming and agri-food supply chains.
The project explores how cybersecurity can enhance traceability, transparency, and trust in the production of organic olive oil—from the olive grove to the supermarket shelf.

The Use Case: From Tree to Table

The use case centers on the monitoring and auditing of organic olive oil production. This includes:

  • Growing conditions monitored by IoT sensors and drones

  • Harvesting and milling tracked via smart devices and robots

  • Bottling, storage, and transport secured through blockchain and digital twins

These technologies ensure that every step of the process is observable and verifiable, enabling stakeholders and consumers to trace the product’s journey and verify its quality.

However, the reliance on unattended, rural IoT devices introduces significant cybersecurity risks. Devices may be physically tampered with, infected with malicious firmware, or used as entry points for broader attacks 

From Cybersecurity to Trust and Sustainability

CyberNEMO’s approach goes beyond technical protection. It enables:

  • Accountability: Through audit logs and timestamped data

  • Transparency: Via blockchain-backed traceability

  • Resilience: With self-healing systems and secure federated learning

  • Compliance: With GDPR, the AI Act, and the Data Act

By embedding cybersecurity into the entire agri-food lifecycle, CyberNEMO ensures that digital farming is not only efficient but also trustworthy and sustainable.

Cybersecurity in agriculture is no longer optional—it’s essential. As food systems become smarter, they must also become more secure. CyberNEMO demonstrates how cutting-edge technologies can be harmonized with ethical and regulatory safeguards to protect both data and food integrity.

This trial offers a replicable model for cybersecure, transparent, resilient, trustworthy and ethical food supply chains, paving the way for a more sustainable agri-tech future.

Read More

Centrally Controlled IPsec (CCIPS): A newmodel for secure, programmable communication

Securing communication across distributed environments requires more than just strong cryptography, it also demands agility, programmability, and centralized control. Centrally Controlled IPsec (CCIPS) introduces a new way to deploy and manage IPsec tunnels by combining SDN principles with the I2NSF (Interface to Network Security Functions) standard.

What is CCIPS?

Traditional IPsec deployments rely on IKE (Internet Key Exchange) for tunnel negotiation. While robust, IKE can be complex to manage at scale, especially in dynamic environments. CCIPS takes a different approach: it defines an IKE-less model where a central controller provisions, manages, and monitors IPsec tunnels across the network.


This model leverages I2NSF IPsec specifications to provide:

  • Standardized interfaces for setting up security functions (e.g., VPNs, firewalls)

  • Centralized policy enforcement and lifecycle management of tunnels

  • Application-driven deployment of secure communication channels

  • The result is a flexible and interoperable framework for secure networking in modern architectures.

How it works?

The CCIPS architecture is built around two main roles:

CCIPS Controller

The central component that manages requests from applications. Translates high-level security requirements into tunnel configurations based on the IKE-less data model. Manages the lifecycle of tunnels via YANG notifications, ensuring that tunnels are created, monitored, and removed correctly.

CCIPS Agents

Network devices capable of terminating one end of an IPsec tunnel. Receive configuration parameters directly from the controller. Deploy the requested tunnels, enforce security policies, and report status updates. Generate notifications back to the controller for lifecycle management.

Why this matters

The CCIPS architecture provides significant advantages over traditional IKE-based deployments:

Centralized control: Policies and lifecycle management are coordinated through a single controller.


Scalability: Simplifies deployment in multi-cluster or multi-domain environments.

Interoperability: Built on I2NSF standards, ensuring consistency across different implementations.


Auditability: Lifecycle events and tunnel operations are logged and verifiable.

In short, CCIPS modernizes IPsec by making it programmable, centrally managed, and lifecycle-aware, an essential step toward secure and agile communication infrastructures.

Read More

Bringing trust to CyberNEMO: The Proof ofTransit component for ZTNA

In CyberNEMO, we’re building a Zero Trust Network Access (ZTNA) solution where every decision is backed by verifiable evidence. Beyond authenticating users and devices, we also need to ensure that the network paths packets take can be trusted. That’s where the Proof of Transit (PoT) component comes in.

What is the Proof of Transit (PoT)?

PoT, is a path verification mechanism. Its purpose is to guarantee that a packet has followed a predetermined route through specific nodes, providing security, traceability, and regulatory compliance.


This capability is essential in environments such as:

  • Service Function Chaining (SFC) with NFV

  • 5G and beyond network architectures

  • Critical infrastructure where packet order and integrity must be preserved

PoT ensures that packets not only arrive at their destination but also travel through the expected, authorized sequence of nodes.

How it Works?

The IETF PoT draft defines two main approaches, both based on Shamir Secret Sharing (SSS):

1.Polynomial-based distribution:

  • A polynomial of degree n–1 (where n is the number of nodes) is generated.

  • Each node receives a point on the polynomial, used to verify its participation in the path.

2.Enhanced entropy with a public polynomial:

  • An additional polynomial (with no constant term) is introduced.

  • This is combined with a random value (RND) at the ingress node, creating a cumulative value (CML).

  • The value travels across all nodes, and the final node verifies it against the expected result, ensuring no tampering occurred.

Ordered Proof of Transit (OPoT)

PoT has naturally evolved into OPoT (Ordered Proof of Transit), which not only validates the nodes traversed but also guarantees the correct sequential order. This prevents reordering attacks and is particularly critical in Real-time, sequence- sensitive systems.


OPoT achieves this by using symmetric masks shared between contiguous nodes,
ensuring both authenticity and ordering of packets.

Why this matters for ZTNA

ZTNA is about “never trust, always verify.” Proof of Transit extends this principle to the network fabric itself. By integrating PoT and OPoT into CyberNEMO, we:

  • Ensure packets take only the approved, policy-compliant paths

  • Detect tampering, misrouting, or reordering of traffic

  • Provide strong traceability and auditability of packet flows

  • Meet compliance and regulatory requirements for sensitive environments

In other words, PoT brings verifiable trust to packet transit, strengthening the Zero Trust foundation of CyberNEMO.

Read More