NIS360 evaluates the cybersecurity maturity and criticality of sectors covered by the NIS2 Directive, focusing on areas such as risk management, operational preparedness, information sharing, institutional capacity, and the resilience of sectoral ecosystems. CyberNEMO demonstrates a strong alignment with the objectives of ENISA’s NIS360 framework in several sectors that are explicitly covered by both the project’s pilot activities and the NIS360 assessment. In particular, the project addresses cybersecurity challenges in healthcare, water services, public-sector digital services, and ICT-enabled critical infrastructures through a comprehensive Zero Trust architecture spanning the IoT–Edge–Cloud–Data continuum. By integrating AI-driven threat detection, continuous monitoring, policy enforcement, risk assessment, and incident mitigation capabilities, CyberNEMO contributes directly to the enhancement of cybersecurity preparedness, operational resilience, and risk management maturity that NIS360 identifies as priorities for these critical sectors.

The alignment is particularly evident in the healthcare and water domains, which NIS360 highlights as sectors requiring sustained efforts to improve cybersecurity maturity and resilience. CyberNEMO’s solutions support secure access management, protection of sensitive operational and personal data, continuous threat monitoring, and coordinated incident response across distributed infrastructures. Through its SAAM platform, the project also strengthens collaboration, information sharing, and cyber situational awareness among stakeholders, addressing key NIS360 objectives related to ecosystem cooperation and collective resilience across critical services.

CyberNEMO validates these capabilities through dedicated pilots operating in sectors that fall within the scope of NIS360. The healthcare pilot focuses on securing access to electronic health records and healthcare information systems using Zero Trust principles and advanced cyber-defence mechanisms. The energy pilot addresses the protection of operational technologies and critical service infrastructures against cyber threats, while cross-organizational federation scenarios demonstrate secure collaboration, threat intelligence exchange, and coordinated incident management among critical-sector stakeholders. These pilots provide practical evidence of how CyberNEMO technologies can support the improvement of cybersecurity maturity in sectors that NIS360 identifies as strategically important for the resilience of the European Union.

In order to understand why Europe’s approach to edge security looks different from the rest of the world, it is necessary to start with the regulation. Unlike the US market, where security investment is primarily driven by competitive pressure and incident response, Europe follows a “regulation-first” adoption curve — and two pieces of legislation are currently redefining what that means in practice.

The NIS2 Directive and the Cyber Resilience Act (CRA) are not simply compliance checkboxes. They are market forces. NIS2 converts cybersecurity from a technical option into a boardroom imperative with personal liability for executives. It also mandates supply chain security, meaning operators must ensure the integrity of every connected device in their network — not just their own perimeter. This is a significant expansion of scope: in an edge environment, where a single factory floor can host hundreds of connected sensors and controllers from dozens of vendors, tracing and verifying the security posture of every component is an enormous operational challenge. It is also, notably, the exact kind of challenge that creates demand for standardised, certifiable security solutions.

The CRA goes further. It requires “security by design” and mandates that vendors provide security updates for the entire expected product lifetime of a device. For manufacturers of low-cost IoT hardware — the category of devices most commonly deployed at the edge — this creates a near-prohibitive barrier. The economics of a €15 sensor do not readily support a 10-year software maintenance cycle, which means the CRA will likely consolidate the IoT vendor market toward larger players capable of absorbing that obligation.

The second structural shift reshaping the market is the convergence of IT and OT. Historically, industrial networks were “air-gapped,” physically isolated from the internet. Industry 4.0 has ended that era. Connecting factory machinery to the cloud for predictive maintenance and real-time analytics means that legacy OT systems — often running outdated, unpatchable operating systems — are now reachable from the public internet. The attack surface has expanded from corporate email servers to robotic arms on assembly lines, and the consequences of a breach have shifted from data loss to potential physical disruption of production.

The market response is moving toward micro-segmentation and Virtual Network Functions (VNFs) to recreate “virtual air gaps” in software — maintaining operational connectivity where needed while isolating critical systems from broader network exposure.

Taken together, these regulatory and technical pressures are fostering a uniquely European ecosystem of “Sovereign Edge” providers — companies aligned with initiatives like Gaia-X that prioritise data residency and immunity from extraterritorial laws (such as the US Cloud Act) over pure scalability. Regulation, in other words, is not slowing the market. It is shaping who wins it.