CyberNEMO presented the latest advancements towards this within the framework of the International Workshop on Secure Cloud Continuum (SCC) at CloudCom 2026, Paris. Two recent demonstrations from the CyberNEMO EU Horizon project address these challenges at two complementary levels: stopping attacks inside the continuum, and sharing threat knowledge across Europe.

Modern infrastructures no longer end at a single perimeter. The IoT–edge–cloud continuum spans sensors, gateways, edge nodes and cloud services, often with many different owners. Attackers exploit that complexity with coordinated kill-chains that move across layers, while defenders often lack the visibility and control interfaces to spot and stop them as they unfold. And when an incident does occur, reporting across interdependent critical infrastructures is still frequently slow, manual and siloed, even though a threat to one operator can cascade to others.

Closing the loop at the edge: Cybersecurity Tools as a Service

The first work, “Cybersecurity Tools as a Service: Closed-Loop Detection and Enforcement for the Computing Continuum”, presents a Cybersecurity Tools as a Service (CTaaS) stack that closes the detect–decide–enforce loop:

• Detect: two detectors, one based on telemetry fusion and one on the DNS layer, raise incidents.
• Decide: a decision-support system reasons over those incidents and issues OpenC2 commands.
• Enforce: three actuators act at the network (L3/L4), application (L7) and DNS layers.

All components share a single signed event bus, and detection thresholds are set relative to peers rather than fixed, so the system adapts to what “normal” looks like in each context.

The stack was validated on a live Farm-to-Fork smart-farming pilot, where enforcement was subsecond. Median response times were 73–86 ms at the DNS and application layers and 0.40 s at the network layer. Containment across all three layers at once took 0.53 s. Across 3,416 pilot incidents over 45 days, cross-detector corroboration separated a deliberate cross-layer attacker from every measured benign false positive.

Sharing what we learn: SAAM

Containing an attack locally is only half the story. The second work, “SAAM: A Pan-European Collaborative Platform for Cyber Threat Knowledge Sharing, Risk Assessment and Incident Mitigation”, was demonstrated at the SCC Workshop on Cybersecurity & Cloud Continuum Demonstrations.

CyberNEMO SAAM is a pan-European platform for knowledge sharing, risk assessment, threat analysis and incident mitigation. It aggregates Cyber Threat Intelligence (CTI) from European critical infrastructures, then analyzes and enriches it with an explainable AI-powered Systemic Risk Analysis Engine. Actionable intelligence is shared across governed Trusted Circles.

The demo covered the full CTI lifecycle:

1. Event ingestion
2. Explainable cross-infrastructure risk prediction
3. Cascading-effect simulation
4. Coordinated multi-actor mitigation

The platform is aligned with NIS2, the Cyber Resilience Act, the AI Act and the CER Directive. It aims to turn isolated incident notifications into proactive, trust-governed collaboration across Europe.

Two layers, one goal

Taken together, the two works show how real-time defense can be built. CTaaS gives operators fast, automated, closed-loop protection inside the IoT–edge–cloud continuum, with subsecond enforcement and detectors that corroborate each other to keep false positives low. SAAM lifts what is learned there into a shared, explainable, regulation-aligned view across critical infrastructures, so a threat seen by one operator can help protect many.

Real-time detection and containment locally, combined with trusted intelligence sharing at European scale, is how defenders can get ahead of coordinated, cascading attacks.

Thank you to the whole team for these insightful presentations and demonstrations!

CyberNEMO as part of the ECSCI cluster participated in the 2026 ECSCI cluster Webinar series aiming to empower the cross-project collaboration and promote the work carried out within the participating projects to a wider audience. In this context, Andreas Papadakis, representative of Synelixis the Project Coordinator of CyberNEMO, presented the project’s objectives and status within the framework of the second webinar of the ECSCI webinar series.

The key points that were stressed out throughout the presentation were:

• The key enablers of CyberNEMO.
• The challenges the project aims to address.
• The CyberNEMO components & their functionalities towards providing a concrete and concealed protection across the various functionalities of a modern ICT-CC platform.
• The importance of the existence of a well-built Risk assessment mechanism & a well established risk methodology.
• The validation domains that CyberNEMO framework is validated as well as the cross-domain CTI exchange through the SAAM platform.

The CyberNEMO consortium is meeting this week in Fornebu, Norway, for its 7th General Assembly, hosted by DNV.

This plenary gathering represents an important moment in the project’s evolution, bringing together partners to review progress, align on next steps, and reinforce collaboration across the consortium in the 2nd half of the project.

Discussions during the meeting focus on key areas such as AI-driven cybersecurity, risk assessment and mitigation, system integration, and validation of technologies in complex IoT–Edge–Cloud environments. The sessions also address the project’s broader impact, including dissemination, standardisation, and engagement with stakeholders.

A central objective of this General Assembly is to advance the integration of CyberNEMO components into a cohesive framework, moving from individual developments toward interoperable and scalable solutions for securing critical infrastructures.

Beyond the technical work, the meeting provides a valuable opportunity to strengthen collaboration, ensuring alignment and continuity as the project progresses toward its next milestones.

CyberNEMO partners (Synelixis and Maggioli) attended the webinar on Privacy-Enhancing Technologies for Information Security in Edge-Cloud Applications, organized by CEI-Sphere and Large Scale Pilots O-CEI and COP-Pilot.

The webinar explored the growing challenge of securely sharing and processing data across distributed environments, from industrial platforms to smart infrastructures, where large numbers of devices, man-in-the-middle threats, and purpose limitation requirements create complex security landscapes. Protecting sensitive data today goes well beyond personal data as business data sovereignty is equally at stake.

Presentations from Fraunhofer ISST and insights from the O-CEI and COP-PILOT Large-Scale Pilots highlighted how technologies such as Federated Machine Learning (FML), Trusted Execution Environments, Homomorphic Encryption, and Zero-Knowledge Proofs can be embedded directly into system design. The “black sheep problem” in FML, identifying and mitigating malicious or corrupted participants in federated learning, is a as a shared concern directly relevant to CyberNEMO’s work on ZT-FML.

CyberNEMO identified synergies in two areas a) the Zero-Trust Federated Machine Learning (ZT-FML) and b) the use of LLMs and MCP-based architectures for privacy-aware decision support functionality.

The CyberNEMO project was present in the 3^rd meeting of the European Cybersecurity Cluster along with INTACT, CASTOR, and MIRANDA following the meeting that took place on January 16^th. This strategic gathering was scheduled to review the projects’ updates since their last meetup and align the shared goals of these leading EU-funded initiatives.

Among the various topics discussed, for CyberNEMO, the presentation of the CyberNEMO Decision Support component was an important milestone. In addition, the projects demonstrated significant interest in co-organizing a workshop in Paris this fall.

The exchange was further enriched by the introduction of three new projects to the cluster: Mediate, CoCyber and GuardAI, expanding the group’s collective expertise in securing the digital landscape.

From April 21 to April 23, 2026, in Brussels, Belgium, OCX gatherd open-source professionals, developers, architects, researchers, and industry leaders to explore the technologies, standards, and collaboration models shaping the future of open innovation.

CyberNEMO participated in the collocated event Open Community for Research .

The CyberNEMO consortium is meeting this week in Rome, Italy, for its 6th General Assembly, hosted by Engineering Ingegneria Informatica.

This plenary gathering represents an important moment in the project’s evolution, bringing together partners to review progress, align on next steps, and reinforce collaboration across the consortium in the view of the upcoming 1st half review.

Discussions during the meeting focus on key areas such as AI-driven cybersecurity, risk assessment and mitigation, system integration, and validation of technologies in complex IoT–Edge–Cloud environments. The sessions also address the project’s broader impact, including dissemination, standardisation, and engagement with stakeholders.

A central objective of this General Assembly is to advance the integration of CyberNEMO components into a cohesive framework, moving from individual developments toward interoperable and scalable solutions for securing critical infrastructures.

Beyond the technical work, the meeting provides a valuable opportunity to strengthen collaboration, ensuring alignment and continuity as the project progresses toward its next milestones.