{"id":5275,"date":"2026-10-27T14:09:52","date_gmt":"2026-10-27T13:09:52","guid":{"rendered":"https:\/\/cybernemo.eu\/?p=5275"},"modified":"2026-10-29T14:32:16","modified_gmt":"2026-10-29T13:32:16","slug":"cybernemo-presented-the-latest-advancements-towards-this-within-the-framework-of-the-international-workshop-on-secure-cloud-continuum-scc-at-cloudcom-2026-paris-two-recent-demonstrations-from-the","status":"publish","type":"post","link":"https:\/\/cybernemo.eu\/index.php\/2026\/10\/27\/cybernemo-presented-the-latest-advancements-towards-this-within-the-framework-of-the-international-workshop-on-secure-cloud-continuum-scc-at-cloudcom-2026-paris-two-recent-demonstrations-from-the\/","title":{"rendered":"Two recent demonstrations from the CyberNEMO EU Horizon project address these challenges at two complementary levels at cloudcom 2026, Paris"},"content":{"rendered":"\n<p>CyberNEMO presented the latest advancements towards this within the framework of the International Workshop on Secure Cloud Continuum (SCC) at CloudCom 2026, Paris. Two recent demonstrations from the CyberNEMO EU Horizon project address these challenges at two complementary levels: stopping attacks inside the continuum, and sharing threat knowledge across Europe.<\/p>\n\n\n\n<p>Modern infrastructures no longer end at a single perimeter. The IoT\u2013edge\u2013cloud continuum spans sensors, gateways, edge nodes and cloud services, often with many different owners. Attackers exploit that complexity with coordinated kill-chains that move across layers, while defenders often lack the visibility and control interfaces to spot and stop them as they unfold. And when an incident does occur, reporting across interdependent critical infrastructures is still frequently slow, manual and siloed, even though a threat to one operator can cascade to others.<\/p>\n\n\n\n<p><strong>Closing the loop at the edge: Cybersecurity Tools as a Service<\/strong><\/p>\n\n\n\n<p>The first work, \u201cCybersecurity Tools as a Service: Closed-Loop Detection and Enforcement for the Computing Continuum\u201d, presents a Cybersecurity Tools as a Service (CTaaS) stack that closes the detect\u2013decide\u2013enforce loop:<\/p>\n\n\n\n<ul>\n<li><strong>Detect:<\/strong> two detectors, one based on telemetry fusion and one on the DNS layer, raise incidents.<\/li>\n\n\n\n<li><strong>Decide:<\/strong> a decision-support system reasons over those incidents and issues OpenC2 commands.<\/li>\n\n\n\n<li><strong>Enforce:<\/strong> three actuators act at the network (L3\/L4), application (L7) and DNS layers.<\/li>\n<\/ul>\n\n\n\n<p>All components share a single signed event bus, and detection thresholds are set relative to peers rather than fixed, so the system adapts to what \u201cnormal\u201d looks like in each context.<\/p>\n\n\n\n<p>The stack was validated on a live Farm-to-Fork smart-farming pilot, where enforcement was subsecond. Median response times were 73\u201386 ms at the DNS and application layers and 0.40 s at the network layer. Containment across all three layers at once took 0.53 s. Across 3,416 pilot incidents over 45 days, cross-detector corroboration separated a deliberate cross-layer attacker from every measured benign false positive.<\/p>\n\n\n\n<p><strong>Sharing what we learn: SAAM<\/strong><\/p>\n\n\n\n<p>Containing an attack locally is only half the story. The second work, \u201cSAAM: A Pan-European Collaborative Platform for Cyber Threat Knowledge Sharing, Risk Assessment and Incident Mitigation\u201d, was demonstrated at the SCC Workshop on Cybersecurity &amp; Cloud Continuum Demonstrations.<\/p>\n\n\n\n<p>CyberNEMO SAAM is a pan-European platform for knowledge sharing, risk assessment, threat analysis and incident mitigation. It aggregates Cyber Threat Intelligence (CTI) from European critical infrastructures, then analyzes and enriches it with an explainable AI-powered Systemic Risk Analysis Engine. Actionable intelligence is shared across governed Trusted Circles.<\/p>\n\n\n\n<p>The demo covered the full CTI lifecycle:<\/p>\n\n\n\n<ol start=\"1\">\n<li>Event ingestion<\/li>\n\n\n\n<li>Explainable cross-infrastructure risk prediction<\/li>\n\n\n\n<li>Cascading-effect simulation<\/li>\n\n\n\n<li>Coordinated multi-actor mitigation<\/li>\n<\/ol>\n\n\n\n<p>The platform is aligned with NIS2, the Cyber Resilience Act, the AI Act and the CER Directive. It aims to turn isolated incident notifications into proactive, trust-governed collaboration across Europe.<\/p>\n\n\n\n<p><strong>Two layers, one goal<\/strong><\/p>\n\n\n\n<p>Taken together, the two works show how real-time defense can be built. CTaaS gives operators fast, automated, closed-loop protection inside the IoT\u2013edge\u2013cloud continuum, with subsecond enforcement and detectors that corroborate each other to keep false positives low. SAAM lifts what is learned there into a shared, explainable, regulation-aligned view across critical infrastructures, so a threat seen by one operator can help protect many.<\/p>\n\n\n\n<p>Real-time detection and containment locally, combined with trusted intelligence sharing at European scale, is how defenders can get ahead of coordinated, cascading attacks.<\/p>\n\n\n\n<p>Thank you to the whole team for these insightful presentations and demonstrations!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CyberNEMO presented the latest advancements towards this within the framework of the International Workshop on Secure Cloud Continuum (SCC) at CloudCom 2026, Paris. Two recent demonstrations from the CyberNEMO EU Horizon project address these challenges at two complementary levels: stopping &hellip;<\/p>\n","protected":false},"author":5,"featured_media":5276,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[24,23,1],"tags":[],"cc_featured_image_caption":{"caption_text":"","source_text":"","source_url":""},"_links":{"self":[{"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/posts\/5275"}],"collection":[{"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/comments?post=5275"}],"version-history":[{"count":2,"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/posts\/5275\/revisions"}],"predecessor-version":[{"id":5278,"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/posts\/5275\/revisions\/5278"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/media\/5276"}],"wp:attachment":[{"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/media?parent=5275"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/categories?post=5275"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybernemo.eu\/index.php\/wp-json\/wp\/v2\/tags?post=5275"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}