Over the past six months, the INTACT project has built the foundation for a forward-looking
cybersecurity framework that emphasises prediction, scalability, and energy efficiency.
Funded by the European Union under Horizon Europe, INTACT aims to develop an
Integrated Software Toolbox that enhances cybersecurity management and threat sensing
across the IoT-to-Cloud continuum. At its core, the project combines advanced AI, zero-trust
identity and access management, and digital twin technology, with real-world deployments
across sectors such as telecommunications, healthcare, transport, and nuclear
infrastructure.
Digital Twins
A key innovation of the project is the use of digital twins – virtual replicas of systems and
processes that allow cyber scenarios to be modelled, tested, and optimised in isolation. Our
partners from the Fraunhofer-Institut für Produktionsanlagen und Konstruktionstechnik
(IPK) are leading the development of the Digital Twin cybersecurity toolbox, which will serve
as a modular and integrated environment for cybersecurity tools contributed by partners
across the consortium. To ensure these twins are both relevant and effective, Fraunhofer
IPK’s team began by analysing the specific needs of each pilot use case: healthcare,
communication, transport network, and a nuclear reactor. This involved identifying how users
interact with their systems in each domain, and what cybersecurity goals and constraints
guide their daily activities.
Through interviews and architecture analysis, the team models user behaviours and
translates them into functional requirements for the digital twins. These requirements will
serve as the foundation for designing the necessary software functions and ensuring that the
digital twins can operate effectively within their respective domains. Ultimately, this process
guarantees that the toolbox will not only be technically robust but also tailored to the
operational realities of its intended users.
Network Fuzzers
Montimage, one of our consortium partners, has developed an open-source network fuzzer,
which plays a key role in testing network resilience against cybersecurity threats. A network
fuzzer works by sending modified data packets across a network to observe how the
infrastructure responds. For example, if a router crashes after receiving a malformed packet,
this reveals a potential vulnerability. By deliberately altering packet characteristics such as
size, content, or format, we can gain insights into the network's weaknesses and assess the
effectiveness of our defences. The way packets are modified is defined by a set of rules.
New approaches to traffic generation and rule creation are developed in the scope of the
project. Montimage has already implemented a large language model (LLM)-based
component that generates fuzzing rules from simple prompts. Fraunhofer team will
contribute to a generative adversarial network (GAN)-based module, which focuses on
creating realistic synthetic traffic that resembles valid packet flows. This synthetic data
enhances the diversity and coverage of testing scenarios, enabling deeper evaluation of
network robustness.
Integration efforts
As the integration lead, Fraunhofer IPK has been instrumental in aligning the technical
components of the toolbox. During this first phase, their focus has been on identifying and
analysing the cybersecurity tools already available across the consortium. Simultaneously,
they have been mapping the architecture of each pilot use case, including data flows, key
processes, and end-user roles. To bring these technical insights into focus, they are
developing detailed user stories that describe how various stakeholders interact with their
systems and what cybersecurity outcomes are necessary in each context. This effort
provides a strong functional blueprint that will guide the architecture of the toolbox as it
moves toward implementation.
The path forward
Looking ahead, the next phase of the project will involve the concrete design and
development of the system architecture, followed by the integration of the digital twin
components and cybersecurity tools into a cohesive platform.
The INTACT toolbox will undergo validation in a lab testbed environment before being
deployed in real operational settings at TRL7 across all four pilot sectors. With a focus on
open standards, EU-wide data integration (such as GAIA-X and IDSA), and energy-efficient
design, the INTACT project is not only addressing today’s cybersecurity needs but also
aligning with broader European priorities around digital sovereignty, sustainability, and
economic resilience.
As we move forward, the foundation built during these first six months will enable the
INTACT consortium to deliver a transformative cybersecurity platform – one that empowers
industries to stay ahead of evolving threats while minimising their operational and
environmental impact.
