DIGITAL-ECCC-2024-DEPLOY-CYBER-06-ENABLINGTECH

SAFE - Security AI for Enhanced SOC

Security AI for Enhanced SOC

Enabling technologies and Artificial Intelligence for Security Operations Centres: a European platform that automates analysis, generates original threat intelligence and shares it with the community.

Jan 2025 - Dec 2027
Grant No. 101190370
12 partners · 8 countries
Digital Europe Programme · ECCC
Explore the project The SAFE consortium
Co-funded by the European Union ECCC - European Cybersecurity Competence Centre

About SAFE

Artificial Intelligence in support of
Europe's SOCs

SAFE - Security AI for Enhanced SOC is a 36-month European project co-funded by the European Union through the Digital Europe Programme and supported by the European Cybersecurity Competence Centre (ECCC), under grant agreement No. 101190370. Coordinated by Eviden Technologies (Romania), the consortium brings together 12 partners from 8 countries: technology companies, public cybersecurity and defence authorities, and universities.

Project objective

Threat intelligence sharing and situational awareness are paramount for swift detection and decision-making.

Threat actors are proliferating at an unprecedented pace across verticals. SAFE optimises CTI creation and analysis through enabling technologies for Security Operations Centres.

  • Battle Control Center

    AI-assisted incident response.

  • Analysis Environment

    Detonates malware, analyses samples and feeds results to the other components.

  • Distribution TIP

    Enriches and distributes threat intelligence.

  • Network acquisition and response

    More visibility into incidents on the supported assets.

Scope

Automate the initial steps of malware or forensic analysis as much as possible, to generate and distribute original threat intelligence with the help of AI.

EU Funding & Tenders PortalOfficial fact sheet · 101190370
CYDERCO2023 - 2026 SAFE2025 - 2027

SAFE continues and extends the results of the CYDERCO project (DIGITAL-ECCC-2022-CYBER-03-SOC).

The challenge

Threat actors multiply faster than incidents can be analysed. SOCs need visibility, speed of analysis and threat intelligence they can share in time.

The approach

An integrated platform that uses AI and dynamic learning to adapt continuously to the threat landscape and brings information from every layer into an intuitive interface for analysts.

Continuity

SAFE builds on the results of the CYDERCO project (DIGITAL-ECCC-2022-CYBER-03-SOC) and takes them further, towards automated analysis and original CTI for national and private SOCs across the EU.

36M
Project duration (months)
€8.0M
Overall budget (50% EU)
12/8
Partners / countries
9
Work packages

Specific objectives

Four components, one platform

The platform extracts and centralises information from multiple layers into an intuitive interface, using AI and dynamic learning to adapt continuously to the evolving threat landscape.

01 · XDR

Extended Detection and Response

An XDR component that improves detection and response during cybersecurity incidents, using network-based data acquisition and response for better visibility into the protected assets.

DetectionResponseAI / ML
02 · SANDBOX

Isolated malware detonation

The Analysis Environment detonates malware in a strictly controlled, isolated environment, analyses submitted samples and safely extracts raw intelligence, feeding it back to the other components.

Malware analysisDetonationAutomation
03 · RBVM

Vulnerability management

A module that manages vulnerabilities on the targeted assets and prioritises them by factors such as active exploits or a public proof of concept, giving each one a risk score.

Risk scoringExploit intelPrioritisation
04 · TIP

Threat Intelligence Platform

The Distribution Threat Intelligence Platform lets organisations use and share CTI through a portal for searching indicators, and distributes intelligence through feeds to enable preventive action.

CTI sharingIoC searchFeeds

Platform architecture

From raw data to actionable intelligence

Each layer of the platform feeds the next: from data acquisition and traffic analysis through to distributing threat intelligence to the community.

WP301/04

Data acquisition and network traffic

Collects and analyses network traffic and responds directly at network level (XDR).

OutputNetwork telemetry

WP4 · WP502/04

Battle Control Center

AI-assisted incident response, data enrichment and risk-scored vulnerabilities.

OutputPrioritised incidents

WP603/04

Analysis Environment

Detonates malware in isolation, analyses samples and extracts raw intelligence.

Results are fed back to the Control Center

OutputArtefacts and IoCs

WP704/04

TIP distribution

CTI repository for analysts and feeds that reach organisations for preventive action.

OutputCTI feeds

AI layer Artificial Intelligence and dynamic learning across all four stages, adapting continuously to the threat landscape WP8 · integration and pilot validation

Work plan

Nine work packages

01
Project management and coordination
Management
02
Stakeholder analysis and component specification
Requirements
03
Data acquisition and network traffic response
Technical component
04
Risk-based vulnerability management
Technical component
05
Battle Control Center
Technical component
06
Analysis Environment
Technical component
07
TIP distribution (Threat Intelligence Platform)
Technical component
08
Platform integration and pilot validation
Integration · Pilot
09
Dissemination, communication and exploitation
Impact
Management and requirements Technical components Integration and pilot Dissemination
202520262027
Start: 1 January 2025 Month 21 / 36 · 58% End: 31 December 2027

Consortium

12 partners from 8 European countries

Technology companies, public cybersecurity and defence authorities, and universities, coordinated by Eviden Technologies.

Click a category to filter the partners

Romania

Eviden Technologies

EVIDEN
Portugal

ISEP (Instituto Superior de Engenharia do Porto)

ISEP
Romania

National Cyber Security Directorate

DNSC
Greece

Diadikasia

DBC
Luxembourg

Netcompany

NCIS
Greece

Infalia

Infalia
France

Université de Pau et des Pays de l'Adour

UPPA
Czechia

DataSentics

DataSentics
Greece

Hellenic Ministry of National Defense

HMoD
Spain

Agència de Ciberseguretat de Catalunya

ACC
Poland

Atos Poland Digital Services

EVIDEN-PL
Spain

Advanced Computing Spain

Bull

Official consortium order. The EU contributions of the 12 partners add up to €3,954,760.31 of the €3,999,105.21 grant (the €44,344.90 difference went to Atos IT Solutions and Services Iberia, whose participation has ended). Source: EU Funding & Tenders Portal.

Budget and duration

Co-funded by the European Union

Project budget

50%EU
Overall budget€7,998,210.41
EU contribution€3,999,105.21
Partner co-financing€3,999,105.20
50%

EU funding rate

€329,563

Average EU contribution per partner

Co-funded byCo-funded by the European Union
Supported byECCC - European Cybersecurity Competence Centre

EU contribution by country

RO
Romania · 2 participants42.0%
GR
Greece · 3 participants15.1%
PL
Poland · 1 participant11.1%
ES
Spain · 2 participants8.8%
CZ
Czechia · 1 participant7.7%
LU
Luxembourg · 1 participant7.6%
PT
Portugal · 1 participant4.3%
FR
France · 1 participant3.4%
Grant agreement 101190370 DIGITAL-ECCC-2024-DEPLOY-CYBER-06-ENABLINGTECH Ongoing
  • ProgrammeDigital Europe (DIGITAL)
  • Granting authorityECCC
  • Type of actionDIGITAL JU Simple Grants
Duration · 36 months
01.01.202531.12.2027
Coordinator
Eviden Technologies SRL

SAFE Newsletter

News and newsletter

Milestones, events and results from the SAFE consortium - read each issue like a book, or download the PDF.

Contact

Stay connected with SAFE

For news, project results and collaboration requests, get in touch with the SAFE consortium on LinkedIn.

Follow SAFE on LinkedIn
Contact SAFE EU Community linkedin.com/company/safe-eu
Official source EU project fact sheet EU Funding & Tenders Portal · 101190370