As critical infrastructures continue their digital transformation journeys, the cybersecurity landscape is becoming increasingly complex. Modern environments no longer operate within clearly defined boundaries. Instead, organizations rely on interconnected cloud services, edge computing platforms, enterprise applications, industrial control systems (ICS), and cyber-physical assets that collectively support essential services.
Why traditional security validation is no longer enough
While this transformation improves operational efficiency, it also expands the cyber-attack surface. Traditional penetration testing approaches often struggle to keep pace with the scale and complexity of these distributed environments, while manual penetration testing remains resource-intensive and difficult to scale. To address this challenge, we aim to develop a penetration testing and simulation environment capable of supporting automa
Figure 1 – CIPHER OT security architecture — Zeek, Suricata and Wazuh EDR feed Threat Detection (T2.4), Vulnerability Assessment (T2.3) and Threat Intel (T2.1) into the Cipher Message Broker over AMQP 1.0; the broker feeds WP3 response, WP4 pentest, the Risk Toolbox and the Visualisation layer, with Netdata connected via MQTT.
Incident response in regional distribution networks
The message broker feeds WP3’s incident-response workflow directly off the risk-score topic, so containment doesn’t wait for someone to piece events together manually. When an incident occurs – say, a contractor’s infected laptop touching a SCADA switch at a regional treatment plant — the system generates an incident summary detailing what happened, when, and which assets were affected, which is what lets a CCO or legal team meet NIS2’s 24-hour early-warning deadline without scrambling for facts, and what keeps the utility clear of fines that can reach €10 million or 2% of global turnover. The same discipline extends to remediation: field technicians and third-party vendors no longer need a slow corporate VPN or a truck roll to fix a broken pump or update PLC logic.
Photos: AQUATIM Regional SCADA Center.
Why this matters under NIS2
Aquatim has been designated an essential entity under Annex 1 of OUG nr. 155/2024, with personal liability exposure for the executive board if controls aren’t demonstrably in place. The CIPHER pilot is built to make that risk manageable in practice: continuous detection and scanning generate the ongoing risk-monitoring evidence Article 21 expects, and the automated incident-summary workflow addresses the notification obligations that follow a confirmed breach. For OT security engineers and CISOs elsewhere in the water sector, the goal is a reference architecture rather than a theoretical compliance checklist.
Project background
The proposal was authored and submitted by Sebastian Tvein under the DIGITAL-ECCC-2024-DEPLOY-CYBER-07-LARGEOPER call, which supports EU member states in building resilience against cyber threats for large-scale industrial infrastructure. It was evaluated at 14.5 out of 15 points and confirmed as a winning proposal in late 2025. On Aquatim’s side, the project is managed by Sebastian Tvein (project manager), with Ionel Draghici as SCADA expert, Mihai Belcescu as IT expert. The diagram below maps the topology described above -sensors, message broker, and the work packages consuming its feeds – the same layout Aquatim’s team is validating against its own regional distribution network as the pilot moves from design into testing.
*To follow the three areas named in the brief directly: real-time threat detection, automated vulnerability scanning, and incident response in regional water distribution networks/SCADA
You can download the full article here