AI helps simplify the reporting of cyber incidents

NIS2, DORA, the GDPR, CER, the Cyber Resilience Act (CRA): there seems to be no end to the number of European directives that companies, public authorities and other organisations must comply with when faced with breaches of their computer networks. Not only are there more of them; they are also becoming increasingly complex and often overlap. As a result, a single incident may have to be reported on multiple platforms, each with its own deadlines, content requirements, formats and competent authorities. Companies and organisations therefore face significant challenges in managing these obligations efficiently and consistently.

For that reason, a number of European organisations that are active in cybersecurity have joined forces to launch the project INCIDENTRON. The aim is to develop an open-source environment and accompanying tools that help organisations determine when an incident must be reported, to whom, and what information is required. This should reduce the administrative burden while ensuring accurate, timely and legally compliant reporting of cyber incidents. 

Within the consortium, the VUB AI Lab contributes advanced artificial intelligence and data-driven methods to support decision-making in incident reporting. This is intended to ensure that information about the reported incident is presented clearly and consistently, that the criteria used to assess the notification are applied uniformly, and that the data shared with the competent authorities is reliable.

“Reporting cyber incidents is, on the one hand, a legal obligation, but on the other it causes companies and public authorities a great deal of difficulty,” says Professor Johan Loeckx of the VUB AI Lab. “By applying AI techniques, VUB helps translate fragmented regulatory requirements into structured and actionable insights that genuinely assist affected organisations, which are often under immense time pressure. This enables organisations to respond more quickly and accurately, even when incidents affect multiple countries or sectors, or have to be reported to different authorities.”

In addition to the technical platform, INCIDENTRON is also developing realistic incident scenarios and simulation-based exercises. These will enable IT and cybersecurity professionals to better prepare for incidents, respond more swiftly and potentially even prevent them.

By providing a shared European foundation for reporting cyber incidents, INCIDENTRON helps ensure that all stakeholders have greater situational awareness and can cooperate more effectively across borders. By making it easier to comply with European cybersecurity legislation, it also increases the likelihood that organisations will do so correctly.

“INCIDENTRON shows how academic research, business expertise and European institutions can come together to address a highly concrete societal and industrial need,” concludes Professor Loeckx.