The PHOENi²X project started in 2022 with the aim of designing and developing Artificial Intelligence-assisted solutions that can protect our infrastructures, using incident response and recovery, and information exchange automation capabilities to enhance business continuity and the resilience of critical infrastructures, in alignment with national and EU cybersecurity priorities. 

After three years, June 2025 marked the completion of this project funded by Horizon Europe, the European Union’s Framework Programme for research and innovation, with a final plenary meeting held in Nicosa, Cyprus, hosted by the Cyprus Digital Security Authority. 

The project consortium was formed by partners from Cyprus, Germany, Greece, Ireland, Norway, and Spain, among them security companies, research institutes, operators of essential services and national authorities like the National Cybersecurity Authority of Greece. 

The project included three real use cases (Energy, Transport, Health) where PHOENi²X developments have been integrated, demonstrated and validated. The use cases involve two Operators of Essential Services, a provider in the supply chain of an Operator of Essential Service, a Telecom Operator and two National Cybersecurity Authorities.

Worldsensing deployed IoT sensors in a relevant rail environment, contributed to the validation and evaluation of the PHOENi²X solution for OT systems, and was in charge of defining innovation management. Besides these tasks, Worldsensing provided the IoT testbed for the integration and validation of the cybersecurity tools developed in the project for the transport use case.

Real use case in a railway metropolitan commuting line 

Rail infrastructure operators face challenges when operating their infrastructure, as they need to ensure safe operations using resources efficiently. One possible approach is to monitor such critical infrastructures continuously to ensure safety and improve maintenance activities. But the deployment of sensors across the infrastructure may introduce new attack vectors into existing OT/IT infrastructure, which can impact other systems. Such attack vectors may affect data and availability of sensors, and also the robustness of the software platform in charge of managing the deployed sensors. The integration of PHOENi²X into deployments of OT monitoring solutions ensures the cyber-robustness of it.

The transport use case involves the deployment of PHOENi²X services for a digital railway infrastructure, improving the proactive strategy to predict cyber-attacks, identifying and isolating security and safety threats of train operations by dividing the system in 3-layers: data collection, data processing, and data analytics. This deployment was carried out in cooperation with Ferrocarrils de la Generalitat de Catalunya​, a rail operator and infrastructure owner in Catalonia​, Spain. 

The technology developed in the project was implemented on a railway section of the metropolitan line around Barcelona, used for daily commuting to the city. In this area Worldsensing technology monitors the stability of the slope along the railway with a remote monitoring system composed of four digital data loggers, one analog data logger and one solar-powered gateway. 

Worldsensing digital loggers collect data from 30 IPI (in-place inclinometers) and load cells installed in the monitored area. All data is managed via Worldsensing CMT cloud platform, providing comprehensive control over the deployed networks and 24/7 data access to assess network performance at all times.

Cybersecurity of an operational technology (OT) solution validated 

Besides monitoring slope stability and other elements that could compromise the security of railway infrastructure, on the operational technology (OT) side, transport operators must also ensure that transport systems are functioning properly from an information security perspective. Sensors monitoring security parameters are used for this purpose, considering data security and integrity for the entire end-to-end IoT solution, as well as the cyber robustness of the OT software suite supporting device and network management, alert generation and data integration.

The solution developed in PHOENi²X has the capacity to detect cyberattacks that can impact the operator decision making. It addresses standard attack types such as data tampering, denial of service and privilege escalation. As an advanced feature, the system uses an AI-based anomaly detection mechanism to identify data tampering and denial-of-service attacks through analysis of resource usage patterns. The following phases are considered:

• Prevention and preparedness: includes continuous monitoring on data and metadata collection from the IoT infrastructure
• During the attack phase: focuses on detection and incident handling with automatic recovery actions
• Post attack phase: covers incident management and reporting to authorities, and business continuity and post-attack training

Additionally, the playbook outlining the workflow to follow when an attack occurs has been automated. According to the defined flow, when an incident is detected, the designated user is identified and the agreed actions are automatically triggered. Once the attack is resolved, all necessary actions to ensure business continuity are also carried out based on predefined automated rules.

“We deployed and validated the solution developed in PHOENi²X using a hybrid approach, both on-premise and in the cloud. This strategy is designed to ensure the cyber robustness of OT solutions supporting critical infrastructure operations.” Ignasi Garcia-Milà, Innovation Project Manager. 

Towards a more resilient transport sector

The PHOENi²X project has delivered a comprehensive, AI-powered cybersecurity solution that strengthens the resilience of critical infrastructure operators in the transport sector. Among the key benefits demonstrated during the project are:

• Improved data integrity: PHOENi²X enhances knowledge data integrity across vertical IoT systems in critical infrastructure environments.
• Enhanced IoT stability: By leveraging open-air radio communications, PHOENi²X improves the operational stability of connected IoT devices. 
• Real-world IoT testing: The solution has been successfully deployed and validated under real-world conditions in railway infrastructure monitoring. 
• Threat visualization for operations: PHOENi²X enables the integration of cyber-threat visualization directly into operational control rooms, improving situational awareness and incident response capabilities.

This robust approach helps prevent potential intrusions before they can cause damage and enhances the remote monitoring system’s resilience in the event of an attack. By continuously adopting the latest technologies, particularly AI-driven tools, Worldsensing remains committed to anticipating evolving threats and boosting cyber robustness in the transport and other industry sectors. 

This project has received funding from the European Union’s Horizon Europe Framework Programme for research and innovation under grant agreement No. 101070586.