Financial organisations operate in environments where even a short delay in understanding a cyber incident can have serious operational, financial and regulatory consequences. Detecting suspicious activity is essential, but detection alone is not enough. Once an alert has been raised, security teams must determine what happened, how the attack progressed, which systems were affected and what actions are needed to prevent a recurrence. 

This transition from detection to investigation is one of the challenges being addressed within the CyberAId project. Through the combined work of its real-time monitoring and digital forensics activities, CyberAId is developing a pipeline that transforms low-level system activity into structured evidence that can support incident reconstruction, root cause analysis and post-incident reporting. 

Seeing activity below the application layer 

Modern financial infrastructures consist of interconnected payment platforms, banking applications, authentication services and trading systems. Monitoring only the logs generated by these applications may leave important gaps in visibility, particularly when attackers attempt to bypass application-level controls or hide their activity within legitimate system processes. 

CyberAId therefore explores the use of extended Berkeley Packet Filter, or eBPF, technology to observe network and system behaviour directly from the operating system kernel. This enables the monitoring of events such as TCP connections and process executions without requiring modifications to the applications being protected. 

Within CyberAId, K3Y is developing eBPF-based monitoring tools to capture network connections and process activity in a representative financial environment. The environment includes payment-processing, banking and authentication services, together with legitimate traffic and selected attack scenarios, enabling the ongoing evaluation and refinement of the monitoring approach. 

The captured activity is transformed into structured security events containing the contextual information required for further analysis, including timestamps, process information and network communication details. Financial-specific detection rules can then identify patterns such as suspicious connections, connection bursts, unexpected process execution and potential privilege-escalation or data-exfiltration activity. 

From monitoring events to security context 

Large volumes of low-level events are only useful when they can be organised, queried and presented in a form that security teams can understand. 

Within CyberAId, K3Y is integrating the monitoring pipeline with Wazuh and OpenSearch. Events generated by the eBPF monitoring tools are processed through custom decoders and detection rules, indexed for further analysis, and visualized through dedicated dashboards. These dashboards provide an overview of event severity, activity over time, detected attack categories, and critical security events. The resulting monitoring and detection outputs can then feed CyberAId’s broader alert generation and notification workflows. 

This integration creates a bridge between kernel-level visibility and operational security monitoring. Instead of examining isolated system events, analysts can access structured information that helps them understand what activity occurred and why it may be important. 

However, an alert still represents only the beginning of an investigation. 

Reconstructing what happened 

CyberAId’s digital forensics and post-incident analysis activities build on the monitoring and detection capabilities developed within the project. Their purpose is to collect and organise relevant evidence, reconstruct incident timelines, identify root causes and map observed behaviour to recognised attack techniques. 

For example, a single suspicious outbound connection may not provide enough information to explain an incident. When combined with process execution records, authentication activity, application logs and other available evidence, it can become part of a broader narrative showing when the attack began, which actions followed and how the attacker moved through the affected environment. 

The planned forensic workflow will use structured monitoring events and detection outputs from CyberAId’s monitoring tasks, together with security knowledge models, correlated events and escalated alerts. These inputs can support the creation of reconstructed incident timelines, Root Cause Analysis outputs, MITRE ATT&CK mappings and forensic reports. 

These forensic outputs can support other CyberAId capabilities by providing structured context for incident reasoning, risk mitigation, analyst investigation and validation within the financial pilot environments. 

Financial-specific and privacy-aware investigation 

Digital investigations in the financial sector must account for more than technical accuracy. Evidence may contain personal, transactional or commercially sensitive information, while organisations must comply withrequirements related to data protection, operational resilience and incident reporting. 

For this reason, CyberAId is also considering chain-of-custody, forensic soundness and privacy-preserving evidence handling. The objective is to support thorough investigations without unnecessarily exposing sensitive business content or personal data. 

The project will further refine financial-specific forensic workflows for payment systems, banking platforms and trading infrastructures. Future work will expand the range of evidence sources, improve timeline reconstruction and root cause analysis, strengthen integration with CyberAId security knowledge models and validate the resulting workflows within the project’s pilot environments. 

By connecting low-level monitoring with structured forensic investigation, CyberAId aims to help financial organisations move beyond simply detecting suspicious activity. The goal is to provide the context required to understand incidents, respond more effectively and turn every investigation into knowledge that strengthens future cyber resilience. 

 

A payment service provider’s AI system flags a transaction as potentially linked to money laundering at 2 a.m., freezes the account, and moves on. Three days later, the client turns out to be legitimate, and the freeze causes them to miss a contractual deadline. Who answers for that: the institution, the vendor, the analyst who set the confidence threshold, or the agent itself?

This scenario illustrates the type of accountability challenge that CyberAId is addressing: agentic AI orchestrating detection, investigation, and response with a degree of autonomy that no traditional SIEM rule engine ever had. It is also precisely the kind of condition that the human oversight principles in Article 14 of the EU AI Act are designed to address, particularly where the system qualifies as high-risk.

The deadline moved. The question did not.

Until recently, 2 August 2026 was the date compliance teams were building toward  when the AI Act’s high-risk obligations, including human oversight under Article 14, were due to apply. Following the Digital Omnibus on AI, approved by the Council on 29 June 2026, those obligations have been postponed to 2 December 2027 for stand-alone high-risk systems under Annex III and to 2 August 2028 for high-risk systems embedded in regulated products.

The postponement does not affect all AI Act obligations. The transparency requirements under Article 50 remain applicable from 2 August 2026.

That is not a pause on the accountability question. DORA has been fully applicable since January 2025, with its own incident-classification duties and strict reporting deadlines  obligations the Omnibus did not touch. For major ICT-related incidents, the initial notification must be submitted within four hours of classification as major and no later than 24 hours after the institution became aware of the incident. An institution running an agentic detection layer still has to decide, today, who signs off on an automated account freeze. The regulatory clock that matters here was never the AI Act’s alone.

Why agents complicate oversight

Article 14 asks for oversight commensurate with the risks, level of autonomy, and context of use of a system. That is a manageable requirement when one model produces one output for one human to review. It is harder when a case is the aggregated result of several specialised agents one scoring transaction risk, one checking sanctions exposure, and one recommending containment  coordinated by a router that resolves conflicts between their findings.

Meaningful oversight then requires explaining not just the final recommendation, but which agent contributed what, and why. Without that, the “black box” problem stops being a technical inconvenience and becomes a compliance gap.

Bounded autonomy, not binary autonomy

The practical answer taking shape across serious agentic deployments  and highly relevant to CyberAId’s architecture  is a tiered model:

• Reversible, low-consequence actions run autonomously.
• Cases below a confidence threshold, or touching a client relationship or a large sum, escalate automatically.
• High-severity or hard-to-reverse actions  freezing an account or declaring a major incident  require explicit human sign-off first.

This does not remove accountability from the institution. It relocates the design question from “should a human be in the loop?” to “at what threshold does the loop close automatically, and on what evidence?”. That threshold is itself a governance decision. It needs to be documented and justified, not left as a default buried in a confidence-score parameter that nobody formally approved.

The deeper point

Faster detection and broader coverage are real gains from agentic AI in financial cybersecurity. But alongside the engineering, a project like CyberAId has to keep answering an institutional question: as autonomy increases, does accountability remain legible?

The answer is not that AI should never act alone. It is that every point where it does should be one the institution can identify, defend, and change before a regulator or a claimant asks why.

References

1. Council of the European Union, Digital Omnibus on AI, final approval of 29 June 2026.
2. Regulation (EU) 2024/1689 — Artificial Intelligence Act, Article 14.
3. Regulation (EU) 2022/2554 — Digital Operational Resilience Act (DORA), applicable since 17 January 2025.

 

In today’s increasingly interconnected financial ecosystem, cybersecurity has become a fundamental pillar of operational resilience. High-Frequency Trading (HFT), where trading decisions and executions occur within milliseconds, depends on the continuous availability, integrity, and confidentiality of critical systems. While speed and performance remain essential competitive advantages, they also expand the attack surface, making HFT platforms attractive targets for sophisticated cyber threats. 

As financial markets continue to evolve, ensuring that trading infrastructures remain secure without compromising performance is no longer optional, it is a strategic necessity. This challenge is at the heart of the CyberAId project, where JRC Capital contributes to the development and validation of innovative cyber-resilience solutions designed specifically for high-performance trading environments. 

Addressing the Cybersecurity Challenges of High-Frequency Trading 

Every second, high-frequency trading platforms process enormous volumes of market data, execute thousands of trades, and rely on proprietary algorithms that represent years of expertise and significant competitive value. A single disruption, unauthorized access, or manipulated data feed can quickly lead to financial losses and operational disruption. 

Protecting these highly complex environments means addressing several challenges at once. Trading algorithms must be safeguarded against theft and unauthorized access, while real-time market data needs to remain accurate, authentic, and free from manipulation. Communications between trading environments and connected platforms must be secure. At the same time, all of this has to happen without introducing the slightest delay that could affect trading performance. 

Meeting these challenges requires far more than traditional cybersecurity measures. It demands continuous monitoring, intelligent threat detection, automated risk assessment, and rapid incident response working together to keep critical systems secure while allowing trading operations to perform at their highest level. 

CyberAId: Building Smarter Cyber Resilience for Financial Markets 

The CyberAId project aims to strengthen cyber resilience through advanced threat detection and dynamic risk modelling, enabling organizations to anticipate, detect, and respond to cyber threats before they impact critical operations. 

 JRC Capital participates in the High-Frequency Trading pilot, which serves as a real-world environment for validating innovative cybersecurity capabilities tailored to financial services. The pilot demonstrates how artificial intelligence, continuous monitoring, and automated response mechanisms can enhance the protection of trading infrastructures while preserving the ultra-low latency required by modern trading systems. 

 The pilot focuses on three complementary use cases that address critical aspects of cybersecurity within high-frequency trading environments. 

 UC4.1 Protecting Trading Algorithm Intellectual Property 

 Proprietary trading algorithms represent one of the most valuable assets of any trading institution. These algorithms encapsulate years of research, market expertise, and strategic innovation, making them prime targets for cyber espionage and intellectual property theft. 

The CyberAId pilot explores mechanisms for strengthening the protection of algorithmic assets by continuously monitoring access patterns, identifying anomalous behaviour, and supporting the early detection of potential insider threats or unauthorized activities. By enhancing visibility into algorithm access and execution environments, the pilot contributes to safeguarding one of the JRC’s most strategic resources. 

 UC4.2 Monitoring the Integrity of Market Data Feeds 

 High-frequency trading decisions depend entirely on accurate and trustworthy market data. Even minor manipulation, corruption, or delays in data feeds can influence trading strategies, create market exposure, and introduce operational risks. 

To address this challenge, the CyberAId pilot evaluates intelligent monitoring techniques capable of identifying anomalies in real-time market data streams. Continuous integrity verification enables the rapid detection of suspicious deviations, helping ensure that trading decisions are based on reliable and authentic information while supporting uninterrupted trading operations. 

 UC4.3 Automating Regulatory Incident Response 

 Financial institutions operate within a highly regulated environment where cybersecurity incidents require timely investigation, documentation, and reporting. Manual response processes can delay decision-making and increase operational burden during critical situations. 

 The CyberAId pilot investigates automated incident response capabilities that support security teams by streamlining detection, prioritization, and reporting workflows. By integrating cyber threat intelligence with risk modelling, the platform facilitates faster and more consistent responses while helping organizations meet regulatory expectations and strengthen operational resilience. 

Balancing Security and Performance 

One of the defining characteristics of high-frequency trading is the requirement for extremely low latency. Any additional security mechanism must operate without introducing measurable delays that could affect trading competitiveness. 

 For this reason, the CyberAId pilot emphasizes security solutions that complement existing trading infrastructures while minimizing performance overhead. Intelligent monitoring, adaptive risk assessment, and automated response mechanisms are designed to operate seamlessly alongside trading operations, allowing cybersecurity and business performance to coexist rather than compete. This balance between resilience and efficiency represents a critical step toward building secure financial systems capable of withstanding increasingly sophisticated cyber threats. 

 Looking Forward 

 As cyber threats targeting financial markets continue to evolve, resilience must become an integral component of every trading platform. Advanced threat detection, dynamic risk modelling, and intelligent automation will play an increasingly important role in protecting critical financial infrastructures and maintaining trust in global markets. 

 Through its participation in the CyberAId project, JRC Capital is contributing to the development of next-generation cybersecurity solutions that address the unique demands of high-frequency trading. By combining innovation, operational expertise, and collaborative research, the project demonstrates how financial institutions can strengthen cyber resilience while preserving the speed, reliability, and performance that modern markets require. 

Ultimately, building resilient trading environments is not only about protecting technology, it is about safeguarding market integrity, maintaining investor confidence, and ensuring the secure evolution of digital finance. 

 

Financial institutions are among the most critical pillars of Europe's digital economy. Every day, banks process high volumes of transactions, protect sensitive customer data, and operate digital services that must remain available, trustworthy, and resilient. At the same time, the cyber threat landscape is becoming more sophisticated, with adversaries increasingly leveraging automation, artificial intelligence, and advanced evasion techniques. In this context, digital defense can no longer rely on isolated tools or reactive processes. It requires integrated, intelligent, and collaborative approaches capable of anticipating, detecting, and responding to threats at scale. 

 Against this backdrop, initiatives like CyberAId offer a practical opportunity to bring next-generation, AI-driven security mechanisms out of the research lab and into the operational reality of the banking sector. The goal is to ensure that these emerging technologies are not designed in a vacuum, but rather validated against the complex constraints, regulatory demands, and daily operations of a highly regulated environment. Ultimately, AI is not a standalone silver bullet, its true value lies in its ability to enrich security data with deep contextual intelligence supporting human analysts, drastically improving triage, and building a more coordinated defense model. 

 To achieve this, new cybersecurity tools must seamlessly align with established operational models, compliance requirements, and risk management frameworks. By engaging security teams and technical experts from day one, banks can define realistic deployment strategies to ensure AI-driven tools address actual, day-to-day challenges rather than theoretical scenarios. 

 One of the most promising applications of this technology focuses on anomaly detection and incident response. The goal is to implement integrated systems capable of neutralizing threats that target digital infrastructures and transaction environments. This approach is structured around three main pillars:  

• AI-driven context enrichment: Synthesizing information from diverse and disparate data sources to build a comprehensive, high-fidelity view of potential security events. This enriched context significantly improves threat detection accuracy and streamlines the initial triage process by distinguishing real threats from background noise. 

• Streamlined incident response: Empowering security teams through Large Language Models (LLMs) and autonomous AI agents. These intelligent agents can assist with triaging alerts, accelerating deep investigations, and executing automated countermeasures to contain threats swiftly. 

• Enterprise-wide risk visualization: Delivering a real-time, comprehensive view of the organization's overall security posture. 

 For a modern bank, integrating these capabilities into an Integrated Security Operations Center (iSOC) is paramount. The iSOC serves as the nerve center where monitoring, analysis, and response activities converge. Introducing AI into this ecosystem means augmenting human expertise with intelligent support, rather than replacing it. By automatically feeding analysts enriched contextual data, AI transforms fragmented alerts into a coherent narrative. This is crucial for managing "alert fatigue": it allows the iSOC to drastically reduce false positives so analysts don't waste time chasing ghosts while sharpening the focus on genuine, high-priority threats. Furthermore, real-time monitoring technologies grant deeper visibility into network and system behavior, driving faster detection and improved operational efficiency. 

 Beyond incident response, true cyber-resilience requires a holistic, proactive strategy. This means going a step further to incorporate measures such as AI-driven penetration testing, vulnerability assessments, privacy-preserving analytics, and secure coding practices. By unifying proactive and reactive mechanisms under an intelligent agentic orchestration layer, modern cybersecurity frameworks can tackle threats in a fully integrated, scalable manner. 

 Cybersecurity and usability are often perceived as competing objectives. The literature contains numerous examples of cybersecurity solutions that have been criticized for poor usability and user experience. Several studies highlight several conflicts between security and usability during both system design and use. From a design perspective, security is frequently treated as an afterthought and integrated late in the development process, often resulting in complex and difficult-to-use solutions. From a user perspective, security mechanisms can interrupt users’ primary tasks and workflows, whereas usability aims to support users in achieving their goals efficiently and effectively. However, rather than viewing security and usability as mutually exclusive, both are essential and should be considered jointly throughout the design process in an iterative and integrated manner.

Similarly, some studies emphasize the importance of usable cybersecurity by examining the limited visibility of security functionalities within end-user applications. Common shortcomings include security settings scattered across multiple menus and sub-menus, security-related features hidden within advanced configuration options, and interfaces that fail to clearly communicate security status or available protections. Such design issues can reduce user awareness, hinder the effective use of security features, and ultimately weaken the overall security posture of the system [1].

These findings highlight the importance of adopting user-centred approaches when designing cybersecurity solutions, ensuring that security mechanisms are not only effective but also understandable, accessible, and usable by their intended users.

CyberAId Practices: User needs & Requirements collection 

In the CyberAId project, requirements engineering and user-centred design play a central role in ensuring that the developed tools address actual cybersecurity needs within finance organisations and ensure effectives system’s usability. The CyberAId requirements engineering process follows a structured methodology that combines multiple sources of information, including:

• Financial sector cybersecurity challenges
• Pilot stakeholder needs
• Project technical objectives
• Regulatory frameworks such as DORA, NIS2, GDPR, PSD2, and the EU AI Act
• International cybersecurity standards and best practices
• Partner expertise and operational experience

By combining these perspectives, CyberAId ensures that requirements are not only technically feasible but also aligned with real-world financial-sector environments.

The requirements collected during the project are classified, reviewed, prioritised, and validated through an iterative process involving technical partners, pilot organisations, cybersecurity experts, and financial-sector stakeholders [2].

Why User stories Matter

While requirements describe what the CyberAId platform must achieve, user stories explain why specific capabilities are needed and how they deliver value to end users. They provide a user-centred perspective that helps translate technical requirements into practical functionalities aligned with real operational needs.

CyberAId adopts user stories as a means of bridging the gap between technical development and the day-to-day realities of financial-sector organizations. By capturing requirements from the perspective of the individuals who will interact with the platform, user stories help development teams better understand user goals, expectations, and challenges.

By developing structured user stories based on the needs of actual stakeholders, CyberAId ensures that the resulting solutions are not only technically robust and compliant with regulatory requirements, but also relevant, usable, and effective in addressing real-world cybersecurity challenges. This approach supports the design of solutions that enhance user experience, facilitate adoption, and ultimately contribute to stronger cybersecurity resilience across the financial sector.

Continuous Validation Through Pilot Activities

Within CyberAId, requirements and user stories are not treated as static project outputs but as living artifacts that evolve throughout the project lifecycle. As technical development progresses and pilot activities unfold, stakeholders continuously review, validate, and refine the identified requirements to ensure they remain aligned with emerging cybersecurity challenges, regulatory developments, and operational needs.

The project’s pilot environments play a crucial role in this process by providing realistic financial-sector settings in which CyberAId technologies can be evaluated and improved. Through ongoing feedback from cybersecurity professionals, operational teams, and financial-sector stakeholders, the consortium can assess whether the proposed functionalities effectively address real-world challenges related to threat detection, incident response, operational resilience, regulatory compliance, and cyber risk management.

This iterative validation approach ensures that CyberAId remains grounded in practical needs while delivering solutions that are both technically robust and operationally relevant.

Looking Ahead

The requirements baseline established in CyberAId marks the beginning of a structured journey towards a more resilient, trustworthy, and intelligent cybersecurity ecosystem for the financial sector. By translating stakeholder needs into clear requirements and user-centred functionalities, the project creates a solid foundation for the design, development, and validation of its AI-driven cybersecurity framework.

As the project advances, these requirements will continue to guide the evolution of CyberAId’s core capabilities, supporting the development of innovative solutions for proactive cyber defense, continuous monitoring, threat intelligence, incident management, and regulatory reporting.

By combining advanced cybersecurity technologies, artificial intelligence, regulatory compliance, and continuous stakeholder engagement, CyberAId aims to deliver solutions that not only strengthen the security posture of financial organizations but also enhance their operational resilience in an increasingly complex threat landscape.

References

[1] Nurse, J. R. C., Creese, S., Goldsmith, M., & Lamberts, K. (2011). Guidelines for Usable Cybersecurity: Past and Present. Proceedings of the 2011 International Conference on Cyber Security and Protection of Digital Services. Available at: https://kar.kent.ac.uk/67535/1/CSS2011_NCGL_authors_final.pdf

[2] CyberAId Consortium, D2.1 – Financial Sector Cybersecurity Requirements Analysis, Deliverable D2.1, CyberAId Project, 2026.