How Artificial Intelligence is Reshaping Cybersecurity

Last week, Irish consumers were warned that a range of household devices, including TV “dodgy boxes”, could be secretly controlled by cybercriminals. Millions of these devices worldwide — including smart light bulbs, TVs, and other internet-connected gadgets — are susceptible to such attacks. Once inside your home network, attackers can monitor online activity and send fake messages that appear convincingly real.

This is just one example of how quickly cyber threats are evolving. Critical infrastructures — such as hospitals, energy grids, and government services — are under constant attack. In response, researchers and policymakers are turning to artificial intelligence (AI) to strengthen digital defences.

One of the most ambitious initiatives in this area is the EU-funded SYNAPSE project, a collaboration of 14 partners across eight countries. SYNAPSE aims to deliver an integrated risk and resilience management platform that provides holistic Situational Awareness (SA), cyber-incident response, and training and preparedness capabilities to safeguard critical environments. The platform is designed to detect cyber threats early, predict potential attacks, and guide security teams on how to respond effectively.

To achieve this, SYNAPSE uses three powerful AI tools — explained here in simple terms.

First, the platform learns what “normal” looks like within an organisation: how users log in, which files they access, and how devices communicate. When something deviates from this baseline, it raises an alert.

Second, another component continuously scans global cybersecurity reports, databases, and open sources. It is like having an AI system that reads every cybersecurity article and threat bulletin worldwide and instantly identifies emerging risks relevant to your organisation.

Third, the system connects different warning signals to forecast potential attacks before they fully unfold. It not only detects threats — it also recommends response strategies, helping security teams react faster and more effectively.

These systems are currently being validated in real-world environments, including a hydrogen energy station in Germany, Cyprus’s National Healthcare System, and a cyber-insurance company in Greece.

But building powerful AI is only half the story. Whenever AI is deployed, strong ethical governance is essential. Eunomia Ltd, an Irish company, acts as the ethics and legal partner, ensuring that regulatory compliance, fundamental rights considerations, and trustworthy AI principles are embedded throughout the project lifecycle.

Europe’s new EU Artificial Intelligence Act (AI Act), which entered into force last year, classifies AI systems depending on the risk they pose for safety and fundamental rights and tailors the level of the intervention to the level of risk. The most regulated systems are the high-risk AI systems, which are those that may significantly affect individuals’ safety or fundamental rights.

Typical examples include AI used in employment and HR decisions (e.g., CV screening), access to education (e.g., exam scoring), creditworthiness and access to essential services (e.g., loan approvals), migration and border management (e.g., risk profiling), and certain law-enforcement or critical infrastructure uses.

This classification triggers strict requirements, including robust risk management systems, human oversight mechanisms, transparency and documentation, technical robustness and accuracy, continuous monitoring and post-deployment evaluation. In parallel, the General Data Protection Regulation (GDPR) continues to regulate how personal data may be processed, including in the context of automated monitoring.

While the AI Act does not apply directly to research-stage systems, responsible projects must anticipate these requirements. For this reason, SYNAPSE is being evaluated based on the EU’s Assessment List for Trustworthy Artificial Intelligence (ALTAI) — a voluntary but influential framework developed by the European Commission’s High-Level Expert Group on AI, to help stakeholders assess their systems against the ethics requirements for Trustworthy AI, which were then translated into legal requirements by the AI Act.

However, ALTAI — while valuable — has recognised limitations. It relies heavily on qualitative questions and subjective assessments without providing specific metrics or benchmarks, making objective evaluation and comparison challenging. As a general framework designed to apply across all AI domains, it lacks sector-specific guidance tailored to particular application contexts.

ALTAI raises important questions but does not provide concrete instructions on how to achieve its objectives. It offers limited practical steps, methodologies, or technical solutions for addressing complex challenges such as algorithmic bias or improving the interpretability of deep learning models.

Moreover, it does not offer guidance on resolving potential trade-offs between ethical principles — for example, when enhancing transparency (explainability) may reduce model accuracy. The framework focuses primarily on the design and development phase, with less attention given to deployment, monitoring, and maintenance. As a result, dynamic issues such as performance degradation over time (model drift) are not sufficiently addressed.

Overall, while ALTAI promotes valuable interdisciplinary reflection, it is resource-intensive, complex to implement, and requires sustained dialogue across technical, legal, and ethical disciplines. At the same time, technological maturity in areas such as bias detection and fairness assessment remains limited, making some of its aspirations difficult to operationalise in practice.

Rather than treating ALTAI as a compliance tick-box, SYNAPSE applies the framework throughout the entire project lifecycle. All partners — technical, legal, and ethical — contribute to answering the assessment questions, identifying risks, and discussing practical solutions. In doing so, SYNAPSE not only prepares its solutions for future regulatory obligations but also contributes to the EU’s broader objective of developing secure, trustworthy, and human-centric AI systems that strengthen the resilience and sovereignty of Europe’s digital infrastructure.

More information is available here: www.synapse-project.eu