e2e-assure запустила Cumulo — первую в Великобритании суверенную AI-платформу SOC для IT и OT

British company e2e-assure has presented an updated Cumulo platform — the first sovereign SOC service powered by artificial intelligence in the United Kingdom. The product protects both corporate IT infrastructure and industrial OT systems from zero-day threats — and is a direct response to GCHQ's initiative to create a national AI Cyber Shield.

How the Cumulo Platform Works

Cumulo operates on a SOC-as-a-service model: an organization receives a full-fledged security monitoring center without the need to hire its own team of analysts and build infrastructure from scratch. The key difference from traditional managed SOCs is that all detection logic is built not on rules and signatures, but on artificial intelligence models.

The architecture rests on two components. First — digital twins: the platform creates a virtual model of each client's infrastructure and continuously compares the real network behavior with the reference state of the twin. Any sustained deviation — a signal of a potential threat — is analyzed before it develops into a full-fledged incident. This approach allows the transition from reactive to proactive defense: an attack is detected at the reconnaissance or initial intrusion stage.

The second component — dedicated AI models for each customer. Traditional SIEM systems apply uniform detection rules to all clients. Cumulo trains a separate model on the specific organization's data, which reduces the number of false positives and allows more accurate detection of anomalies specific to that environment.

Sovereignty and the GCHQ Initiative

E2e-assure's principal position is that client data is processed exclusively within British jurisdiction and is not transmitted to third-party clouds, including infrastructure from American providers. This is what the company calls platform "sovereignty."

GCHQ has announced the AI Cyber Shield program — a government initiative to strengthen critical infrastructure cybersecurity through AI. The program imposes the requirement for sovereign data processing for systems operating on sensitive facilities. Cumulo is directly positioned as a solution meeting this requirement.

According to e2e-assure, the platform provides:

• Detection of zero-day threats before they materialize into incidents
• Unified monitoring of IT networks and OT systems (SCADA, industrial control systems, process control automation)
• British jurisdiction — data does not leave the controlled environment
• Personal AI models for each customer
• As-a-service format — without building your own SOC

Why IT and OT Need to Be Protected Together

Industrial control systems (OT) were historically built as isolated networks — without connection to the internet or corporate resources. But over time, enterprises began integrating factories and power systems with corporate networks for remote management, monitoring, and analytics. The boundary between IT and OT blurs.

This has created a persistent class of threats. Attackers penetrate through the IT perimeter — via phishing, vulnerable VPN, compromised contractor — and then move into the OT segment. That is where the greatest damage occurs: production stoppage, accident at an energy facility, disruption of critical infrastructure.

Attacks on industrial facilities in Europe and North America in recent years have formed a consistent pattern: the entry point is always IT. Separate SOC solutions for IT and OT create blind zones at the transition points between segments. Cumulo sees both layers in a unified security context: AI tracks the entire attack chain from the beginning — still in the corporate network — before the threat reaches critical industrial assets.

What This Means

The launch of Cumulo is part of a broader trend: European governments and regulators are increasingly demanding sovereign AI solutions in cybersecurity. For the SOC-as-a-service market, this means a shift in competition from price and response time — to guarantees of data jurisdiction, depth of infrastructure integration, and the ability to simultaneously monitor IT and OT in a unified threat context.