Understand what is happening. Decide. Act.
Organizations have an increasing number of cybersecurity tools, systems, and information sources.
The challenge is connecting them to understand what is happening and to be able to act in a coordinated manner
A European platform to connect and coordinate cybersecurity
ONE is not just another isolated console.
It is an orchestration layer that connects an organization’s security signals and tools, relates information, and enables the coordination of decisions and actions.
In this way, teams that used to work separately can operate as a connected and coordinated system, facilitating decision-making.
Integrates signals, assets, identities, tools, and control capabilities present in the environment.
Connects information to understand what is happening, which elements are connected, and what may be affected.
Analyzes the context to generate situational awareness and facilitate decision-making.
Allows for action on connected control capabilities, maintaining traceability and human oversight.
Attacks advance quickly, but the response remains fragmented
Organizations have more information and tools than ever, but signals, teams, and response capabilities often still function separately.
This fragmentation increases the distance between detecting a threat, understanding it, and being able to respond.
Attacks evolve, combine techniques, and spread faster than traditional analysis and response cycles.
Signals are spread across multiple consoles, technologies, teams, and workflows, hindering a common vision.
IT, OT, IoT, IoMT, cloud, and legacy systems coexist within the same organization with different technologies and levels of control.
Organizations must demonstrate control, traceability, and response capability, maintaining a record of the decisions and actions taken.
OODA: observe, orient, decide, and act.
The entire process maintains situational awareness, traceability, and human control.
ONE applies the OODA (Observe, Orient, Decide, Act) model to connect the different phases of the response and reduce the time needed to understand a situation and act upon it.
1
OBSERVE
Collects data and telemetry from the various systems, tools, and technologies in the environment.
Connect signals
2
ORIENT
Relates information to build a contextualized view of what is happening.
Understand the context
3
DECIDE
AI, defined policies, and human judgment help prioritize the most appropriate response.
Determine what to do
4
ACT
Orchestrates control capabilities to execute coordinated, traceable, and governed actions.
Applicable and traceable action
Understand better to act sooner
Obtain a shared vision of what is happening, why it matters, and what may be affected.
Distinguish sooner the situations that require attention and response.
Obtain contextualized information without having to navigate multiple consoles.
Align teams, policies, and tools with a common vision and shared responsibilities.
Convert decisions into applicable, traceable, and governed actions.
ONE in action
Situational awareness in heterogeneous environments
What it does
Correlates signals from IT, OT, IoT, IoMT, cloud, and legacy systems to build a common vision of the environment.
How
The ontology relates assets, identities, business context, dependencies, and events. AI uses that context to help interpret what is happening and why it is relevant.
Result
Greater situational awareness to identify priorities and coordinate the response with a shared context.
Investigate the environment using natural language
What it does
Allows for inquiries about an incident, a decision, or an action without navigating multiple consoles and dashboards.
How
The ontology connects relationships and evidence; AI interprets the question, gathers the relevant context, and explains the sequence.
Result
Faster, explainable, and contextualized investigation, maintaining traceability and human control.
From contextualized intelligence to applicable action
What it does
Connects understanding and decision-making with the control and response capabilities present in the ecosystem.
How
AI supports prioritization; policies and human governance determine the response; ONE coordinates teams, flows, and technologies.
What it does
Respond with greater speed and precision through applicable, traceable, and governed actions.
Designed for critical sectors operating in heterogeneous environments.
IoMT and clinical systems with high operational dependency and a need for continuity.
Distributed and sensitive environments that demand sovereignty, resilience, and governed response.
IT/OT convergence, legacy technology, and operations that cannot be stopped.
Regulated and fragmented ecosystems across agencies, providers, and platforms.
Environments that ONE connects
Technological sovereignty is now a matter of resilience
Europe depends heavily on external providers even to protect its most regulated infrastructures and environments.
Sovereignty does not mean isolating the ecosystem. It means maintaining control over information, decisions, and the ability to act.
European development with long-term control and autonomy.
Knowledge of networks, access, secure communications, and critical environments.
Integration with existing technologies and capabilities.
Decisions and actions aligned with policies and human control.