During the meeting, DECOIT® from Bremen and the Institute for Reliable Embedded Systems and Communication Electronics (ivESK) discussed the progress made since the last meeting in February 2025. AI integration and the development of the Intelligent Analyst were particularly noteworthy.

The partners presented and discussed the results of work packages 4 to 6. Work package 4 focused on the selection and development of algorithms for artificial intelligence (AI), which make up the ‘Intelligent Analyst’ used to detect and correlate attacks on IT/OT networks. The connection of the AI implementation and the pipelines for data pre-processing were also part of this work package. In work package 5, individual software architecture components were integrated into the overall SIEM (Security Information and Event Management) framework. During the presentation of the AP6 work, the partners continued to discuss test procedures and tests that can be performed on the Intelligent Analyst system, which were developed in the previous work packages. Optimisations of the Intelligent Analyst were also discussed.

Between the two consortium meetings, the partners published two joint papers at the IDAACS 2025 conference in Gliwice, Poland, with the titles „A Testbed for Cyber Attack Emulation and AI-Driven Anomaly Detection in Industrial IoT- and OT-Networks” and „A SIEM-Based Framework for Multi-Layer Data Collection and Anomaly Detection in OT-Networks”. In addition, ivESK published a paper at the ICEST 2025 conference in Ohrid, North Macedonia, with the titel „Mapping the MITRE ATT&CK Framework to Modbus Cyber Attacks in Industrial OT Networks”. Plans for at least two further publications were discussed at the meeting.

Overall, the project is entirely on schedule, so that extensive testing and optimisation can now be carried out before field testing begins. The KISTE project will run until June 2026.