GreenShieldX: AI-native SOC for smarter security

GreenShieldX is organised into seven workstreams that lead from architectural design to end-to-end validation of the solution:

1- Hybrid Cloud-HPC architecture and MLOps framework

An architecture designed to support compute-intensive AI workloads and flexibly distribute training, inference and application services. The MLOps framework governs the model lifecycle, experiment reproducibility, deployment and monitoring of model versions in operation.

2- Cognitive Threat Detection

A detection engine that applies AI models to the correlation of security events and signals. The objective is to improve the ability to distinguish relevant phenomena from operational noise and build a more contextualised representation of threats.

3- Incident-response orchestration

A set of mechanisms for coordinating post-detection actions in a more automated way, reducing response times and repetitive manual work. The most critical decisions remain within a human-in-the-loop operating model.

4- Explainable AI and Knowledge Interface

A layer dedicated to the explanation and traceability of decisions supported by artificial intelligence. Technical evidence, semantic relationships and operational context are organised to provide views aligned with the needs of SOC analysts, CISOs and compliance functions.

5- Energy-aware deployment and optimisation

A component focused on the efficiency of AI workloads, using techniques such as pruning, quantisation and distillation together with energy metrics. The objective is to assess performance, computational consumption and infrastructure sustainability within the same design framework.

A workstream focused on the security of the AI components themselves, considering threats such as evasion, poisoning and prompt injection. The activities are intended to improve the robustness of models and AI-enabled services against deliberate manipulation and anomalous behaviour.

Integration and validation in a SOC-like environment
The final phase integrates architecture, detection models, orchestration, explainability, MLOps and energy optimisation into an end-to-end prototype. Validation is carried out in an environment representative of SOC operations to verify the interaction between components and move the solution towards a pre-operational configuration.
 

GreenShieldX brings together three aspects that are often handled separately in traditional SOC environments: threat-detection effectiveness, understandability of decisions and the computational cost of AI models. The project therefore aims to create a technological foundation in which automation and artificial intelligence remain governable, auditable and compatible with the operational requirements of a Security Operations Center.

The expected final result is a TRL 7 operational prototype of an integrated and scalable AI-native SOC, validated in a representative environment and conceived as the foundation for a new Mashfrog cybersecurity service line. The platform + service model therefore connects the R&D result with the management, evolution and operational use of the platform.
 

Purpose and expected results
GreenShieldX aims to develop and validate a new generation of AI-native Security Operations Center capabilities combining threat detection and correlation, response orchestration, Explainable AI, MLOps, energy-aware optimisation and adversarial-resilience techniques. The expected result is a TRL 7 operational prototype that is integrated, scalable and auditable, validated in a SOC-like environment and oriented towards a subsequent pre-commercial configuration.
 

Funding status
The project submitted by Mashfrog Group S.r.l. under the “Aid for the development and manufacturing of critical technologies - STEP - Second Edition” call of the Campania ERDF Regional Programme 2021-2027 was included in the ranking of operations eligible for funding approved by Executive Decree No. 135 of 26 June 2026. The grant award is subject to the subsequent measure provided for by the call and to completion of the required administrative checks and formalities.
 

If you would like more information about our services or products, or if you would like to get directly in touch with our teams and competence centres, fill in the form on the Mashfrog website and we will get back to you as soon as possible.