Europe's defenders work in isolation while attackers coordinate across borders. LATTICE builds the federated layer that lets organisations detect, decide and respond together — with no central authority and no sharing of sensitive data.
lattice-project.eu · October 2026 – September 2029 · Coordinated by LIST, Luxembourg
The problem
Hospitals discover ransomware days after neighbouring facilities faced identical threats. Financial institutions miss sector-wide campaigns. Fragmented defence across 27 Member States costs European organisations an estimated €43 billion every year.
Median time to identify an intrusion, against the time attackers need for lateral movement. That separation is what makes purely reactive defence impossible.
Documented delay to establish cross-border sharing during incidents today. LATTICE targets coordinated response in under 15 minutes.
Share of EU organisations kept out of threat-intelligence sharing by GDPR exposure concerns. Collective defence fails when most defenders cannot participate.
These figures — and the market figures quoted elsewhere on this site — were accurate when last checked, in November 2025.
The approach
LATTICE removes the false choice between isolated defence and centralised aggregation. Peer-to-peer by design, it lets thousands of organisations in the scope of the EU's NIS2 directive act as one — while each keeps full custody of its data and decisions.
Graduated response across autonomous security operations centres (SOCs) with no central authority: 60% consensus triggers enhanced monitoring, 75% coordinated investigation, 90% full containment. Byzantine-fault-tolerant with up to 33% of nodes acting maliciously.
Peer-to-peer secure multi-party computation correlates threats over encrypted telemetry. Organisations verify that attack patterns match — without revealing detection methods or vulnerable systems. Zero-knowledge proofs, evaluated against NIST SP 800-226.
Shared cyber-range infrastructure to rehearse dangerous responses safely before they touch production. Roughly 10× cheaper than the €500K–€2M of a dedicated range — opening pre-deployment validation to the SMEs that make up 70% of NIS2 entities.
Evidence
These are not demos. Each pilot runs continuously for six months on live security telemetry — real events, no synthetic data — producing the operational evidence for technology readiness level 7 (TRL 7) by September 2029.
Federated detection and adversary emulation spanning telecom, finance, utilities and education infrastructure — sectors that today discover shared campaigns in isolation.
A live 250-bed hospital defended by the federation — with digital-twin validation keeping false positives away from patient safety, and patient privacy untouched.
Real-time coordination between security operations centres processing over one million events a day — operational secrecy intact on every side.
Accelerated advisory distribution across European CSIRTs, integrated with the national CSIRT's production MISP platform serving 1,000+ organisations worldwide.
Consortium
Coordinated by the Luxembourg Institute of Science and Technology, LATTICE pairs security operations centres and a national CSIRT with universities advancing privacy technology — and puts SMEs in the lead, carrying 49.8% of the work.
Resources
European code, European licence. The alpha platform reaches GitHub in 2028; the full release with deployment guides follows as the project closes in September 2029, alongside contributions to MISP, ETSI, CEN-CENELEC, W3C and ISO/IEC standards work.
From the consortium's research
News
The consortium meets at LIST to open the 36-month programme. First on the board: requirements and a federated architecture specification, privacy gateway development, and the groundwork for four operational pilots running by 2029.
The federation is built to grow beyond the consortium. Talk to us about early access, the open-source alpha, or joining the stakeholder group.