Summary

• Milan-based CyberKord has raised €2.7 million in pre-seed funding led by 360 Capital.
• Its proposed platform combines AI with a digital representation of IT infrastructure to investigate incidents and test corrective actions.
• The company plans initial pilots with major European enterprises, with customers able to choose between recommendations, approved actions, and greater autonomy.

Italian cybersecurity startup CyberKord has secured €2.7 million in pre-seed funding to develop software that investigates IT and security incidents, tests proposed corrections, and can apply changes to enterprise infrastructure according to permissions established by the customer.

The Milan-based company raised the funding in a round led by 360 Capital, with participation from Plus Partners, Addendum Capital, and Vento. It intends to expand its engineering and commercial teams while preparing initial pilot projects with major European organisations.

Founded in 2026 by Alessandro Maggio, Dragos Tanasa, and Cosimo Michelagnoli, CyberKord is developing an AI-based platform that connects to existing security and infrastructure management tools. Its system uses a digital representation of an organisation’s IT environment to examine incidents and simulate responses before authorised changes are made.

The company is targeting businesses in manufacturing, technology, healthcare, and telecommunications, where complicated infrastructure and the need for continuous services can make incident response difficult to manage through manual procedures alone.

Connecting detection with corrective action

Security teams commonly rely on monitoring systems that identify suspicious activity, software vulnerabilities, and unusual behaviour across networks and devices. These tools can generate alerts quickly, but responding to an alert may require several additional steps before the underlying issue is resolved.

An analyst may need to establish whether the reported activity represents a genuine risk, identify the affected systems, determine what other services could be exposed, and select a suitable corrective action.

Even after the appropriate response is identified, implementing it can require coordination with infrastructure engineers and service owners. A change intended to contain an incident may interrupt an application, block legitimate access, or affect connected systems if its wider consequences are not understood.

CyberKord is attempting to automate more of that sequence. Its software can receive information from security monitoring tools, vulnerability scanners, support tickets, and messages submitted through platforms including Microsoft Teams and Slack.

Using a model of the customer’s infrastructure, the system examines the affected assets and the relationships between them. That information is intended to help determine how an issue could spread and which corrective actions may be appropriate.

The proposed response is then simulated before the software makes a change to the live environment. CyberKord describes this as testing the likely consequences of an intervention against a digital representation of the relevant infrastructure.

The effectiveness of such testing depends on how closely the model reflects the operating environment. Changes to software, network connections, user permissions, or service dependencies can alter the effect of a correction, making accurate and current infrastructure information an important requirement.

A simulation may identify likely consequences, but it cannot guarantee that every condition present during live operation has been represented. Organisations will need to consider how the technology deals with uncertainty and how its recommendations are reviewed when the consequences of an error could be substantial.

Customers decide how much authority to grant

CyberKord has designed its platform around different levels of permitted automation, allowing organisations to begin with observation and move towards greater independence where they consider it appropriate.

The initial operating arrangement provides read-only access to relevant systems. The software can investigate alerts and prepare reports showing what it would have done, without applying changes to production infrastructure.

Customers can subsequently allow the platform to implement particular actions after an employee approves the proposed correction. This creates a controlled route from analysis to execution while retaining human authorisation for the actual change.

A third option allows specified categories of action to proceed automatically, according to rules established by the organisation. CyberKord presents this as a way to respond to suitable incidents without waiting for an analyst to be available.

The distinction between these arrangements affects the risks associated with deployment. Removing access for an account believed to be compromised may have different consequences from changing a network policy or modifying a production system supporting essential business activity.

Permission levels therefore need to reflect the potential effect of each action, rather than treating all incident response tasks as equally suitable for autonomous execution.

CyberKord says its system records the stages of an investigation and the actions performed, providing a report that technical staff can review afterwards.

Those records could support internal assurance and incident review, although their usefulness will depend on whether the information is sufficiently detailed to establish what the software observed, why a response was selected, and what changed in the live environment.

Existing tools remain part of the system

CyberKord is designed to connect with cloud and locally operated infrastructure without requiring customers to replace their existing security products.

This integration model recognises that enterprises often maintain several tools for monitoring, endpoint security, access management, vulnerability assessment, and infrastructure configuration.

Each system provides different information and technical capabilities. Monitoring software may identify a potential threat, while a separate management tool is needed to disable an account, change a configuration, or apply a correction.

Coordinating those components creates an opportunity for automation, but it also introduces dependencies. The AI platform must receive appropriate information from each connected system and exercise only the permissions needed for authorised work.

Integration quality will influence how reliably the software can distinguish an isolated problem from an issue affecting several connected services. Incomplete information could cause an incident to be assessed incorrectly, particularly where important systems are missing from the infrastructure model.

Organisations will also need to manage credentials, access restrictions, and the security of the automation platform itself. A system capable of implementing changes across multiple administrative tools becomes an important component of the enterprise’s operational security.

Controlling that access is especially significant where automated actions can affect production infrastructure without a person approving every individual change.

Enterprise pilots will provide the next evidence

CyberKord’s planned pilots will test how its approach operates beyond product demonstrations. The company has identified major European enterprises in manufacturing, technology, healthcare, and telecommunications as potential initial users.

These sectors can have demanding availability requirements, with systems supporting production, clinical operations, communications, or other essential services.

A corrective action may need to be coordinated with established maintenance procedures or operational restrictions, even when the original security issue requires attention.

CyberKord’s published website includes illustrative incident timelines showing how the software might investigate and contain a threat. These examples describe intended workflows rather than independently verified performance measurements from completed enterprise deployments.

The available funding announcement does not provide measured reductions in incident resolution times, production success rates, or independent comparisons with established security operations tools.

Such evidence will become important as customers assess whether the system improves response times without increasing the risk of unnecessary disruption.

Enterprises will also need to determine which activities remain subject to employee approval and how responsibility is assigned when an automated action produces an unexpected result.

The company intends to use its €2.7 million financing to develop the platform and recruit additional technical and commercial staff. Its initial enterprise projects will establish whether the combination of infrastructure modelling, simulated correction, and configurable autonomy can be used consistently within complex operating environments.