Monday, 6 April 2026

On 19 March 2026, SOC4SME participated in the workshop “Enhancing Incident Response Efficiency Across the National SOC Landscape Through Security Playbooks”, hosted at the ICT Academy in Nicosia. 

Organised by the CY-TRUST project in collaboration with SOC4SME and NG-SOC EU, the event brought together key cybersecurity stakeholders from across the national and European ecosystem, highlighting the importance of cross-project cooperation in strengthening operational cybersecurity capabilities. 

The programme focused on CACAO-compliant security playbooks, automation, and AI-driven SOC workflows, combining expert presentations with hands-on experience in playbook design and execution. 

Within this context, SOC4SME contributed with a dedicated session titled “Operationalising SOC Playbooks using the CACAO Standard”, presented by Mr Dimitris Koupatsiaris, Project Manager at consortium partner Cybersafe. 

The session, co-developed by consortium partner Sphynx, explored how structured, machine-readable playbooks can transform incident response from fragmented processes into coordinated and automated workflows. By leveraging the CACAO standard, SOCs can define executable response actions, improving speed, consistency, and collaboration across systems and teams. 

CACAO playbooks represent a shift from static documentation to dynamic operational tools. Encoded as structured workflows, they enable the orchestration of actions across technologies and human operators, supporting more efficient and scalable incident response processes. 

As highlighted during the session by Mr Dimitris Koupatsiaris, this transition is not only technical but operational: 

Moving from documentation to execution is critical. Within SOC4SME, CACAO playbooks allow us to standardise and automate response processes, making SOC operations more efficient, interoperable, and accessible for SMEs.

This approach ultimately enables organisations to move beyond theoretical preparedness and towards real-time, coordinated response capabilities in operational environments. 

Beyond the technical discussions, the workshop provided a space for meaningful exchange between stakeholders, including real use cases, practical demonstrations, and collaborative dialogue between public and private sector actors. 

SOC4SME’s participation reflects the project’s broader objective: moving from awareness to real operational capability for SMEs. By contributing to discussions on automation, interoperability, and standardisation, the project continues to position itself at the intersection of innovation and practical cybersecurity deployment. 

As cyber threats become more complex, initiatives like SOC4SME play a key role in ensuring that advanced SOC capabilities are not limited to large organisations, but become accessible, scalable, and actionable for SMEs across Europe.