Embedded Files
"We use cookies to improve your experience. Manage your preferences."
Questionnaires
Post-Training Questionnaire
Kindly complete the Post-Training Questionnaire for NERO's training sessions (see the relevant trainings description in the programme below).
We truly appreciate your time and feedback, which are essential for evaluating the effectiveness of the NERO training activities and improving future sessions.
Post-Training Questionnaire
Kindly complete the Post-Training Questionnaire for NERO's training sessions (see the relevant trainings description in the programme below).
We truly appreciate your time and feedback, which are essential for evaluating the effectiveness of the NERO training activities and improving future sessions.
6th CyberHOT Programme
Day 1 - 22nd October 2026
Day 1 - 22nd October 2026
🏛️ Room: Orange Auditorium, Ground Floor
8:00 - 8:30 Opening of CyberHOT Day 1 - Registration
(Registration Desk, Ground Floor)
8:30 - 9:00 Welcome by the Organisers
Chairperson: Christos Douligeris
9:00 - 09:40 From Skills Gap to Skills Practice: Three Years of NERO
by Eleni Seralidou, Charalambos Klitis, Kitty Kioskli
Abstract: This session reflects on the three-year journey of the NERO project (2023–2026) and its mission to boost cybersecurity awareness and capability across European SMEs. Attendees will gain an overview of how NERO translated industry requirements into an integrated ecosystem, combining testing frameworks, specialised training modules, and real-world validation across healthcare, finance, and logistics, to turn theoretical skill gaps into operational defence practices.
09:40 - 11:10 Hands-on Phishing Detection Training through Serious Gaming
by Kitty Kioskli, Spyros Papagiannopoulos, Luong Nguyen, Wissam Mallouli
Abstract: This hands-on training session introduces an interactive serious game developed by Montimage to raise awareness and build practical skills against phishing attacks. Participants will engage in realistic scenarios where they must identify suspicious behaviors, analyze messages, and make appropriate decisions in real time. The platform uses AI-driven mechanisms and simulation concepts inspired by digital twin environments to reproduce real-world conditions, enabling users to better understand cyber threats and improve their reflexes in detecting and mitigating phishing attempts.
Tool to be used: https://pdtp.montimage.eu/
Requirements for trainees: Laptop, Web access
Post-training questionnaire: Please find it here.
11:10 - 11:15 Coffee Break ☕
(Networking & Lunch Area, Ground Floor)
Chairperson: Eleni Seralidou
11:15 - 12:45 DeepGuardian Security Framework: Hands-On
by Luís Cordeiro, Diogo Fevereiro, Marco Neto
Abstract: The training will cover the key topics around Intrusion Detection Systems, from traditional approaches to AI-based ones. In addition, cloud-native concepts and technologies are presented, followed by different AI/ML approaches commonly used in IDS systems. A practical hands-on session with DeepGuardian is included.
Tool to be used: https://deepguardian.org
Requirements for trainees: Laptop, Linux/Debian terminal, web browser, internet connectivity (docker, gitlab, and kubectl installed are advised)
Post-training questionnaire: Please find it here.
12:45 - 13:00 Demonstration of NERO Market Place
Abstract: This session provides an interactive demonstration of the NERO Marketplace and its integrated Moodle LMS training platform. Attendees will see firsthand how SMEs can access, deploy, and utilise NERO's central hub of security tools, such as automated code scanners and network monitoring, alongside interactive, scenario-based training modules designed to upskill staff and strengthen organisational cyber resilience.
Post-training questionnaire: Please find it here.
in parallel with:
Chairperson: Wissam Mallouli
12:45 - 13:00 Poster Session 📜
(Networking & Lunch Area, Ground Floor)
12:45 - 13:45 Lunch Break 🍽️
(Networking & Lunch Area, Ground Floor)
Chairperson: Kitty Kioskli
13:45 - 15:15 Incident Response Playbooks: From Strategy to Automated Execution
Abstract: This training session provides a comprehensive introduction to incident response playbooks, combining theoretical foundations with practical demonstration. Participants will learn how to design, structure, and operationalize playbooks to effectively detect, analyze, and respond to cybersecurity incidents. The session will cover best practices for standardizing response procedures, integrating automation, and leveraging AI-driven tools to enhance efficiency and consistency. A live demo will illustrate how playbooks can be applied in real-world scenarios to accelerate response time and improve resilience.
Tool to be used: AI4SOAR
Requirements for trainees: Ubuntu OS. Follow instructions here : https://github.com/montimage/ai4soar
15:15 - 15:30 Coffee Break ☕
(Networking & Lunch Area, Ground Floor)
Chairperson: Charalambos Klitis
15:30 - 17:00 From Playbooks to Readiness: Co-Piloting and Hyper-Automating Incident Response
by Spiros Antonatos, Manos Athanatos
Abstract: Incident response teams often have playbooks, automation tools and threat frameworks, yet still struggle to answer a fundamental question: are we actually ready to respond? This hands-on session introduces a practical method for moving from isolated procedures and playbooks to measurable Incident Response Readiness. Participants will use Cymph to create or import a response workflow, map it to relevant threats, assets and security frameworks, identify coverage gaps and missing responsibilities, and execute the playbook collaboratively. The session will then demonstrate how selected actions can be connected to hyper-automation platforms such as n8n or StackStorm, while keeping human decisions, approvals and escalation points visible and governed. Participants will experience the complete readiness cycle: assess existing capabilities, co-pilot priority playbooks, validate them through execution, capture lessons learned and continuously improve the response process. The objective is not to automate every response activity, but to understand what can be automated, what must remain human-led and how organisations can maintain operational readiness over time.
Tool to be used: https://app.cymph.io
Requirements for trainees: Laptop, Web access
17:00 End of CyberHOT Summer School Day 1
19:30 Trainers' Dinner at Salty
Day 2 - 23rd October 2026
Day 2 - 23rd October 2026
🏛️ Room: Lab 210, 2nd Floor
8:00 - 8:30 Opening of CyberHOT Day 2
8:30 - 9:00 Welcome by the Organisers
Chairperson: Sotiris Ioannidis
9:00 - 10:30 SW Vulnerability Assessment & Hands-on Training Courses
Abstract: Bridging the gap between theoretical security and practical execution requires immersive, hands-on training environments. This session introduces participants to the PSTVA Toolkit via CONSOLE, a platform dedicated to static and dynamic code analysis. Utilizing CONSOLE’s integrated training module - powered by Moodle technology - attendees will engage in a custom-built Capture The Flag (CTF) exercise designed to simulate real-world vulnerability assessment workflows.
The workshop is structured into three core phases. First, participants will master the foundational mechanics of the PSTVA environment and its underlying open-source security utilities: nmap for network discovery, nikto for web server scanning, ffuf for web fuzzing, and nuclei for automated vulnerability scanning. Second, we will map out the specific penetration testing methodology required to analyze a deliberately vulnerable target service (such as Metasploitable). Finally, participants will apply these tools in real time, navigating the attack lifecycle to identify flaws, exploit weaknesses, and successfully capture the flag. Attendees will leave with a practical framework for conducting structured vulnerability assessments.
Tools to be used: nmap (network mapper), nikto (vulnerability scanner), fuff (web fuzzer), nuclei (vulnerability scanner), bandit (Python), dca (JavaScript, Node.js), horusec (Java, Kotlin, Kubernetes, Node.js, C#, Dart, Nginx, Swift), insider (Java, JavaScript, C#, Kotlin, Swift), njsscan (Node.js), zapproxy (Web), gosec (Go), progpilot (PHP), sql-injection (Web), Moodle (e-learning)
Requirements for trainees: Level of experience: Basic understanding of security and network-related terms, Own laptop: >8GB RAM, >10GB disk space, Internet browser, VM player (VMware or VirtualBox), Docker environment, OS: Unix-based or Windows with WSL support
10:30 - 10:45 Coffee Break ☕
(Networking & Lunch Area, Ground Floor)
Chairperson: Kitty Kioskli
10:45 - 12:15 Reverse Engineering Browser Synchronisation Protocols
Abstract: Browser synchronisation services enable users to seamlessly share browsing state and activity across multiple devices, improving usability and session continuity. This hands-on workshop explores the technical aspects of browser synchronisation through reverse engineering, traffic analysis, and synchronisation artefact investigation. Participants will build synchronised environments using a host machine and a virtual machine acting as a second device, perform browsing and synchronisation actions, capture synchronisation traffic using a MiTM proxy, and analyse browser storage and synchronisation behaviour. The workshop investigates synchronisation workflows, protocol behaviour, and observable metadata across both account-based and account-less synchronisation approaches, while discussing the associated privacy implications.
Tools to be used: Virtual machine environment (VirtualBox/VMware), synchronised browsers (e.g., Firefox, Chrome, Brave), mitmproxy for interception and analysis of synchronisation traffic, Wireshark for network traffic analysis.
Requirements for trainees: Trainees should bring a laptop (Windows/Linux/macOS, recommended: at least 8 GB RAM) with VirtualBox or VMware pre-installed and a working Ubuntu virtual machine. Basic knowledge of networking concepts, basic familiarity with the Linux command line, and some experience with Wireshark or similar traffic analysis tools is recommended.
Chairperson: Chrysa Psyllaki
12:15 - 12:45 Poster Session 📜
(Networking & Lunch Area, Ground Floor)
12:45 - 13:45 Lunch Break 🍽️
(Networking & Lunch Area, Ground Floor)
Chairperson: Christos Douligeris
13:45 - 15:15 TrustGuard: An in-isolation AI Risk Assessment System
by Eleni Tsalapati, Nicholas Fair
Abstract: Abstract: In the session, after a brief introduction to the Trustworthiness Assessment Framework developed within the FAITH project, trainees will participate in a hands-on training on the TrustGuard system. TrustGuard is an in-isolation AI risk assessment system designed to evaluate risks arising from the compromise of key trustworthiness characteristics—such as safety, security and resilience—across both model and data assets throughout the entire AI lifecycle, from design and development to deployment. In addition to identifying risks, the tool provides asset-level controls to support targeted mitigation.
Built as a checklist-based solution, TrustGuard operationalises a six-phase, risk-based methodology defined within the FAITH trustworthiness assessment framework and is aligned with ISO 27005 and ISO 42001 standards. The tool assesses trustworthiness dimensions derived from leading European and international best practices and standards, including guidance from the EU High-Level Expert Group on AI (HLEG), ENISA, NIST’s AI Risk Management Framework, and relevant ISO/IEC initiatives. Together, these references form a comprehensive framework for evaluating and promoting trustworthy AI systems.
Tool to be used: Spyderisk - System Security Modeller
Requirements for trainees: No experience needed, but an understanding and interest in cybersecurity risk assessment core concepts will be beneficial. Participants will need to bring their own laptops.
15:15 - 15:30 Coffee Break ☕
(Networking & Lunch Area, Ground Floor)
Chairperson: Nineta Polemi
15:30 - 17:00 Automating Cybersecurity Risk Assessment Through System Modelling
by Eleni Tsalapati, Nicholas Fair
Abstract: Participants will get hands-on with the Spyderisk - System Security Modeller tool (SSM), learning how to model a basic AI system (inc. the people, places and processes involved in the system) and run an automated risk assessment. Then participants will learn how to interpret the results and apply Controls and Control Strategies to model mitigations. There will also be a chance to discover the AI Trustworthiness Assessment Framework and to join the international MITHRA risk assessment community.
Tool to be used: Spyderisk - System Security Modeller
Requirements for trainees: No experience needed, but an understanding and interest in cybersecurity risk assessment core concepts will be beneficial. Participants will need to bring their own laptops.
17:00 - 17:30 End of CyberHOT Summer School Day 2 - Certifications
(Registration Desk, Ground Floor)
Report abuse