Italy’s cyber agency wants to make its EU recovery project last beyond the funding

This story is part of GovInsider's Digital Trust & Cybersecurity Champions 2026 Special Report.

Ticking off milestones of an European Union (EU)-funded recovery project is one thing, but keeping cyber systems running once the money stops is the harder thing. 

With about €600 million (S$860 million) of EU’s funding, Italy’s National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale – ACN) has set up a supercomputer in Naples, national cyber services like HyperSOC and regional incident response teams (CSIRTs), and Italy’s first network of accreditation labs. 

The funding is part of the broader National Recovery and Resilience Plan (Piano Nazionale di Ripresa e Resilienza – PNRR) targeted to recover the economy from the Covid-19 pandemic. 

Speaking to GovInsider, ACN's Head of Industrial, Technological and Research Programmes Service, Luca Nicoletti, says that his agency achieved all the milestones in December 2024, ahead of this year's timeline.  

The project is over, but the systems still need licences, maintenance, and skilled staff.  

"Milestones are essential checkpoints, but resilience is measured by the capabilities that remain once the investments have been completed," he explains, which he says that feedback gathered by ACN "largely confirms the effectiveness" of the tools and capabilities that were deployed. 

The agency and the plan arrived together in 2021. While ACN was setting up its own organisation, it was also supporting public agencies and implementing the EU recovery plan. 

Nicoletti, who oversees the delivery, explains what the agency built with the millions of recovery money, how it tells results from box-ticking, and what Italy still has to settle to keep it all running. 

Translating plans into platforms 

The objective of the EU recovery funds was to build strategic infrastructures, platforms and services that continue to deliver value well beyond the implementation window until 2026. 

The biggest proof of this investment is Megaride, a high-performance computing infrastructure hosted in Naples. 

A significant share of its capacity powers ACN’s national threat-monitoring platform for public and

private organisations, with the remaining capacity supporting applied research in cybersecurity and AI. 

According to Nicoletti, the infrastructure has about 340 GPUs, more than 300 compute nodes, 50 petabytes of storage and AI performance of 4 exaflops.  

Rather than an isolated supercomputer, Megaride is connected to Leonardo, the supercomputer run by Cineca in Bologna, which is ranked the world's 12th most powerful supercomputer. 

That connection “further expand[s] its computational potential," he says, which can be leveraged upon by Italy and the EU to build its regional AI sovereignty as the country was selected to host an AI Factory known as IT4LIA. 

“Managing delays, blocks and difficulties is a daily job,” he says, citing the number of stakeholders and the complexity of technology supply chains.  

Nicoletti himself has seen the programme from both ends.   

At Italy's Presidency of the Council of Ministers, he was involved in drafting the cybersecurity component of the recovery plan, as well as ACN's establishment and Italy's National Cybersecurity Strategy. 

He then moved to ACN to oversee delivery, which changed what the job demanded. 

Implementers must deal “every day with the complexity of the situation," while being expected to produce concrete results of meeting deadlines, rules and requirements and also engage the broader ecosystem across the public sector, industry, and academia.  

Beyond Megaride, Nicoletti says that ACN completed more than 60 resilience projects for public and private bodies. 

The funding was also used to establish a regional network of CSIRTs; HyperSOC, which is a platform connecting local security operations centres (SOCs) across public and private sectors to share threat data in real-time and enhance proactive defence; and a national information sharing and analysis centre (ISAC Italia). 

ACN has set up Italy’s first national network of 12 accredited test laboratories (LAPs) that test hardware and software for security flaws before critical organisations adopt them. 

The LAPs are accredited by the two national centres for evaluation and certification (CVCNs) in the country. 

ACN has also built up a central inspection unit to ensure organisations comply with National Cybersecurity Perimeter (PSNC) and Network and Information Security (NIS) measures, having completed 30 inspections thus far. 

Helping small businesses without becoming the gatekeeper 

For small firms, cybersecurity can mean new costs and more paperwork. Nicoletti says that the role of ACN shouldn't be to add to that.  

He points to ACN's support for small and medium-size enterprises (SMEs) to bring together public and private capabilities, and create the conditions for cybersecurity solutions to become more accessible and effective for them. 

Public-private partnerships in cybersecurity help ACN achieve a few objectives. 

The first is growing the startup ecosystem.  

Through its Cyber Innovation Network, ACN partnered with six innovation incubators to support the acceleration and funding for early-stage cybersecurity companies.   

The second is understanding the market before acting on it.  

ACN works with the Cybersecurity & Data Protection Observatory at the Polytechnic University of Milan to analyse the national cybersecurity ecosystem. 

ACN is also an institutional partner in the Cyber Index PMI, which leverages the scientific contribution of the observatory. The index measures how aware and mature Italian SMEs are on cybersecurity. 

The third is funding.  

ACN coordinates SECURE, another EU-funded initiative involving 13 other European countries to support SMEs with funding and guidance. 

It helps SMEs strengthen their security and prepare for requirements like EU's Cyber Resilience Act, “while avoiding unnecessary financial or administrative burdens."

“Public-private partnership works when the public sector provides direction and coordination, while leveraging the capabilities, knowledge and innovation already available in the market," he says. 

Mandate alone is not enough, he notes, highlighting that credibility within the ecosystem is built through continuous engagement, understanding stakeholders’ capabilities and needs, and ACN’s ability to provide direction. 

After the money, and what Italy must control 

Software licensing, infrastructure maintenance, and the specialised skills require continuous funding, Nicoletti acknowledges.  

Since 2024, after meeting the milestones of the EU recovery plan, ACN continues to pursue Italy's National Cybersecurity Strategy, which outlines the funding mechanisms and involved entities.  

"Our teams are already working to identify and secure the resources needed to ensure that these capabilities continue to evolve and remain effective over the long term," he explains, a sign that part of the funding is still being arranged. 

On what digital sovereignty means to him, "it means having the capacity to make autonomous choices, manage critical dependencies and retain control over the capabilities that are essential to our security.” 

The dependencies are visible in the results from ACN's first ecosystem study with the Polytechnic University of Milan. 

Of about 1,600 active cybersecurity companies, most focus more on integrating, distributing, and advising on solutions than on developing their own technology. 

Only around a third of those analysed are fully Italian-owned. 

However, Italy only spends around 0.14 per cent of GDP on cybersecurity, below the leading G7 countries.  

He highlights the importance of selectivity, and not isolation, in ensuring sovereignty. 

“Sovereignty is not about building everything at home,” he says. “It is about knowing what we cannot afford not to control, while remaining open to cooperation where it creates value.”