Classification Methodology
How 88 EU-funded cybersecurity projects are grouped into 9 thematic clusters for the COcyber Collateral Projects landscape.
1. Overview
The 88 projects in the COcyber Collateral Projects portfolio are classified into 9 thematic clusters. This classification is internal to the COcyber project and does not directly correspond to the official EU Work Programme taxonomy, which uses distinct terminologies for Horizon Europe (“Destinations”) and Digital Europe (“Specific Objectives” / “Action Areas”).
The 9 clusters represent an operational grouping designed for the COcyber cybersecurity landscape, cutting across both funding programmes.
2. Classification approach
Phase 1 — Deterministic rules (topic-code based)
Each project’s topic field contains the EU call identifier under which it was funded. Classification follows a priority-ordered set of keyword-matching rules — the first match wins:
| Priority | Pattern in topic (case-insensitive) | Assigned cluster |
|---|---|---|
| 1 | contains SOC | SOC |
| 2 | contains CYBER-RE | Cyber Ranges |
| 3 | contains SKILLS or TRAINING | Skills & Training |
| 4 | contains DEPLOY | Deployment |
| 5 | contains CS-01 (Horizon CL3 Cybersecurity) | Cybersecurity Research |
| 6 | contains INFRA | Infrastructure Protection |
| 7 | contains SSRI or FCT or BM-01 | Security & Society |
| 8 | contains DIGITAL, DATA, or EDIH | Digital & Data |
| 9 | no match | Other |
This system is deterministic and reproducible: given the same topic code, the cluster assignment is always the same. It works well for clusters that correspond directly to dedicated EU calls (e.g. CL3-CS → Cybersecurity Research, CYBER-03-SOC → SOC).
Phase 2 — Manual corrections (content-based)
Eight projects were reclassified manually because the call topic did not reflect the project’s actual content:
| Project | From (automatic) | To (corrected) | Rationale |
|---|---|---|---|
| NITRO | Digital & Data | Cyber Ranges | Topic CYBER-B-03-CYBER-; title “Connected 5G-IoT Cyber Range” |
| OT_EarWarnSys | Digital & Data | Infrastructure Protection | Title “Early Warning System for Critical Infrastructure” |
| AI4CYBER | Digital & Data | Cybersecurity Research | Title “Trustworthy AI for Cybersecurity” |
| CSC-EDIC | Digital & Data | Skills & Training | Title “Cybersecurity Skills Academy” |
| AIAS | Other | Cybersecurity Research | Title “AI-Assisted Cybersecurity” (MSCA grant) |
| INSIDER | Other | Infrastructure Protection | Title “Insider Threat Management for Critical Infrastructure” |
| SECURE-NET | Other | Cybersecurity Research | Title “Cybersecurity Ecosystem Development” (WIDERA) |
| Cynergy4MIE | Other | Infrastructure Protection | Title “Leverage synergy by cyber-physical systems” (KDT-JU) |
3. Current distribution
| Cluster | Projects | Total budget |
|---|---|---|
| Cybersecurity Research | 26 | €132.2M |
| Deployment | 16 | €77.9M |
| SOC | 12 | €28.8M |
| Skills & Training | 7 | €19.4M |
| Infrastructure Protection | 7 | €37.9M |
| Cyber Ranges | 6 | €8.5M |
| Security & Society | 6 | €16.8M |
| Digital & Data | 4 | €7.4M |
| Other | 4 | €12.4M |
| Total | 88 | €341.3M |
4. Relationship with official EU Work Programmes
Our clusters do not directly correspond to the official EU taxonomies. Here is how they relate:
4.1 Horizon Europe — Cluster 3: Civil Security for Society
The CL3 Work Programme 2025 (and 2026–2027) defines 6 Destinations:
| HE CL3 Destination | Topic prefix | Our cluster(s) | Notes |
|---|---|---|---|
| Better protect the EU against Crime and Terrorism | FCT | Security & Society | Partial — we group FCT with SSRI and BM |
| Effective management of EU external borders | BM | Security & Society | Only BORDERLINK in our dataset |
| Resilient Infrastructure | INFRA | Infrastructure Protection | Direct match |
| Increased Cybersecurity | CS | Cybersecurity Research | Near-direct match (we also include manually reclassified projects) |
| Disaster-Resilient Society for Europe | DRS | — | No projects in our dataset |
| Strengthened Security Research and Innovation | SSRI | Security & Society | SSRI is cross-cutting in the official WP; we merge it with FCT and BM |
4.2 Horizon Europe — Cluster 4 and other programmes
Several projects come from Cluster 4 (Digital, Industry and Space) and other Horizon Europe instruments:
| Programme | Topic pattern | Projects | Our cluster |
|---|---|---|---|
| HE Cluster 4 | CL4-DIGITAL-EMERGING | AI4CYBER | Cybersecurity Research |
| HE Cluster 4 | CL4-DATA | NexusForum.EU, CEI-Sphere | Digital & Data |
| HE Cluster 4 | CL4-HUMAN | INSTAR, StandICT.eu 2029 | Other |
| MSCA | MSCA-* | AIAS, INSIDER | Cybersecurity Research, Infrastructure Protection |
| WIDERA | WIDERA-* | SECURE-NET | Cybersecurity Research |
| SESAR | SESAR-* | ATM-EXCITE | Other |
| KDT-JU | KDT-JU-* | Cynergy4MIE | Infrastructure Protection |
| SNS-JU | SNS-* | SNS CO-OP | Other |
4.3 Digital Europe Programme — ECCC Work Programme 2025–2027
The ECCC Cybersecurity Work Programme (€390M) defines 4 Action Areas:
| ECCC Action Area | Budget | Our cluster(s) |
|---|---|---|
| 1. New Technologies, AI & Post-Quantum Transition | €142M | Cybersecurity Research, Deployment |
| 2. Cyber Solidarity Act Implementation (Cyber Hubs, ECAS) | €121M | SOC, Deployment |
| 3. EU Cyber Resilience Enhancement (NIS2, CRA, DORA) | €118M | Deployment, Infrastructure Protection |
| 4. Programme Support Actions | €9M | — |
The specific Digital Europe topic patterns map more directly:
| DEP topic pattern | Our cluster | ECCC Action Area |
|---|---|---|
CYBER-03-SOC | SOC | #2 Cyber Solidarity |
CYBER-03-CYBER-RE | Cyber Ranges | #1 New Technologies |
DEPLOY-CYBER-04-* | Deployment | #3 Cyber Resilience |
DEPLOY-CYBER-06-* | Deployment | #3 Cyber Resilience |
DEPLOY-CYBER-07-SOC* | SOC | #2 Cyber Solidarity |
DEPLOY-CYBER-07-CYBERS* | Deployment | #3 Cyber Resilience |
SKILLS-* / TRAINING-* | Skills & Training | SO4 — Skills |
EDIH-* / BESTUSE-* | Digital & Data | SO2 — Digital Capacities |
5. Why “Cluster” and not “Destination”
The term “Destination” is specific to Horizon Europe and refers to the 6 thematic areas in the CL3 Work Programme. Our groupings are not Destinations for three reasons:
- Cross-programme scope: our clusters combine projects from Horizon Europe (CL3, CL4, MSCA, WIDERA, JU) and Digital Europe (ECCC, EDIH, Skills), which each use different taxonomies.
- Not a one-to-one mapping: even where partial overlap exists (our “Cybersecurity Research” ≈ Destination “Increased Cybersecurity”), the perimeters do not coincide exactly.
- Different orientation: HE Destinations are organised by policy impact; our clusters are organised by operational type in the COcyber context.
The term “Cluster” (or “Thematic Area”) is more neutral and avoids confusion with official nomenclature.
6. Data quality notes
Three project acronyms appear twice in the dataset, representing distinct grants:
| Acronym | First occurrence | Second occurrence | Note |
|---|---|---|---|
| SOCCER | SOC, scored 100%, €1.63M | SOC, scored 86%, €5.08M | Two distinct projects under the same SOC call |
| ATHENA | SOC (Digital Europe), scored 94%, €2.36M | Cybersecurity Research (Horizon Europe), unscored, €5.2M | Different projects: cross-border SOC vs. HW/SW validation |
Sources
- Horizon Europe WP 2025 — Cluster 3: Civil Security for Society (PDF)
- Horizon Europe WP 2026–2027 — Cluster 3 (PDF)
- Horizon Europe WP 2026–2027 — Cluster 4: Digital, Industry and Space (PDF)
- ECCC DEP Cybersecurity WP 2025–2027 — €390M announcement
- Center for Cybersecurity Policy — DEP WP 2025–2027 analysis
- HaDEA Spotlight on EU Cybersecurity (February 2026)