A Cybersecurity Framework for Seaplane Operations

As seaplane services develop into a component of Greece’s national transport network, the aircraft, the docks and the energy infrastructure that supports them increasingly depend on connected digital systems. This connectivity enables efficient operations, and it also introduces exposure to cyber threats. Sea Plane Fortress (SPF) is the Horizon Europe subproject established to address that exposure, with Parity Platform serving as subproject lead.

The problem SPF addresses

A seaplane operation comprises a chain of interconnected systems that must communicate in real time: telemetry from the aircraft, charging and refueling control at the dock, a cloud monitoring back end and a digital twin that mirrors the operating environment. Each of these data flows represents a potential point at which an adversary could interfere with operations, manipulate readings or disrupt energy delivery.

SPF treats this chain as critical infrastructure and protects it accordingly. The subproject delivers a cybersecurity framework developed specifically for the digital twin and the cloud monitoring back end used across both electric and conventional seaplane operations. The objective is to maintain the integrity of every real-time data flow, from sensor measurement to operator action.

Built on proven foundations

SPF builds directly on two applications that Parity Platform already operates in the field, EV Loader and EV Safe. Both were designed to manage and secure charging infrastructure, a domain closely related to the recharging and refueling systems on which a seaplane network depends.

The disciplines that protect an electric vehicle charging point apply equally to a seaplane dock:

• Hardening the communication protocols that carry control commands and telemetry, including OCPP, MQTT and REST.
• Securing the real-time data paths for telemetry, charging and refueling control through hardened OCPP and REST interfaces.
• Aligning the architecture with the EUDOROS reference model, so the toolset conforms to an established security blueprint.

The framework produces an operator dashboard and an edge and cloud deployment of the SPF toolset suitable for use on operational infrastructure rather than in a laboratory setting alone.

Validation approach

The SPF toolset is validated through three complementary methods:

• Penetration testing to identify weaknesses from an adversarial perspective.
• Attack simulations that reproduce realistic cyber-attack scenarios against the recharging and refueling infrastructure.
• A pilot deployment on live infrastructure, which evaluates the toolset under operational conditions.

Together, these methods assess the framework against both isolated vulnerabilities and coordinated attacks, and confirm its performance outside controlled environments.

Partner responsibilities

The subproject brings together three complementary partners, with responsibilities clearly divided.

Parity Platform (PARITY) serves as subproject lead and application developer. As a Greek SME developing secure charging infrastructure software, Parity adapts its EV Loader monitoring platform, introduces the cybersecurity toolset for seaplane recharging and refueling, hardens the communication protocols, and delivers both the operator dashboards and the edge and cloud deployment.

The University of Patras (UPATRAS) provides the research foundation. Through the Cyber-Physical Energy Systems team within the Power Systems, Renewable and Distributed Generation Laboratory, UPATRAS develops anomaly detection and resilient control algorithms for the recharging and refueling infrastructure. The team also employs its real-time digital simulation facilities to model cyber-attack scenarios and integrate them directly with the SPF toolset, enabling attacks to be analysed before they reach operational systems.

Hellenic Seaplanes (HSP) participates as the priority entity and end user. As a transport operator developing a nationwide seaplane network, HSP supplies the operational requirements, provides real-world recharging and refueling infrastructure and operational data, hosts the pilot deployment, and leads end-user validation of the toolset.

Relevance beyond seaplanes

While SPF concerns seaplane operations specifically, the approach it establishes has wider application. Electric and conventional transport increasingly share a common digital backbone of connected energy delivery, real-time telemetry and cloud monitoring centred on a digital twin. Securing that backbone for seaplanes yields methods, tools and protocol hardening that transfer to other energy-intensive transport modes.

For Parity Platform, SPF demonstrates how expertise in charging infrastructure software extends into adjacent critical infrastructure. The operating environment differs and the protocols vary in application, but the central requirement remains constant: preserving the integrity of data and the trustworthiness of control systems.

As seaplane networks expand across Greece and elsewhere, the operations that support them will continue to grow in complexity and connectivity. Sea Plane Fortress is intended to ensure that this connectivity is delivered securely.

For further information, visit the official Sea Plane Fortress project site or review Parity Platform’s wider cybersecurity activities.

Why Resilient Software Is the New Foundation of Trust

The electric vehicle charging network in Europe has quietly graduated from a convenience for early adopters into a piece of critical infrastructure. Hotels rely on it to attract guests, fleet operators rely on it to keep vans on the road, and cities rely on it to meet climate commitments. When a charger fails, a payment is intercepted, or a roaming session is hijacked, the damage is not just commercial. It erodes public trust in the entire transition to electric mobility.

That is why cybersecurity in EV charging is no longer a topic for a small group of specialists. It belongs in every conversation about how we design, operate, and scale this network.

The Threat Surface Is Wider Than People Think

An EV charger is not a single device. It is a system of systems: firmware on the unit itself, the OCPP link to the back office, the OCPI roaming interface to other operators, payment processors, mobile apps, fleet portals, and a long chain of third party software libraries that hold it all together. Each of those layers is a potential entry point.

The risks are concrete and well documented:

• Tampered firmware can underreport energy delivery or open a path into the operator’s back office.
• Insecure OCPP sessions can be hijacked to start unauthorised charging sessions or read driver data.
• Vulnerabilities in the OCPI 2.2.1 interoperability layer can ripple across the entire European roaming network in hours, not days.
• Leaked secrets in source code repositories can hand attackers production credentials before anyone notices.
• Unpatched dependencies can carry well known CVEs straight into a regulated charging service.

Regulators have already drawn the line. The NIS2 Directive classifies essential service providers in the energy sector under stricter security and reporting obligations. The Cyber Resilience Act (CRA) extends product security obligations across the software supply chain. EV charging operators of meaningful size now sit squarely inside both frameworks.

In short, secure software is no longer a competitive nicety. It is a licence to operate.

What We Validated in the CONSOLE Project

Parity Platform P.C. (operating brand: EV Loader) has successfully completed the External Validation Activity (EVA) of the CONSOLE project under our EVC Guardian sub-grant, funded under Horizon Europe.

Over the past five months we worked alongside the CONSOLE consortium to validate the platform’s capabilities on a regulated, production grade EV charging code base. The validation focused on three pillars:

1. Static code analysis across the EV Loader services, looking for known vulnerability patterns, insecure cryptography, and risky API usage before code ever reaches production.
2. Secret scanning across our repositories and CI pipelines, to catch leaked tokens, keys, and credentials at commit time rather than after an incident.
3. Unified reporting that ties findings from multiple tools into a single, auditable view that maps cleanly to NIS2 and CRA evidence requirements.

We deliberately put the OCPI 2.2.1 interoperability surface at the centre of the exercise. OCPI is the layer that connects our platform to roaming partners across Europe. It is where a vulnerability stops being an internal problem and becomes a shared one. Validating CONSOLE against this surface gave us hard signal on whether the tooling can support not just our own service, but the wider ecosystem we are part of.

Results: Every Objective Met, Above Target

Every technical and business objective declared in our approved proposal was achieved above target.

What that meant in practice:

• Findings were triaged faster, with fewer false positives reaching engineers.
• The unified reporting layer accelerated our NIS2 documentation cycle, turning what used to be a quarterly scramble into a continuous, evidence driven process.
• The work directly informed the EVC Guardian Cybersecurity-as-a-Service blueprint that we will offer to Charge Point Operators across the EU.

In other words, the validation was not just a tick box exercise on a research project. It changed how we build and how we will help others build.

EVC Guardian: Cybersecurity-as-a-Service for Charge Point Operators

The EV charging market is full of operators who know they need to harden their software stack but do not want to build a dedicated security function from scratch. EVC Guardian is being designed for exactly that audience.

The service combines:

• Unified, audit ready reporting aligned to NIS2 and CRA evidence requirements.
• Advisory support for vulnerability response, secure development practices, and roaming partner due diligence.

The goal is simple: let operators focus on building a great charging experience while we take on the heavy lifting of keeping the software stack defensible.

Let’s Talk

We are actively looking for partners on the next phase of this work.

• Charge Point Operators who want to onboard early to EVC Guardian Cybersecurity-as-a-Service.
• Research consortia and SMEs building proposals under Horizon Europe, Digital Europe, or related funding lines, where secure EV charging software is in scope.
• Roaming partners and platform vendors who want to align on a higher security baseline across the OCPI ecosystem.

Contact us to discuss a new research project, a joint proposal, or an EVC Guardian engagement for your operation. We are happy to share what we learned during CONSOLE and to scope concrete next steps for your environment.

I am text block. Click edit button to change this text. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.