Water CIs are exposed to a wide number of IT challenges that go from the cooperation and alignment between physical and cyber security teams to the proliferation of new vulnerabilities and complex cyber-attacks with potential disastrous consequences. Although novel and powerful solutions are proposed in the literature, most of them lack appropriate mechanisms to detect cyber and physical attacks in real time. We propose a Cross-Layer Analytic Platform (denoted as CLAP) developed for the correlation of Cyber and Physical security events affecting water CIs. CLAP aims to improve the detection of complex attack scenarios in real time based on the correlation of cyber and physical security events. The platform assigns appropriate severity values to each correlated alarm that will guide security analysts in the decision-making process of prioritizing mitigation actions. A series of passive and active attack scenarios against the target infrastructure are presented at the end of the paper to show the mechanisms used for the detection and correlation of cyber–physical security events. Results show promising benefits in the improvement of response accuracy, false rates reduction and real-time detection of complex attacks based on cross-correlation rules.

In the recent years, the majority of the world’s Critical Infrastructures (CIs) have evolved to be more flexible, cost efficient and able to offer better services and conditions for business growth. Through this evolution, CIs and companies offering CI services had to adopt many of the recent advances of the Information and Communication Technologies (ICT) field. This rapid adaptation however, was performed without thorough evaluation of its impact on CIs’ security. It resulted into leaving CIs vulnerable to a new set of threats and vulnerabilities that impose high levels of risk to the public safety, economy and welfare of the population. To this extend, the main approach for protecting CIs includes handling them as comprehensive entities and offer a complete solution for their overall infrastructures and ICT systems (IT&OT departments). However, complete CI security solutions exist, in the form of individual products from IT security companies. These products, integrate only in-house designed and developed tools/solutions, thus offering a limited range of technical solutions.

Cultural heritage assets are exposed to diverse environmental, structural, geological, biological, and anthropogenic threats, yet IoT monitoring strategies remain largely site-specific. This study presents and validates the ARGUS framework, a threat-oriented methodology that defines monitoring requirements according to deterioration mechanisms rather than monument typology. The framework integrates heritage characterization, risk assessment, threat-to-sensor mapping, and IoT deployment and was evaluated across five contrasting European heritage sites. Priority threats identified through preliminary risk assessment were compared with evidence obtained from environmental, structural, and operational monitoring. The results showed strong correspondence between the anticipated threats and the deterioration processes observed during monitoring, while also enabling their relative importance to be reassessed. Cross-site comparison revealed recurring relationships between environmental forcing and material or structural responses and showed that heritage assets affected by similar deterioration mechanisms required comparable sensor configurations despite differences in typology, materials, and geographical setting. These recurring configurations were consolidated into transferable monitoring packages addressing moisture, climatic exposure, structural stability, pollution, and operational pressures. The ARGUS framework therefore provides a scalable approach for translating conservation risks into targeted monitoring strategies, supporting risk-informed preventive conservation across heterogeneous cultural heritage contexts.