Decent Cybersecurity today announces the open-source release of the SynapseCommand integration layer. The release comprises the platform's Canonical Data Model, its published JSON Schema, ten verified format adapters, and the software development kit and validation harness used internally by the company. The SynapseCommand product itself remains proprietary.

The interoperability challenge

Modern defence and security operations depend on a common operational picture assembled from numerous data sources, each governed by a different standard. These include ASTERIX, the EUROCONTROL standard family used by air surveillance radars across Europe, defined category by category (CAT021 for ADS-B target reports, CAT048 for radar target reports, CAT034 for radar service messages, among others); STANAG 4676, the NATO standard for exchanging tracking information between nations and systems; STANAG 4607, the NATO format for ground moving target indicator radar data; ADS-B and AIS, the standard broadcasts for aircraft and vessels respectively; TAK, the Team Awareness Kit used by NATO forces, special operations and first responders; and commercial platforms such as Picogrid, together with positioning and navigation feeds.

Each standard defines its own structure, units and semantics. Connecting N systems directly requires N(N-1)/2 discrete translations. For ten systems, this amounts to forty-five translators, each developed, tested and maintained separately, and each a potential point of silent data corruption. In an operational context, undetected corruption of position data constitutes a material risk.

The Canonical Data Model

The release is centred on the Canonical Data Model (CDM), a single intermediate representation through which all connected systems exchange data. Each external format is translated into the CDM once, and out of it once where bidirectional traffic is required. Ten systems therefore require ten adapters rather than forty-five translations, and each additional system requires exactly one further adapter. The integration cost declines with every system added.

Contents of the release

The public repository is published under the Apache 2.0 licence and contains:

The Canonical Data Model, version 1.0.0. Four core objects: Entity (a physical object such as an aircraft or vessel), Event (an occurrence), Track (a sequence of observed positions over time), and PlanObject (an intended construct such as a route or area). All supported formats map into these four objects.

The published JSON Schema. The machine-readable specification of the contract. Partners developing in Go, TypeScript, Rust or any other language can validate their data against it without reference to the company's source code.

Ten verified adapters. PNTMAP, TAK, AIS, ADS-B, Picogrid, ASTERIX CAT021, CAT048 and CAT034, STANAG 4676, and STANAG 4607. The five binary formats are verified byte-exact: decoding a message and re-encoding it produces identical output, bit for bit. This property is confirmed automatically on every test run rather than asserted in documentation.

The adapter SDK and validation harness. The harness constitutes the acceptance gate for every adapter, whether developed by the company or by a partner. External developers connecting new systems to the CDM use the same tooling and acceptance criteria applied internally.

Architectural boundary

The SynapseCommand product, comprising the fusion, correlation, analysis and operational capability built on the integration layer, remains proprietary. The separation is deliberate: the public repository constitutes the contract layer; the proprietary codebase constitutes the value layer.

This boundary is enforced technically rather than by policy. The public repository depends on exactly two established open-source libraries and contains no dependency on the product codebase. An automated structural check inspects the source on every test run and fails the build if this condition is violated. Adapters are further restricted to translation alone: no fusion, no inference, and no joining of data sources is permitted within the public layer.

Rationale

Accelerated integration. Partners, system integrators, prime contractors and customers can develop against the data model immediately, without an NDA cycle or technical exchange meeting.

Reduced procurement risk. Evaluating organisations need not accept interoperability claims on trust. The interface layer, field-by-field format coverage tables and full test suite of over 2,400 automated tests are available for independent inspection and execution from a fresh download.

Demonstrable engineering discipline. Every adapter is developed specification-first, against the official published standard, with the exact edition recorded by cryptographic hash and date in the repository. The precise standard edition implemented by each adapter is independently verifiable.

Compliance with standards bodies' terms. The repository redistributes no standards documents. EUROCONTROL and NATO publications remain under their publishers' terms; the repository records what is implemented and where the source documents may be obtained. Distribution rights for every referenced document were verified prior to publication.

A neutral contract layer. Broader adoption of the contract layer increases its value to every connected party. The combination of open interfaces and proprietary capability is an established model across modern infrastructure software.

Quality assurance

The release is supported by several assurance measures beyond conventional testing.

The test suite itself is validated through mutation checking: specific defects are deliberately introduced and the suite is verified to detect them, confirming that each test guards against the failure it claims to cover.

The complete repository history was audited prior to publication. Every version of every file, from the initial commit onward, was reviewed to confirm the absence of standards documents, credentials, keys, or classified or restricted content.

Contribution governance is enforced automatically. External contributions operate under the Developer Certificate of Origin, the mechanism used by the Linux kernel, verified on every pull request. The main branch is protected against force-pushes and deletion.

The external user experience has been verified empirically. Following publication, the company confirmed that a fresh anonymous download, following only the README instructions, concludes with the full test suite passing.

Roadmap

The roadmap published in the repository identifies the next two adapters: ASTERIX CAT062, covering system tracks produced by fused radar processing chains, and CAT023, covering service status messages. Both are scoped in the public format coverage tables.

Summary

Decent Cybersecurity has published the contract, not the product. The contract layer is where trust is established with partners and procurement authorities; the product is where operational capability resides. Interoperability claims can now be verified independently, on the evaluator's own infrastructure, without the company's involvement.

The repository implements published EUROCONTROL and NATO standards. It has not been reviewed, certified or endorsed by those organisations.

SynapseCommand® is a product of Decent Cybersecurity, holder of NATO SECRET and EU SECRET facility clearances and a selected participant in the NATO DIANA Decision Superiority Challenge.

Decent Cybersecurity is a European defence deeptech specialising in sovereign AI, post-quantum cryptography and quantum-resistant blockchain, holding NATO SECRET facility clearance, ISO 9001 and ISO 27001 certifications, and participating in EU EDF: AIDA (Artificial Intelligence Deployable Agent) as a consortium participant and NATO DIANA as a selected innovator. The company operates entities in Slovakia, Czechia, Poland, Austria, Ireland, the United Kingdom, Canada and the United States. Download the capability brief.

SC-LOG-01 · Logistics Agent

Decision support for sustainment and convoy planning. SC-LOG-01 separates recorded-state calculations from forecasts. Current stock, readiness, consumption and resupply figures are calculated from customer-held source data by deterministic services, so every current-state figure can be traced back to its source record. Forecasts may use approved analytical models calibrated on historical usage and are clearly labelled as forecasts with traceable inputs. A language model may support task interpretation, structured reasoning and explanation, but it does not invent the underlying source figures. SC-LOG-01 was originally developed as an internal reference implementation used to establish and exercise the platform's agent pattern. It is newly included in the released Warfighting Agent Suite, rather than newly conceived at the time of this release, and it remains the most extensively exercised agent in the product.

SC-LNP-01 · Logic and Planning Agent

Structured reasoning and plan decomposition. The agent breaks a commander intent into ordered, checkable planning steps, making intermediate reasoning visible and inspectable. Staff can challenge a plan at the specific step where they disagree rather than accepting or rejecting it whole. It also serves the rest of the suite as a rigour layer, supplying structured task decomposition that other agents build on.

SC-STR-01 · Strategy and Doctrine Agent

Strategic-level and doctrinal analysis. The agent grounds operational recommendations in doctrinal sources and standing guidance, making alignment with doctrine an explicit, recorded step in the decision process rather than an assumption left to individual staff memory. Its assessments are written to the decision record alongside the recommendation they qualify.

SC-WHT-01 · White Force Agent

Exercise control for the training variant of SynapseCommand. The agent supports exercise directors with scenario adjudication, dynamic event injection and exercise management, enabling units to train against the same agent suite they would operate with. It ships only in the training variant, a deliberate separation that keeps exercise tooling out of operational deployments and out of operational accreditation scope.

SC-ATO-01 · Air Tasking Agent

Air tasking order workflows, delivered in the dedicated Air Tasking package. The air tasking cycle is among the most process-intensive activities in joint operations, with rigid timelines and heavy coordination demands. The agent supports development and management of the cycle within the same governed framework as the rest of the suite: outputs pass the evaluator, records are written to the decision ledger, and a human remains in command throughout.

Governance applies to every agent, without exception

The new agents inherit the full control set of the platform. Every answer follows one mandatory path: orchestrate, evaluate, append, deliver. A rejected answer returns its rejection reason to the commander, never the suppressed output. Every answer is written to the hash-chained decision ledger before a human sees it; with a signing key configured, each record carries an ML-DSA-87 (FIPS 204) signature, and without one the console reports the record as UNVERIFIED rather than presenting a false assurance. The models permitted to serve an answer are a register decision: a model tag that has not been approved is refused, never assumed acceptable, and the model that served each answer is recorded on the answer itself. SynapseCommand agent modules may combine deterministic software components, approved analytical models and, where appropriate, customer-approved self-hosted open-weight language models. Agent modules can use customer-approved, self-hosted open-weight models where model-assisted reasoning or language interaction is required. Deterministic calculations and policy services remain separate from model inference. Numerical calculations, policy evaluations and source-record retrieval remain separate from language-model generation. All model inference runs inside the customer's boundary, with zero external AI calls in runtime code, a property enforced by an automated test that parses every file in the codebase.

Verification

The expanded suite is backed by the platform's standing verification programme: 708 platform tests, 484 engine and conformance tests, and 404 offline tool-and-expectation checks. The verification record now holds 1,685 recorded question-runs, one file per agent per model set, each capturing the commit, component versions, models used and per-case pass rates. The newest agent completed its acceptance run across two model families with no failing and no flaky case.

What this means for customers

The expansion brings broader coverage of the staff function. Logistics, planning structure, doctrinal alignment, exercise control and air tasking now sit alongside the original eight agents in a single governed platform, reducing the number of disconnected tools a staff must operate. Deployment remains modular: each agent is independently deployable and can be removed without breaking the core platform runtime. Removing an agent also removes its functions and may disable or degrade declared dependent workflows, since agents exchange structured outputs and some supply a rigour layer to others. Dependencies are explicit and can be reviewed before deployment, so the platform keeps running and unaffected agents remain available, while the removed capability is genuinely absent rather than silently substituted. Above all, the expansion demonstrates that the agent pattern scales. Adding capability to SynapseCommand means adding an agent against published contracts, not redesigning the system. Five new doctrinal tasks arrive already governed, already auditable and already under the customer's control.

Briefings on the expanded suite are available under NDA. Classified briefings can be arranged through cleared channels. The SynapseCommand capability brief is available to download from this site.

Decent Cybersecurity is a European defence deeptech specialising in sovereign AI, post-quantum cryptography and quantum-resistant blockchain, holding NATO SECRET facility clearance, ISO 9001 and ISO 27001 certifications, and participating in EU EDF: AIDA (Artificial Intelligence Deployable Agent) as a consortium participant and NATO DIANA as a selected innovator. The company operates entities in Slovakia, Czechia, Poland, Austria, Ireland, the United Kingdom, Canada and the United States. Download the capability brief.

It is a room you don't find yourself in very often. Warfighters from SHAPE on one side of the table, engineers on the other, and a shared whiteboard in between. No layers of process, no theory of digital transformation. Just concrete operational problems and a hard deadline.

We prototype fast, we test with the people who fight, and we scale what works.

Col. Arnel David, Director of Task Force Maven, NATO SHAPE

Why we're here

SynapseCommand was selected in the NATO DIANA Decision Superiority Challenge, ranking in the top 2.34% of 427 submissions across 29 Allied nations. DIANA set the bar deliberately high for this challenge: TRL 7 or above, technology proven in an operational environment, ready to integrate within months rather than years. There is no accelerator phase and no second round. Selected companies go straight into workshops with ACO, receive €100,000 in contractual funding, and build towards a live demonstration to NATO commands by December 2026. Successful demonstrations open the door to follow-on contracts through DIANA's Rapid Adoption Service, without further competition.

London made the ambition of this programme tangible. We sat across from the people who will actually use this in an operation, and they told us plainly what works, what doesn't, and where the decision loop breaks. That is exactly the environment SynapseCommand was built for. Now we integrate, and we prove it.

Matej Michalko, founder, chairman, ceo, Decent Cybersecurity

Plugging into the Maven Smart System

The challenge is anchored on the Maven Smart System NATO (MSS NATO), the AI-enabled digital warfighting platform deployed at Allied Command Operations and stewarded by Task Force Maven. MSS NATO fuses data from multiple sources into a real-time, geospatially contextualised operating picture supporting situational awareness, targeting and operational planning. Crucially, it is an open, extensible platform, designed for exactly this kind of rapid third-party integration.

That is where SynapseCommand comes in. Our sovereign, post-quantum multi-agent AI platform runs up to twelve operational agents in parallel, from ISR fusion and red-force behaviour prediction to course-of-action analysis and operational planning, with every step sealed in a hash-chained, append-only audit ledger and, in assured deployments, signed with NIST-standardised ML-DSA cryptography; records produced without an active signing key are explicitly marked UNVERIFIED. The goal in this programme is straightforward: augment the decision loop that MSS NATO enables, without ever asking a commander to trust a recommendation that cannot be traced, verified or declined.

Speed and sovereignty are usually presented as a trade. We built SynapseCommand so they aren't. Models, weights, inference logs and keys stay in national custody; outputs stay explainable; weapon-relevant decisions stay with humans, by construction.

What happens next

The London kickoff concludes Stage 1 planning: validating use cases with the relevant NATO commands, defining the integration path, and setting up the accredited cloud environment where the work will happen. From here it's heads-down integration and rapid iteration with Task Force Maven and other cohort members, because in this programme the companies are expected to integrate with each other, not just with NATO, before a final demonstration to Allied Command Operations at the end of the year.

We are grateful to NATO DIANA, Allied Command Operations and Task Force Maven for the trust, and to the operators who spent the week telling us, with refreshing directness, exactly where the bottlenecks are. That candour is worth more than any funding line.

More updates as the integration progresses.

Decent Cybersecurity is a European defence deeptech specialising in sovereign AI, post-quantum cryptography and quantum-resistant blockchain, holding NATO SECRET facility clearance, ISO 9001 and ISO 27001 certifications, and participating in EU EDF: AIDA (Artificial Intelligence Deployable Agent) as a consortium participant and NATO DIANA as a selected innovator. The company operates entities in Slovakia, Czechia, Poland, Austria, Ireland, the United Kingdom, Canada and the United States. Download the capability brief.

Built around MSS NATO

DIANA announced the results on 9 July 2026 together with Allied Command Operations (ACO), headquartered at SHAPE in Mons, Belgium. Alongside Decent Cybersecurity, the selected companies are Matrix Pro Sims, Hadean, Watchtower Labs, Flai, Grist Mill Exchange, ETE Technology, Onebrief, Picogrid and Levato AS. Each receives €100,000 to integrate and demonstrate its solution with the Alliance's operational users.

The challenge is built on the Maven Smart System NATO (MSS NATO), a digital warfighting platform from US-based Palantir Technologies. It was procured by the NATO Communications and Information Agency (NCIA) in March 2025 for SHAPE; the acquisition took six months and ranks among the fastest in the Alliance's history. MSS NATO is an open and extensible platform into which vendor solutions integrate via API. On the NATO side, the system is owned by Task Force Maven at SHAPE.

NATO is not looking for more data in this programme, but for the ability to plan at the pace at which the situation changes. The entry bar was Technology Readiness Level 7 and above, meaning technology proven in an operational environment. There is no preparatory phase and no second round: companies go straight into workshops with ACO and must integrate with one another as well. Successful participants are then eligible for follow-on contracts without further competition.

Sovereign AI, post-quantum by design

SynapseCommand is built on sovereign artificial intelligence and post-quantum cryptography. Sovereign AI means models operated under European control, on infrastructure where it is clear who accesses the data and where it stays. Post-quantum protection addresses the other side of the same problem: every input into the operating picture is also an attack surface, and a spoofed input does not slow the decision loop down, it accelerates a wrong decision. ML-DSA signature verification takes tens of microseconds, so it does not delay the decision loop; SLH-DSA serves as a conservative backup for long-term trust anchors. Both NIST standards are designed to withstand attack by a quantum computer.

You couldn't apply to this challenge with a slide deck and a promise. The bar was technology proven in operation. But I want to be precise: this is not a deployment contract. It is the opportunity to demonstrate our solution to the people who would rely on it to make decisions in an operation.

Matej Michalko, founder, chairman, ceo, Decent Cybersecurity

In the Czech Republic, the perception persists that only large multinational corporations get into NATO programmes. Yet the criteria are technical. I appreciate the support of the Czech Ministry of Defence, CzechInvest and AOBP. There are more Czech teams that clear this bar than there are teams applying.

Karel Marčík, Country Manager, Decent Cybersecurity for the Czech Republic

The selected companies will spend the coming months integrating with NATO entities in a cloud environment. The programme culminates in a demonstration phase by December 2026.

About Decent Cybersecurity

Decent Cybersecurity specialises in sovereign artificial intelligence, post-quantum cryptography and quantum-resistant blockchain for the protection of critical infrastructure. It operates in space and satellite communications, aerospace and defence, and unmanned traffic management. In addition to the Czech Republic, it has entities in Slovakia, Poland, Austria, Ireland and the United Kingdom. The company holds industrial security clearance at the Secret level nationally as well as towards the EU and NATO, ISO 9001 and ISO 27001 certifications, is a registered NSPA supplier, an NCIA Basic Ordering Agreement (BOA) holder and a member of AOBP.

The original press release (in Czech) was distributed via Protext ČTK on 4 August 2026 and is available at https://www.protext.cz/zpravy/show/58650.

Decent Cybersecurity s.r.o. is selected by NATO DIANA for the Decision Superiority for NATO Warfighters programme. The company was supported by the Czech Ministry of Defence, CzechInvest and AOBP.