Two Portuguese Firms Built the Armed Forces an AI That Hunts Its Own Vulnerabilities, for 920,000 Euros of Recovery Plan Money
BlackRoute and Ethiack delivered Digital Sentinel and AI Ethical Hacking to the Cyberdefence Operations Command. Both went into use in June and were validated by ARTE and the European Commission on 31 August.
Two Portuguese companies, BlackRoute and Ethiack, have delivered the artificial intelligence systems now running inside the Armed Forces' cyberdefence command. The two projects, named Digital Sentinel and AI Ethical Hacking, were an initiative of the Estado-Maior-General das Forças Armadas through its Cyberdefence Operations Command, and cost more than 920,000 euros, financed entirely by the Recovery and Resilience Plan.
A spokesperson for the general staff told ECO that work began in September 2025 and finished in June 2026, at which point the Cyberdefence Centre's operations command started using both. On 31 August they were validated by ARTE, the state technology reform agency, and by the European Commission. That date is not incidental: it was the final deadline for recovery plan milestones.
What the Two Systems Do
Digital Sentinel uses AI to monitor continuously the systems, applications and services the Armed Forces expose to the internet. It identifies assets, analyses them and ranks the risks, with the aim of giving a current picture of the military's digital exposure rather than a picture refreshed every audit cycle. The premise is that a large organisation does not reliably know what it has connected, and cannot defend what it has not inventoried.
AI Ethical Hacking automates penetration testing and, more to the point, raises how often it happens. Rather than a set-piece annual exercise, the system runs recurring tests to find vulnerabilities before an attacker does, prioritising the most serious findings and shortening the time between a weakness appearing and someone noticing it.
Both automate the repetitive collection and analysis work that consumes security teams, which is the stated justification: freeing the people to concentrate on the risks that matter. The general staff is explicit that the AI is a support tool and that human supervision over results and operational decisions remains.
Built for Three Branches and for Segregated Networks
The capabilities are being developed so that the Navy, the Army and the Air Force can all use them. Any branch can be covered by the asset discovery and the testing, and the general staff says the architecture was designed for different network environments, including segregated networks, meaning the classified or air-gapped systems that ordinarily sit outside the reach of internet-facing security tooling.
The Procurement Point
The detail worth holding onto is who built it. Ethiack is a Portuguese offensive-security company working on autonomous ethical hacking; BlackRoute is likewise a domestic cybersecurity firm. A defence ministry buying AI-driven security capability could straightforwardly have bought an American or Israeli product. It bought two national ones, with European money, and had the result validated in Brussels.
That fits a pattern visible across Portuguese defence spending this year. Portugal has stood up a 21-person office to spend 5.84 billion euros of EU defence loans, and the pressure attached to that money is as much industrial as military: the loans are meant to be spent inside Europe, and where possible with suppliers who employ people in the country doing the spending.
The sum here is small, 920,000 euros against billions, and the two projects are tools rather than platforms. But they are a working example of the sequence the government keeps describing in the abstract: European funding, a national requirement, a domestic supplier, delivery on time and formal validation. The recovery plan produced a great many commitments that will be argued over for years. This one was finished in June, is in operational use and has been signed off.
