RAISE - AI-Powered Predictive Risk Management for Strategic Infrastructure
RAISE (Risk AI SecOps) is Fidem’s platform for predictive, continuous risk management across portfolios of strategic infrastructure. It combines the ISO 31000 framework with artificial intelligence modules, digitizes documentation directly on site and correlates risk indicators across sites in a single operations center in Italy, giving every prediction a readable explanation. The machine signals and explains; the decision stays with a person.
The Limits of Traditional Risk Management
Even when it follows ISO 31000, traditional risk management takes a picture of the past: assessments happen at fixed intervals, risk matrices do not update when the context changes, and a significant share of technical information about the assets remains in paper archives or unstructured digital folders, hard to use for systematic analysis.
In organizations spread across many locations there is also the problem of silos: each site knows its own perimeter, but information reaches the upper levels late, badly aggregated or not at all. The result is a system that reacts to events instead of anticipating them, and that does not help decide where to focus resources and interventions.
Four Principles
Prediction
Before the reaction
RAISE signals the growing probability that a risk will materialize before historical data confirms it, combining the condition of the assets with environmental, territorial, operational and threat context factors. Those managing the infrastructure have time to act, not just to document.
Dynamism
A map that updates itself
The risk map is not an annual document: it updates as the internal and external context changes, with the trajectory of every asset over time. A relevant new data point is reflected in the assessment within the day, not at the next review.
Human control
The machine supports, it does not replace
Every prediction comes with a natural language explanation produced by the explainable artificial intelligence module. No assessment moves into the treatment phase without formal approval, recorded with its reasons.
Organization
Data, technology and culture together
The platform creates value only if the data is reliable, the technology is adequate and people use it in their processes. That is why RAISE builds on the classification process already in use, replicating its phases, and provides training and change management alongside development.
Three Levels and a Pyramid
RAISE is distributed over three levels, with a pyramid view that lets every organizational level manage its own perimeter and aggregate the data of the levels below. The model follows the architecture of the Defensio ecosystem, already in operation: sensors at the edge, a managed operations center, cloud services.
At the edge, at every site
RAISE Sensor
A physical or virtual appliance installed at each infrastructure or local facility, on the model of Defensio Sensor. It keeps the local asset register with technical characteristics, state of conservation and intervention history. It digitizes paper documentation with OCR and extraction of technical data; original documents never leave the site. The appliance has disks encrypted at rest and runs locally the predictive model distributed by the SOC, even without a connection.
At the center, on-premises in Italy
RAISE SOC
The Risk & Security Operations Center combines security operations and risk management in a single facility, on the model of the Defensio SOC. It receives telemetry and indicators from the Sensors over encrypted channels, correlates signals across different sites, trains and updates models on air-gapped infrastructure with no calls to external services, and manages the validation gate. Analysts read together the indicators of the assets’ condition and the external risk factors, for a single risk assessment per asset.
At the intermediate and top levels
Pyramid view
The local node sees its own perimeter. The intermediate node, regional or organizational, receives the indicators of the dependent nodes in a consolidated dashboard with authorized drill-down. The top node has the overall view, compares facilities, identifies systemic risks and defines policies valid for the whole organization. No black box: every level has full access to its own instance, and every node can work disconnected.
The guiding principle is that data stays as close as possible to its origin: documents and detailed data in the Sensor, telemetry and indicators at the SOC, only aggregates at the upper levels. Synchronization over TLS 1.3 encrypted channels, data at rest encrypted with AES-256, keys managed locally.
Intelligence Engine: the AI Modules
The Intelligence Engine is the heart of the platform: models are trained in the SOC and run both at the center and at the edge. Five modules, each with a precise task.
Training at the SOC · inference everywhere
Endogenous and exogenous predictive model
It combines the condition and characteristics of the assets (endogenous factors) with environmental, territorial, operational and threat context factors (exogenous factors), and produces a predictive indicator for every asset.
At the SOC
Supervised machine learning
It recognizes the patterns that preceded events and incidents and updates itself with new data. It is the module that learns from the organization’s own history, not from a generic dataset.
In the Sensor
NLP Document Intelligence
It extracts technical data and new risk factors from documents, including those acquired via OCR. Extracted data remains provisional until an operator confirms it.
At the SOC
Probabilistic simulation
Monte Carlo methods to estimate impacts and scenarios, supporting the prioritization of interventions and the allocation of resources.
Sensor and SOC
XAI: explainability
It explains every prediction in natural language with SHAP and LIME techniques, supporting compliance with the European AI Regulation.
From Inventory to Treatment Plan
The workflow engine brings the Analysis → Risk Assessment → Risk Management flow into the platform and builds on the existing classification process: current phases are replicated in a configurable way, and the platform adds predictive indicators and validation points.
Analysis
Asset inventory, acquisition and digitization of documents in the Sensor, data quality checks. Output: validated asset records, with the source, date and reliability level of every piece of information.
Risk Assessment
Threats and risks, cause-and-effect relationships, probability and impact, predictive indicators. Output: an assessment per asset, with its trajectory over time.
Validation
Formal review of the results by the designated managers, with the reasons recorded. Output: an approved assessment.
Risk Management
Vulnerabilities, treatment actions, prioritization, allocation of resources and interventions, monitoring. Output: a treatment plan, tracked in the governance dashboard.
No assessment feeds treatment without explicit approval
The validation gate is the point where human control becomes a recorded fact and not a statement: who approved, when, why. It is what makes the platform traceable for auditors and supervisory bodies, and compliant with the human oversight requirement of the AI Act (Regulation (EU) 2024/1689).
Risk Cockpit: See, Explain, Trace
The Risk Cockpit is the web interface available at every level, with views tailored to three profiles: operator, facility manager, executive level. It offers the dynamic risk register with its trajectory over time, the per-asset view with current classification, predictive indicator, security status of the site network and assessment history, alerting ordered by urgency with evidence and a suggested corrective action, and an immutable audit trail of every operation.
Every piece of data carries its source, date and reliability. Every prediction carries its own explanation. Every decision carries who made it. It is this chain, not the algorithm, that makes the platform defensible before an auditor.
Standards and Certifications
RAISE is designed in compliance with ISO 31000 for the risk management process, ISO/IEC 27001 for information security, ISO/IEC 27701 for privacy, Regulation (EU) 2024/1689 (AI Act) for the transparency, explainability, robustness and human oversight requirements of high-risk AI systems, and the GDPR with privacy by design and by default. The architecture supports the technical obligations of Article 21 of the NIS2 directive: continuous monitoring, vulnerability management, up-to-date asset inventory, supply chain security and support for incident notification.
Fidem, which develops and runs the Defensio ecosystem with the same deployment model as RAISE, is certified ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO 9001 and operates its own SOC in Italy.
Who It Is For
RAISE is built for those who manage large portfolios of infrastructure and organizations with a hierarchical or territorial structure: operators of infrastructure networks, bodies with local and central facilities, organizations working in high-security environments or with industrial systems, PLCs and SCADA, and anyone with a mixed paper and digital document base from which it is hard today to extract a systematic assessment. It suits those who already have a risk classification process and want to make it predictive, not those looking to replace it.
The Same Deployment Model as Defensio
RAISE adopts the distributed architecture with which Fidem already runs the Defensio ecosystem, and gives each level a role in risk management. The Sensor in RAISE becomes the outpost of every infrastructure: it keeps the site’s asset register and digitizes the documentation. The SOC in RAISE trains the models, correlates the signals coming from the sites and hosts the validation gate that approves every assessment before treatment.
It is a model designed for organizations spread across many locations: every node works on its own perimeter, can also operate disconnected, and synchronization happens over encrypted channels with locally managed keys. The operations center can be run by Fidem, by the organization with Fidem’s support, or in hybrid mode, depending on how much direct control the organization wants to keep.
Open, Modular, Step by Step
The platform is open and modular, and is adopted step by step: a demonstrator on a pilot sample of sites with the first Sensors, then the SOC for cross-site correlation, and finally the pyramid across the whole portfolio. Every function is accessible through open APIs, with import and export in standard formats and no vendor lock-in. Threat intelligence is integrated through STIX/TAXII and MISP and with official vulnerability sources; connectors to existing ERP, maintenance management systems, SIEM and document archives are agreed at kick-off.
Risk taxonomy, process phases, thresholds and validation rules are configurable without software development. The typical path starts with a demonstrator on a small sample of assets, with demo sessions and periodic progress reviews, and extends to the whole portfolio only after a joint validation of the results.
Frequently Asked Questions about RAISE
Does RAISE replace the risk classification process we use today?
No. The workflow engine replicates the phases of the existing process in a configurable way and adds predictive indicators and validation points. People keep working in the flow they know; what changes is the quality and timeliness of the information they receive.
Do the assets' technical documents end up in the cloud?
No. OCR digitization and data extraction take place in the RAISE Sensor, at the site, on encrypted disks. The SOC receives telemetry and indicators; the upper levels receive only aggregated data.
Does the AI decide on its own?
No. Every prediction comes with a natural language explanation and no assessment moves into the treatment phase without a recorded formal approval. The models are trained on on-premises infrastructure in Italy, air-gapped, with no calls to external services.
Who validates automatically extracted data?
Every piece of data is associated with a source, a date and a reliability level. Data the Sensor extracts automatically from documents remains provisional until an operator confirms it: no unvalidated data enters the risk assessment.
Can we start small?
Yes, and it is the recommended path: a demonstrator on a pilot sample of assets, with Sensors installed only at the chosen sites, and extension to the whole portfolio only after joint validation of the results.
Anticipate the Risk, Not the Incident
Contact us for a RAISE demonstration or to assess together how to add prediction to your risk classification process.
Read more: Risk Management · Defensio Ecosystem · NIS2 Compliance · Certifications