Collaboration Brief // 20·05·2026 // For Dr. Héjja Róbert István, CEO, BPNE Zrt.

The autonomy layer
for C2-integrated
defence operations.

Prepared by
Eduard Dulharu
Founder & CTO · vExpertAI GmbH · Munich
Strictly confidential
For BPNE Zrt. internal use
Doc rev. 2026-05-20
02 / Premise // from Daniela's note & your reply

Why this
conversation,
and not a pitch.

This analysis explores strategic partnership models between vExpertAI and BPNE, examining three collaboration frameworks ordered by strategic depth: technology integration with AI autonomy embedded in BPNE's C2 platform, joint go-to-market for CEE defense and critical infrastructure tenders, and reseller/integrator distribution across BPNE's customer base.

It answers BPNE's five screening questions in order — in defence vocabulary, not SaaS vocabulary — before arriving at the partnership models above.

BPNE owns the sensor, RF and C2 layer around critical infrastructure. vExpertAI builds the autonomy layer that turns that telemetry into operator-grade decisions at machine speed.

We have read your portfolio. We are not here to sell you a SOC tool.

03 / Thesis // the missing layer between sensor and operator

Between sensor flood and operator decision,
there is one layer most C2 stacks do not have.

LAYER 1 · BPNE
Sensors & C2

Radar, RF, EO/IR, drone-recognition models, network telemetry, integrated command platforms — already deployed.

LAYER 2 · vExpertAI
Autonomy

Six fine-tuned agents that triage, correlate, diagnose and pre-decide — at machine speed, on-prem, with verifiable outputs.

LAYER 3 · OPERATOR
Command

Stays in command. Approves kinetic / critical actions. Freed from L1 / L2 toil. Sees the picture, not the firehose.

BPNE owns Layer 1. The operator owns Layer 3. Layer 2 is the structural gap bridged today by hiring more analysts — when there are no more analysts to hire.

04 / Context // what defence operators are seeing in 2026

The threat
surface fused,
not separated.

Drone swarms, AI-generated cyber intrusions, hybrid kinetic & digital incidents — all hitting the same operator, on the same screen, at the same time.

500K+
EU cybersecurity skills gap
2026
First large-scale AI-generated attacks — ENISA
Jan ’25
DORA enforcement live
18
NIS2-regulated sectors across NATO allies

Sensor fusion is no longer optional. Adding more dashboards does not solve the operator-bandwidth problem. Adding an autonomy layer does.

05 / Filter 01 // use cases in operational vocabulary
Q1 — Use cases
"What are the main use cases of your AI solution in NOC / SOC environments?"

Six outcomes,
told the way
an operator tells them.

  • A · Triage90%+ noise reduction across mixed SIEM / EDR / NDR / sensor feeds via context-aware correlation.
  • B · CorrelationCross-domain fusion of kinetic and cyber events — drone incursion + RF anomaly + network spike treated as one incident.
  • C · DiagnosticsNetwork fault isolation, configuration drift, asset-behaviour anomalies — diagnosed without opening a CLI.
  • D · ResponseAutomated runbook execution with human-in-the-loop gates for every kinetic or critical action.
  • E · HuntingContinuous hypothesis generation and IOC pivot against local telemetry — no data leaves the perimeter.
  • F · ReportingAuto-generated incident narratives aligned to NIS2 · DORA · NATO reporting templates.
06 / Filter 02 // sovereign by default
Q2 — On-prem deployment
"Can your solution be deployed on-premise — fully sovereign — for sensitive customers?"

Yes — and
specifically air-gap
capable.

Not "cloud-light". The same system that runs in our Munich lab runs disconnected, in your customer's enclave, with no telemetry leaving the perimeter.

  • 01Fully air-gap capable. Zero outbound telemetry. No external API calls.
  • 02Containerised (Kubernetes / Docker) on customer-owned hardware.
  • 03Local LLM inference — fine-tuned models stay inside the enclave. No weights leave.
  • 04CPU-only mode supported for restricted environments. GPU optional for throughput.
  • 05Encryption at rest, RBAC, full audit logging suitable for defence-grade review.
  • 06Architecturally compatible with DORA + NIS2 + EU AI Act simultaneously.
07 / Moat // what makes this defensible

Not a
GPT wrapper.

Six domain-specific models, fine-tuned on twenty years of proprietary NOC / SOC operating data. Built from first principles — not stitched together with prompts.

  • ModelsSix custom agents, fine-tuned on 20+ years of proprietary NOC / SOC operational data.
  • ValidationDigital-twin validation on every action — prevents hallucinated configurations from reaching live networks.
  • VerifiabilityA verifiability wrapper sits around every agent action: full provenance, full rollback, auditable.
  • ProtocolAgent-to-agent A2A protocol over Redis + MCP. Each agent independently inspectable.
  • WindowThe window to build defensible domain models closes in ~18 months before hyperscalers commoditise the layer.
08 / Architecture // the production multi-agent team

A team of agents,
not a single oracle.

Live in production at scanner.vexpertai.com — orchestrated by a team leader, supervised by an architect, audited continuously.

// Orchestrator
Team Leader
Routes work, owns context, decides when to escalate to the human operator.
// Diagnostics
Troubleshooting
Fault isolation across network, security and infrastructure layers.
// Posture
Stability
Configuration drift, capacity, predictive failure signals.
// Threat
Security
Incident triage and threat hunting against local telemetry.
// Design
Virtual Architect
Validates changes against a digital twin before any live application.

Stack note: A2A protocol over Redis pub/sub + MCP. Not LangGraph, not a single-prompt wrapper. Each agent is its own container, its own model, its own audit trail.

09 / Filter 03 // integration into BPNE's existing C2 stack
Q3 — Integration
"What are the integration requirements with existing infrastructure and C2 stacks?"

Standard rails
where they exist —
an SDK where they don't.

No forklift upgrade. We sit beside what BPNE already deploys; the agent SDK lets us bind to bespoke C2 / sensor platforms without round-tripping through generic SOAR vendors.

  • TelemetrySyslog · SNMP · NetFlow / IPFIX · STIX / TAXII
  • SIEMSplunk · Elastic · Microsoft Sentinel · QRadar
  • EDRCrowdStrike · SentinelOne · Microsoft Defender
  • NetworkSolarWinds · PRTG · Zabbix · vendor-native APIs
  • SOARServiceNow · Jira · custom REST · webhook bus
  • C2 / SensorDocumented agent SDK for bespoke C2 and sensor platforms — including BPNE's stack.
10 / Composition // agents inside BPNE's stack

How the autonomy layer
composes with BPNE's stack.

LAYER 1 · BPNE Sensors & C2 stack RF / radar / EO-IR sensor mesh Counter-UAS recognition models Integrated C2 / command platform Network & security telemetry EVENTS / TELEMETRY → LAYER 2 · vExpertAI Autonomy layer TEAM LEADER TRIAGE Troubleshooting POSTURE Stability THREAT Security DESIGN Virtual Arch. A2A · REDIS · MCP · DIGITAL-TWIN VALIDATION VERIFIABILITY WRAPPER · LOCAL LLM INFERENCE DECISIONS / NARRATIVES → HUMAN-IN-LOOP GATES LAYER 3 Operator — Sees pictures, not firehoses — Owns kinetic decisions — Stays in command FOOTPRINT · ENTIRELY INSIDE THE CUSTOMER PERIMETER · ZERO EGRESS · DORA·NIS2·EU AI ACT COMPLIANT
11 / Filter 04 // the credibility slide
Q4 — NATO experience
"What is your experience with NATO and defence-grade procurement?"

Built by an
operator — not a
career SaaS founder.

The founder of this company once sat in the seat the customer sits in. The product is designed for that seat.

Eduard Dulharu
Founder & CTO · vExpertAI GmbH
Military
Military Technical Academy graduate · former Deputy Commander (Technical) of a Surface-to-Air Missile unit
Industry
20+ years network architect at AT&T and Kyndryl, across critical-infrastructure customers
Active engagement
Live pipeline with a European Defence & Aerospace Group · €150K engagement
Design baseline
Aligned with NATO AC/322 data-handling principles · STANAG-compatible reporting outputs
12 / Filter 05 // three open doors, one preferred entry
Q5 — Partner models
"What are the partner models you are open to? Are there opportunities for a closer collaboration or strategic investment?"

Three open doors.
One we'd walk through first.

Lead
01 · Technology integration

vExpertAI agents embedded as the autonomy layer inside BPNE's C2 / monitoring platform.

White-label or co-branded. BPNE owns the customer; we provide the engine. Where the moat is shared — and the wider conversation becomes natural.

02 · Joint go-to-market

One combined offering into Hungarian and CEE defence / CNI tenders.

Shared bid roles, shared proposal effort. Anchor: any near-term BPNE tender where an autonomy layer changes the score.

03 · Reseller / integrator

BPNE distributes vExpertAI across its existing customer base.

Fastest to start, lowest ceiling. Open — but not where value compounds for either side.

A 20-minute call lets us pick the right shape against BPNE's roadmap — not against ours.

13 / Strategic fit // what changes for BPNE

What changes for BPNE
once Layer 2 is owned.

  • 01
    Tender competitiveness. An autonomy layer is increasingly an unstated requirement in CEE / NATO Eastern-Flank defence and CNI tenders. Carrying it natively raises BPNE's score.
  • 02
    Direction-of-travel alignment. The €26.8M GINOP_PLUSZ-2.1.3-24 production-innovation programme already pushes BPNE up-stack. Layer 2 is the natural next step.
  • 03
    Independent positioning. Hungary's defence industry is consolidating under 4iG / N7 Defence. BPNE is outside that perimeter — and benefits from differentiated AI capability none of the consolidated entities can show.
  • 04
    Operator-grade output. BPNE's existing customers already speak in incidents, not alerts. The autonomy layer speaks the same language.
  • 05
    Joint export angle. NATO Eastern Flank, MENA, LATAM — all markets where sovereign on-prem is a hard requirement and where BPNE already has reach.
  • 06
    Founder-network alignment. Both companies share a worldview: critical infrastructure needs sovereign, on-prem, AI-native defence — built by people who have worn the uniform.
14 / Timing // the 18-month window

A narrow
window of
opportunity.

Eighteen months until hyperscalers commoditise generic AIOps. The defensible position is built now or not at all.

  • ‘25
    DORA enforcement live since January 2025 — compliance demand is mandatory.
  • ‘25
    NIS2 transposition deadlines hitting across NATO-aligned EU.
  • ‘26
    ENISA forecast: first large-scale AI-generated cyber attacks land this year.
  • ‘26
    Ukraine combat lessons reshape EU C-UAS and CNI procurement specs.
  • ‘27
    By 2027, sovereign autonomy layers transition from differentiator to checkbox.
15 / Scenarios // three concrete operating pictures

Three pictures of what
a joint customer looks like.

Airport

BPNEApproach-airspace counter-UAS · perimeter RF defence · drone-recognition layer.
vExpertAIAutonomous SOC / NOC for the IT & OT network — ATC, baggage, building systems.

Military base

BPNEPerimeter air defence, sensor mesh, integrated C2 against drone and RF threats.
vExpertAIInternal network & command-system defence — at the same operator console.

Energy / national grid

BPNEDrone & airspace cover for substations, gas terminals, transmission infrastructure.
vExpertAIContinuous network & security monitoring across OT and IT — NIS2 / DORA aligned reporting.
16 / Next steps // what we propose, in order

A three-step path,
each step cheap
and reversible.

PHASE 01 · this month
Technical workshop
One day, virtual or in Budapest. Two-way capability deep-dive. Integration points scoped against BPNE's C2 stack and at least one named near-term opportunity. Working session, not pitch.
PHASE 02 · Q3 ’26
Joint demo
Representative scenario combining BPNE's sensor / C2 feed with the vExpertAI autonomy layer. Shown on a digital twin — no live customer required. Ready for a procurement audience.
PHASE 03 · Q4 ’26
Pilot customer
One shared customer for a joint proof-of-concept — EU-funded if eligible. Commercial framework signed. Door opens to deeper strategic alignment if both sides want it.

Out of scope for this brief: any investment conversation. Open if and when the partnership shape is clear — on BPNE's timeline, not ours.

17 / Close // operator to operator

BPNE owns the airspace.
We can own the autonomy
inside it — together.

Twenty minutes on a call. Five questions answered. The right next step picked against your roadmap, not ours.

vExpertAI × BPNE
01 / 17
Munich · Budapest · 2026-05-20
Cover