Request an intervention

Hardware and models

Whatever reads your network runs inside your perimeter.

Before you sign, four questions: where the compute runs, who wrote the software, who holds the model weights, and what leaves the perimeter. Here are the four answers — and the limits, stated on the same page.

Black-and-white view of the back of a patching cabinet, with tidy bundles of cable running down to the panels

With a subscription assistant it is not a document that leaves. It is the map.

  • The measurements, which are the baseline.

    Native OTDR traces are not files: they are the reference against which that network would notice it had been touched. Every tapping technique introduces a measurable loss — a clip-on coupler that bends the fibre costs about 1 dB or more — and it shows only against a certified baseline. Read the other way round, the same baseline says how much loss each link absorbs before anything trips. Upload it to a generic assistant and you have handed a third party the threshold at which your own alarm sounds.

  • The map, which is the list of places the network opens.

    Georeferenced as-built records say where the splices, closures, chambers and cabinets are: they are the first defence against splices nobody planned, and they are the same file that lists every point where the network can be opened, because no tapping technique works on an intact cable. On top of that sits the equipment inventory the cadastre now asks for: under AgID determination 129/2026 every amplifier carries its type, its power supply and AMP_VUL, “cyber vulnerability”, alongside its surveillance capabilities. One row with vulnerability declared, surveillance empty and the coordinates beside it is a target — in a list already sorted by priority.

  • The calendar and the tender.

    Not everything is a drawing. Agreed work windows say which night, in which ward or which room, one path is out of service and the other is carrying everything. The grid that lines four bids up on the same row, before the award, is the most delicate document in the procedure. These are the two files that leave most easily, because nobody files them as technical data.

  • The ability to verify.

    A use limit you cannot check technically is a promise, not a control. If the rules can change with an update on the supplier’s website, your limits are a web page. Clauses become verifiable when the infrastructure is under the control of the party accountable for it: the logs are yours, and you audit when you choose.

Three layers of ownership: the machine, the software, the model.

The machine.

On-premise, the machine is yours: the model runs on infrastructure you already control, and administration stays with your IT. On the dedicated cloud the environment is reserved for a single client — never shared, never a generic public cloud — reached over a dedicated VPN, with the data centre resident in Italy and premises we staff directly. Ask anyone offering capacity “in Italy”, ourselves included, for three names: who owns the infrastructure, who operates the service, who controls the operator. We give ours before you sign. Of the room that runs the weights we take the part that is our trade: power per rack, cooling, cable routes, interconnect, and the availability classes of EN 50600.

The software.

This is not a licence to configure: it is a system built around your naming conventions, your record formats and your site names, sitting on top of the systems you already run. The published rules still hold: the crew reviews the diagnosis and confirms, and no intervention starts on its own. And the output comes out in your formats — native traces, as-built records, georeferenced records in the cadastre’s own data model — so that reporting to the register is an export, not a survey done twice. A system that produces only its own format is a system you cannot leave.

The model.

Open-weight models: a copy of the weights downloaded and archived inside the perimeter where it runs, not a remote endpoint. Archived alongside them: a cryptographic hash of every file, the exact revision reference, the tokeniser, the configuration, the chat template, the model card and the licence text as it stood on the day of download. The other side belongs in the same paragraph: open weights arrive AS IS, with no warranty of title and no warranty of non-infringement, and clearing third-party rights falls on whoever installs them. The licence tells you what you may do with them. It does not tell you where to run them.

A weights file inside your perimeter has no remote switch.

The first reason is physical, and on a network it shows more plainly than anywhere else. The tool that helps close a fault works while the network is degraded: a cut backbone, an isolated site, a night window with one leg of the ring out of service. A remote endpoint depends on precisely the link you are repairing. Weights installed on the right side of the fault answer even when the link is gone.

The second is contractual. A service reached over a remote interface can stop or change behaviour without your consent and without useful notice; a copy of the weights already inside the perimeter cannot. It is worth being precise about the instruments being named this year. An export-list designation acts on exports, re-exports and transfers to the listed party; a procurement ban binds the buyer. These are levers on future flows, not orders to delete copies already distributed. The risk is called supply, not seizure, and it is managed in advance: a second candidate from another jurisdiction, already downloaded and already tested.

The reverse, in full. A frozen model does not improve, and the security fixes that matter almost never sit in the weights: they sit in the engine that runs them. CVE-2025-32444 affects vLLM, CVSS score 9.8, remote code execution, fixed in version 0.8.5. Freeze the environment so nothing breaks, and you freeze its defects too. The rule we apply to any piece of equipment in the field applies here: the environment that runs the weights has a maintenance plan, with stated versions and a date.

Four steps. You climb only when the step below has been measured and found short.

Each step has three lines: what it involves, what it needs from you, and when it is not the answer.

  1. 00

    The open model, as it is.

    An open-weight model chosen for the task — reading a campaign of traces, checking a specification against the standard it cites, pulling out of a field record the entry the cadastre wants — quantised and sized to the machine you have. Memory is counted in bytes, not parameters: a model of around 30 billion parameters fits a 48 GB GPU at 8-bit and a 24 GB one at 4-bit; for a 128-billion dense model the vendor states four H100 cards, six to eight in production; a 2.8-trillion-parameter model needs over 1.4 TB of memory just to load the weights and more than sixty accelerators across nodes. These are vendor-stated figures, not ours.

    The real documents to judge it against: real native traces, real as-built extracts, real tender specifications, and the answers you expect. That is the first thing you build, before you even pick the model.

    This is where most cases end. For classifying, extracting, summarising and checking documents against requirements, a well-chosen open model is often more than enough.

  2. 01

    Context, not weights.

    The network map connected to the model — links, splices, cabinets, services — together with the measurements, the field records, and the guardrails on what the system may read and what it may never touch. It is the layer this site already describes: from signal to restoration, with the crew deciding.

    The sources you already own, connected read-only at the start. No training data.

    It does not change the weights, so it invalidates none of the vendor’s measurements and survives a change of model without friction. That is why it comes before tuning, not after.

  3. 02

    Tuning on your own examples.

    This is the step we take into production most often, and it is work we have already done. The model is adapted to the language of your own house: link references, site names, record formats, the way your crew describes an event. The cost is not in the compute, it is in preparing the examples — selected, annotated and corrected by people who know the trade. Whoever does that work sees which links matter and in what order, which is why it stays inside the perimeter. The curated corpus stays yours, and a model adapted to your documents is of no use to another client.

    A curated corpus and an evaluation set of your own. After tuning, the vendor’s measurements no longer apply: only yours do, on your documents. How many examples it takes depends on the task, and you find out by measuring.

    Not every model adapts well: some are quantised during training and have no full-precision checkpoint to start from. The licence decides whether you may, and on what terms. And a small quantity does not mean a small risk: the UK AI Security Institute has found that defences introduced through fine-tuning can be undone with a few dozen examples.

  4. 03

    Pre-training a model of your own.

    Building the model instead of adapting it. The only order of magnitude we can publish is a European public project: Soofi S, 31.6 billion parameters, roughly 26.68 trillion tokens, from 24 March to 13 May 2026, on up to 512 NVIDIA B200 GPUs for about 253,000 GPU-hours. Seven weeks of a national cluster, paid for once by a state budget.

    A corpus in the order of trillions of tokens, with documented provenance. And the understanding that whoever pre-trains becomes the provider of a model, with the documentation duties that follow — no longer only a deployer.

    It makes sense only when the domain is genuinely unrepeatable and the corpus already exists. In the large majority of cases it is not the answer, and we say so before assessing it, not after.

You move up a step only when the one below has been measured and found short. If the value is not measurable, it stops there: that holds for the operational trial, which starts from a single link or a single room, and it holds for this ladder.

What it costs, and the line that never reaches the invoice.

The comparison that counts is not against the cheapest API on the market: it is against the spend you are already making. Send your network documentation to a closed frontier model and you pay by consumption, on a price list you do not negotiate, for a spend that rises with use and has no ceiling — the better the system works, the more it costs. Open weights on hardware you own take the cost per token to zero. What remains is power, cooling, maintenance and depreciation: your own lines, forecastable, and sizeable in advance, because they are the same lines you size a room with.

The most expensive line, though, never reaches the invoice. Paying by the token hands the supplier which links you measure, with what result, and in what order of priority: that is the state of health of your infrastructure, not a consumption metric. For anyone inside the national cyber security perimeter there is a second layer: the same inventory says how much equipment will have to be replaced and by when — the size of the negotiation and your position in it, in one file. Once it has left the perimeter it does not come back.

Finally, the nature of the spend changes: a capital line you put on the balance sheet, depreciate and forecast, instead of a variable cost set by a price list that can change with an update. We state the limit anyway, because it is real. Measured against the cheapest API in circulation — on DeepSeek’s list, $3,999 buys over 14 billion output tokens — a single desktop machine for a single user does not pay for itself. That arithmetic holds for the lowest price on the market and for one user, not for an organisation sending its network documentation to a frontier model. The threshold is worked out on your real volume: if it does not add up, we tell you first.

The model can be replaced. The dependencies that remain, we name.

The silicon.

Accelerators are designed and manufactured outside Europe, and installing them in Italy does not change that. We name it as a dependency, not as a claim: a serious assessment looks at the whole chain — chip, runtime, model — and does not stop at the geography of the servers.

The inference engine and the drivers.

This is where the vulnerabilities that matter arrive, and they need updating even when the weights stay the same. An archive of weights alone, without the recipe to rebuild the environment that runs them, is a block of numbers two years from now.

The room: power, heat, routes.

A rack of accelerators does not have the electrical and thermal profile of a rack of switches: power density changes, cooling changes, routes change. EN 50600 asks you to state the target availability class for power, environmental control and cabling, and EN 50600-2-5 the physical protection classes of rooms, routes and spaces. On the cable routes, the CPR class still has to be written as the full designation, not as the word “LSZH”.

The interconnect.

You choose it once, it lasts as long as the room, and it decides which accelerators you will be able to fit three years from now. It is the constraint that outlives all the others — and the only one installed by the same hands that install everything else.

The catalogue of supported models.

On a non-general-purpose accelerator a model runs only if the vendor’s compiler supports it, and the public catalogue is short: you read it before you buy, not after. On a general-purpose GPU, in practice, everything that ships runs. It costs more per token and it resells: that is the price of reversibility.

The weights licence.

Written by whoever publishes them, and not uniform: revenue thresholds, field-of-use restrictions incorporated by reference to a page that is not the contract, and in one case the supplier’s right to restrict use remotely and to require deletion of all copies on termination. Read it and archive it beforehand, not afterwards.

None of these disappears by bringing the system in-house. What changes is that they are named, that they can be replaced one at a time, and that the question to put to any supplier — us included — is not which model you use, but what it costs to change it.

The four questions to put to a supplier

The same rules that demand the evidence demand that you can produce it.

The authorities asking for this data are classifying it as critical. AgID determination 129/2026 brings the cyber vulnerability of amplifiers, and early warning, into the national network cadastre. The national cyber security perimeter — Decree-Law 105 of 21 September 2019, converted by Law 133 of 18 November 2019 — requires notification of the acquisition of ICT goods, systems and services intended for critical networks, information systems and services, and requires waiting for the assessment of the National Evaluation and Certification Centre of the Italian cyber security agency before proceeding. Regulation (EU) 2024/1309 requires minimum georeferenced information to be accessible through a single information point. And the Digital Networks Act proposal, COM(2026) 16, which is not yet law, tasks BEREC with ENISA to map dependencies, vulnerabilities and critical nodes. The dataset you work on to produce the report to the register is richer than the report itself.

So we say what leaves, rather than promising that nothing does. Reporting to the SINFI register is a duty under article 4 of Legislative Decree 33 of 15 February 2016, with a fine of €5,000 to €50,000 under article 10(3); ninety days’ notice before opening a worksite is a duty; notification to the evaluation centre precedes the purchase. What leaves, leaves towards an authority, because the law says so, in the prescribed format. The perimeter decides who works on the data, not who the law requires you to hand it to.

There is no tension between European compliance and control of the stack: compliance is what we sell. CPR and EN 50575 on cable classes, EN 50600 on data centres, EN 50173 and EN 50174 on cabling, ITU-T and IEC on measurement, Italian Decree 81/08 on safety, the GDPR on data. They all ask for the same thing: evidence retained, traceable and producible on request. That evidence exists only where the infrastructure is under the control of the party accountable for it.

The limit of the argument, stated here: keeping the processing inside the perimeter is one of those measures, not compliance itself. It has to be described and traced — who has access, over which channel, where the document is stored. And it is not self-sufficiency: the network map and the measurements in-house, non-negotiable; open models in-house where the data cannot leave; frontier models over an API where you need maximum capability and the data may leave. You decide what leaves and what does not.

Standards and qualifications

What we do not promise.

No guaranteed outcome.

The operational trial starts from a single link or a single room and is judged on the metrics agreed beforehand. If the value is not measurable, the path stops there.

We do not detect a tap.

We make a deviation measurable. Every tapping technique introduces a loss, but it only shows against a certified baseline, and the control that closes the remaining margin is continuous optical power monitoring, not one-off testing. ITU-T Recommendation X.805 states that its schemes do not detect a tap taken through a monitoring port: we write that down because the recommendation says it.

“Early warning” is not a tick box.

In the cadastre it is a boolean: declaring it costs one box, demonstrating it takes an out-of-band measurement running alongside the traffic and a history to compare it with. Without both conditions it is an intention, and we do not put it in a bid.

Not every link can be measured in service.

It takes a 1650 nm cut filter at the customer termination — a design decision made when the termination is chosen and the patch cord is laid — and it takes the position of that filter to be recorded in the as-built. Where it is absent, in-service measurement is not done: it is not a question of instrument.

No guaranteed cadastre compliance.

For network nodes, version 4.0 states in as many words that the proposals are to be agreed with stakeholders, and the document contains inconsistencies we have already pointed out in public. We prepare the data so that reporting is an export; compliance is declared by whoever reports.

The perimeter is not compliance.

It is one of the measures the rules ask for, and on its own it is not enough. It has to be described, traced and produced on request.

No superiority over frontier models.

On cyber capability the UK AI Security Institute measures open models four to seven months behind closed frontier ones. Quality is measured on your documents, not on a published benchmark.

Dedicated pre-training is almost never the answer.

It is one step on the ladder, assessed case by case. In the large majority of cases the path closes earlier, and we say so at the start.

State secrets and EU classified information are out of reach.

Italian Law 124/2007 restricts access to those cleared by virtue of their function; EU classified information, governed by Council Decision 2013/488/EU, may be handled only on accredited systems. No commercial platform, ours included, replaces a state-accredited environment.

What you are left holding.

  • The environment that runs the model, in the mode you chose, and the inventory of what it takes to stand it up somewhere else: weights with a cryptographic hash and the exact revision reference, tokeniser, configuration, templates, model card and the licence text as of the day of download.
  • The recipe to rebuild the environment: versions of engine, drivers and libraries, startup parameters, quantisation procedure.
  • Your evaluation set — native traces, as-built extracts, real tender specifications and the expected answers — which is the only proof that a replacement model does the same job.
  • The curated corpus and your own naming conventions, in open formats: the part no download replicates, and the part that stays yours when the model changes.
  • Output in your formats: native traces, as-built records, georeferenced entries in the cadastre’s data model, so that reporting to the register is an export.
  • The logs of what the system read, what it proposed and who approved it, kept where you can read them, retain them and produce them.
  • If you choose the dedicated cloud, the three names behind the infrastructure it runs on: owner, service operator, and who controls the operator. Before you sign.

Two ways of running it.

On-premise, in your own environment

The model runs on infrastructure you already control: traces, network map and as-built records never cross the boundary of your network, and administration stays with your IT. Where it is needed, we size the room that runs it — power, cooling, cable routes, interconnect.

Dedicated cloud, in Italy

An environment reserved for a single client, a dedicated VPN, the data centre resident in Italy, in premises we staff directly. No resources shared with other clients.

In both cases measurements, native traces, the network map and the as-built records stay yours. Ask anyone offering capacity “in Italy”, ourselves included, for three names: who owns the infrastructure, who operates the service, who controls the operator. We give ours before you sign.

Frequently asked questions

The questions we are asked most often.

  • Can we run AI on our network data without it leaving the company?

    Yes, and it is one of the two modes we deliver in: on-premise, with the model installed on infrastructure you already control. The other is the dedicated cloud, an environment reserved for a single client, reachable solely over a dedicated VPN, with the data centre resident in Italy and premises we staff directly. In both cases native traces, the network map and the as-built records never leave the perimeter, and the model is not connected to the open web. The choice between the two turns on who administers the infrastructure and on how critical the data is — not on price.

  • Who sees our OTDR traces and our as-built records if we use a subscription assistant?

    Whoever administers the service, on terms you can read but cannot verify. The point is not the supplier’s good faith: it is that the set of traces is the baseline of the network and the as-built is the position of every point where that network opens. Put together, they answer the question “would a deviation show here?”. That is physical security data about the infrastructure, not an attachment. Which is why our rule is that the model goes to the data, not the data to the model.

  • What hardware do you need to run an open-weight model in a company?

    Memory is counted in bytes, not parameters, and these are vendor-stated figures. A model of around 30 billion parameters takes roughly 32 GB at 8-bit and roughly 16 GB at 4-bit: it fits a single 48 GB professional GPU, or a 24 GB one in the more compressed build. For a 128-billion dense model the vendor states four H100 cards, six to eight in production. A 2.8-trillion-parameter model needs over 1.4 TB of memory just to load the weights and more than sixty accelerators across nodes: within reach of a hyperscaler, not of a mid-sized company. Quality after quantisation has to be checked on your own documents.

  • What does the room need in order to carry accelerators?

    The same four items as always, with different numbers: power per rack, cooling, cable routes and interconnect. A rack of accelerators does not have the electrical and thermal profile of a rack of switches, and the density changes both the cooling and the routing decisions. EN 50600 asks you to state the target availability class for power, environmental control and cabling; EN 50600-2-5 sets the physical protection classes for rooms, routes and spaces; on the cable routes the CPR class has to be written as the full designation. The interconnect is chosen once, and it decides which accelerators will fit three years from now.

  • Can a supplier revoke the weights of an open model?

    A weights file already copied inside your perimeter has no remote switch: it keeps working even if the supplier changes strategy or a repository takes it down. Export-list designations and procurement bans act on future flows; they do not order the deletion of copies already distributed. The risk is called supply, not seizure, and it is managed with a second candidate from another jurisdiction, already downloaded and already tested. The reverse has to be said too: a frozen model does not improve, and the security fixes that matter sit in the engine that runs the weights, not in the weights.

  • Is it cheaper than paying a frontier model by consumption?

    Against that spend, yes, for three reasons that compound. Cost per token goes to zero, and what remains is power, cooling, maintenance and depreciation: forecastable lines instead of consumption billing on a price list you do not negotiate and that rises with use. You hand nobody the record of which links you measure, with what result, in what order. And the spend changes nature, from variable cost to a capital line. The limit is real and we state it: against the cheapest API in circulation — on DeepSeek’s list, $3,999 buys over 14 billion output tokens — a single desktop machine for a single user does not pay for itself. The threshold is worked out on your real volume, and if it does not add up we tell you first.

  • Is the dedicated cloud a public cloud? Where are the data centres?

    It is not a generic public cloud and it is not shared: it is an environment reserved for a single client, reachable solely over a dedicated VPN, with the data centre resident in Italy and premises we staff directly. It involves no access by non-EU entities. That said, a data centre in Italy does not by itself qualify a service: qualification against how critical the data is has to be verified before the tender, not at signature. And the three names — who owns the infrastructure, who operates the service, who controls the operator — we give before you sign.

  • Does tuning on our field records make the model ours?

    It makes the model better suited to the way you write, not “yours” and not better in absolute terms. Three things to know first: the cost is not in the compute but in preparing the examples, which is the slow part no download replicates; after tuning the vendor’s stated measurements no longer apply and you need an evaluation set of your own; and a few dozen examples are enough to shift behaviour, including where you did not intend it. The weights licence decides whether tuning is permitted and on what terms. The curated corpus, by contrast, stays yours and is reused when the base model changes.

  • Does AI inside our perimeter make us compliant with the cadastre and the cyber perimeter?

    No, and anyone promising that is selling something else. Reporting to the SINFI register remains a duty under article 4 of Legislative Decree 33/2016, with a fine of €5,000 to €50,000; notification to the national evaluation and certification centre precedes the purchase of ICT goods intended for critical networks and services. What changes is where the data is produced: if field records, measurements and permit files are worked inside your perimeter, reporting becomes an export and the evidence stays where you can produce it. The perimeter decides who works on the data, not who the law requires you to hand it to.

Worth reading before you decide.

The first step

A site survey. Then the numbers.

Tell us the environment and the need; we tell you times, methods and costs. Before we start, not after.

30 minutes video call or site survey free of charge
Request an intervention

We reply within one business day. Survey and quote are free.