A Scalable Lakehouse Architecture for AI-Driven Cybersecurity Intelligence

The rapidly evolving cybersecurity threat landscape demands advanced analytical capabilities that combine real-time threat intelligence, Machine Learning (ML), and operational scalability. This paper presents a data lakehouse architecture designed to enhance cyber threat analysis across European Union member states. The platform integrates diverse cybersecurity data sources through a medallion architecture pattern, leveraging Delta Lake technologies to provide Atomicity, Consistency, Isolation, Durability (ACID) compliant data management with the scalability of data lakes. A hub-and-satellite framework is described that enables secure collaboration while maintain ing data sovereignty, incorporating ML Operations (MLOps) and Large Language Model Operations (LLMOps) practices for continuous model improvement. The architecture supports multiple AI/ML workflows including threat classification, vulnerability forecasting, and Retrieval-Augmented Generation (RAG) for threat intelligence synthesis.