• Copenhagen-based Triton Depth, founded in 2025 by three DTU engineering students, has raised €1 million in pre-seed funding
• It aims to address one of the EU's most underserved security concerns: the seabed, as Baltic cable sabotage, shadow-fleet activity, and underwater drone warfare are increasingly growing concerns
• Triton Depth intends to build a scalable network of passive acoustic sensors it calls 'Triton Nodes' to address the issue, leveraging AI to identify vessels and objects in real time

A three-man Danish company founded by students is venturing into a somewhat interesting industry for an EU-based startup: underwater defense.

Triton Depth has received €1 million in pre-seed funding from investors including London-based The Creator Fund and Denmark's state-owned Export and Investment Fund (EIFO), with aims to focus on acoustics to answer what is arguably Europe's biggest security threat in the days to come: drone-based naval warfare and sabotage.

With growing concerns about the vulnerability of the European Union, and by extension, Denmark, to a variety of sea-borne threats, EIFO's investment in Triton Depth might be more than just a value play, but a hallmark of a realization that it needs to tend to its own defense needs even as NATO continues to meander, with the US proving to be a volatile partner of late, to say the least.

Using affordable dual-use acoustic technology as the first line of defense

Triton Depth's approach is appealing for a domestic defense industry that does not share the budgets that larger naval players such as the US, Russia, or China possess: it is simple, yet elegant in its premise, and even partial wins when it comes to its claims would go a long way to safeguard Denmark and the EU's regional interests.

Triton Depth's approach centers around the use and deployment of its 'Triton Nodes', a scalable cluster of low-maintenance passive acoustic sensors that measure sound underwater before feeding information back to an AI model that assesses and classifies signatures it detects in real time.

The company intends to market its product line as a dual-use technology play, with CEO and Co-Founder Carl Borg stating that they aim to build "the intelligence layer for the ocean" for both civilian and defense use cases.

The focus on defense stems from Denmark's own vulnerabilities in the Baltic Sea, which has previously suffered significant economic damage from sabotage, including the destruction of Nord Stream 1 and 2.

With an increasing share of its critical infrastructure, including power interconnectors, data cables, and offshore wind, lying underwater, it could be argued that EIFO's investment is the Danish state safeguarding its own maritime security and intelligence interests by investing in an intelligent tripwire for the future.

Other European governments are also actively seeking scalable, affordable ways to monitor coastal and subsea infrastructure, even as Nordic defense budgets continue to rise, with Triton Depth among many defense infrastructure companies poised to benefit from a renewed focus on maritime security in the region, even as acoustics are seen as a reliable metric to monitor for a variety of infrastructure plays.

• An internal DHS readout shows analysts twice dismissed intrusion alerts on the HSIN information-sharing network as false positives
• This effectively gave hackers roughly three weeks of undetected access before a breach was declared on June 4 2026
• The as-yet anonymous attackers altered server files, ran malicious code through a legitimate web-server program, deleted logs, installed backdoors, and stole credential files

Hackers managed to find their way into the US Department of Homeland Security's primary information sharing platform, gaining unfettered access to the HSIN network that hosts unclassified information that multiple US agencies and international rely on.

The hack allowed the attackers to modify server files, run malicious code and steal credential files while installing backdoors and deleting logs to remove their digital footprint.

Their movements were flagged twice by automated systems and analysts in May 2026, before being dismissed as a false positive each time before an active breach was declared a month later.

Bad timing meets bad security practices?

The timing and specifics of this intrusion are, in particular, details which could prove to be embarrassing for the US government.

Not only does the HSIN network serve as a key intelligence-sharing tool for both domestic and international partners during the FIFA World Cup, but it also hosts information on other major events, such as America250.

The fact that the hack was picked up not once, but twice by flags before being dismissed as a false positive raises competency concerns for an instance that has already sparked interest, with the House Homeland Security Committee staff having already requested a briefing on the intrusion.

The DHS, for its part, is downplaying the incident, with a spokesperson confirming it but characterizing it narrowly: the department is "aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment" and states there is no indication that classified networks were affected.

This viewpoint is countered by Senate Intelligence Committee Vice Chairman Mark Warner, who argued the platform's sensitivity outstrips its classification level, saying that the information in HSIN, "while not classified, is highly sensitive, and its exposure risks national security."

Investigators have yet to identify or assign blame to a particular hacking group or organization, adding to the chaos in determining motive. The hackers have deleted logs on servers, which only adds to the confusion here.

Major implications

The important question, perhaps, is not how the breach happened, but why confusion and mischaracterization of the security lapse allowed it to become a much bigger issue than it would have been if it had been contained from the start. Despite security flags and analysts highlighting the breach as early as the 15th of May, the hackers essentially had free rein to operate until at least the 3rd of June thanks to initial reports being dismissed as false positives.

HSIN as a platform handles event security planning, interagency coordination, threat information, and details on persons of interest. Whether any of that material was actually copied remains unknown. Investigators have not determined what, if anything, was exfiltrated, though the theft of credential files is itself telling: attackers who steal credentials are, almost by definition, trying to reach systems and accounts beyond their initial foothold.

This is not the first time HSIN has been compromised, with two documented previous incidents, including a compromised account in 2009 and misconfigured access in 2023, that have resulted in intentional and unintentional breaches of the network.

The issue is only exacerbated by the fact that the DHS, along with its cybersecurity agency, CISA, has absorbed significant workforce cuts over the past year, potentially weakening its defenses against sophisticated hacks that require manual human intervention or oversight to detect, even when the correct flags (which triggered as intended) are already in place.

Such manpower shortages have also been politically polarizing in the US Congress and may be highlighted when the department provides more detailed information about the hack in the coming days, even as the Pentagon deals with its own OPSEC issues that are also being aired in the same forum.

Via DefenseOne