Cybersecurity Spending,
Geo-Specific
US Firms Face Mounting ‘Sovereignty’-Fueled Backlash in Europe
European technology buyers are increasingly prioritizing cybersecurity products developed within the European Union, signaling a notable shift in the dynamics between US and European vendors. Recent analysis indicates that as European businesses move towards the adoption of domestically produced technology, the demand for EU-based cybersecurity solutions is expected to become a central strategy for many organizations across the continent.
Data released by British market intelligence firm Context highlighted a significant 35% increase in the sales of cybersecurity products from EU-based vendors over the past two years. In contrast, the overall sales from all vendors grew by only 10%, while sales from U.S. vendors saw a modest increase of 8%. This disparity suggests that European firms are actively seeking local alternatives amid growing concerns over data sovereignty.
Context’s Vice President Joe Turner pointed out that the emerging principle of digital sovereignty is profoundly influencing purchasing decisions. As organizations and resellers become more educated on the implications of such sovereignty, factors such as the control of encryption keys and access to sensitive logs have taken precedence in the minds of buyers. Turner stated that the location of data storage is now a critical question during the procurement process, emphasizing the importance of transparency regarding data management.
However, despite this clear trend towards supporting European cybersecurity firms, American vendors remain dominant in the market. According to Context, U.S. companies accounted for approximately 62% of cybersecurity sales in the third quarter of the current year, while EU firms represented only 15%. This data underscores the challenges that European vendors must overcome to expand their market share in what continues to be a competitive landscape heavily influenced by established U.S. entities.
In recent years, the digital sovereignty debate has intensified across Europe, particularly following the heightened tensions during the second Trump administration in the United States. Controversial statements and actions, including threats to annex Greenland and imposition of export controls on advanced AI models, have exacerbated fears among European leaders about over-reliance on American technology. The perception of U.S. technological control has catalyzed discussions around the importance of local sourcing in maintaining national security and technological independence.
Furthermore, European firms are benefiting from local regulatory measures such as the Network and Information Security (NIS) 2 directive. This legislation mandates rigorous supply chain risk management across critical infrastructure sectors, encouraging businesses to prioritize local vendors for cybersecurity needs. While these regulations do not explicitly require organizations to source their cybersecurity solutions within Europe, analysts predict that future legislative revisions could prompt shifts towards more assertive local sourcing mandates.
The European Commission has proposed restrictions to prevent vendors under third-country control from participating in public sector contracts. This proposal reflects a growing determination to ensure that domestic firms are prioritized, thereby minimizing potential risks associated with third-party foreign interventions. Such policies pose challenges specifically for U.S. vendors, as the U.S. Cloud Act allows law enforcement to access data held on their servers, complicating their ability to secure contracts across Europe.
In the context of regulatory pressures, Context’s findings reveal that while EU vendors excel in areas such as security awareness training—where they capture 92% of the market share—they still trail behind U.S. firms in critical sectors like identity and access management. U.S. vendors retain a significant 75% share of this particular market. Notably, Turner remarked that organizations have the option to maintain their existing identity platforms while opting for European providers to manage their security logs, indicating a potential pathway for increased collaboration between U.S. and EU companies.
Looking to the future, Gartner has projected that over 90% of EU organizations could implement a digital sovereignty strategy by 2029. The consultancy emphasized that the upcoming decade would see digital sovereignty entrenched as a crucial component of national security strategies worldwide. According to Gartner’s Senior Director Rene Buest, Europe has reached a pivotal moment concerning digital sovereignty, where dependencies that once heightened efficiencies are increasingly seen as risks.
Despite the urgency for business leaders to reassess where their dependencies lie, Gartner cautioned against the belief that any organization could fully eliminate reliance on external technologies. Vice President Bettina Tratz-Ryan advised that strategic flexibility, particularly in identifying vulnerabilities, should take precedence while maintaining a balanced approach to interdependence in the tech ecosystem.
Notably, Context’s examination of the UK cybersecurity market reveals stark differences from the EU, with only 5% of the market controlled by EU-based vendors. UK Chief Information Security Officers (CISOs) appear to focus less on where products originate and more on optimizing budgets through global consolidation and support for domestic innovators like Darktrace, whose spending surged by an impressive 164% over the two-year period.
In a related report from the UK’s Institute for Public Policy Research, it was highlighted that a mere fraction of public sector technology expenditure goes to British firms. The findings suggest that the government lacks visibility into its heavy reliance on foreign technological solutions. The report urges the UK to focus its efforts where it can successfully compete, particularly in sectors like AI safety and chip design, and emphasizes the necessity for collaboration and unified approaches with EU partners to foster access to advanced technologies while avoiding nationalism in procurement decisions.
The findings reflect a collective realization within Europe and the United Kingdom that to promote sustainability and security in technology procurement, highlighting the importance of shared goals and collaborative strategies with international allies remains paramount.