EU Market Turns to Domestic Cybersecurity Tech

Cybersecurity Spending
,
Geo-Specific

US Firms Face Mounting ‘Sovereignty’-Fueled Backlash in Europe

David Meyer •
November 12, 2026    

See Also: How UK government can continue to innovate while reducing tech costs

According to figures released Wednesday by British market intelligence firm Context, the last two years saw a 35% rise in the sales of cybersecurity products from EU-headquartered vendors through distributors in Europe, the Middle East and Africa. Sales from all vendors rose by 10% during that time while U.S. vendors saw only an 8% sales lift.

“Digital sovereignty is becoming a buying decision. As customers and resellers get clearer about what it means in practice, they’re asking who holds the encryption keys, who can access sensitive logs and where that data is stored,” said Context Research Vice President Joe Turner.

Still, European cybersecurity vendors have a way to go before they could dominate. Context said 62% of sales in the third quarter of this year went to American vendors, with EU vendors only accounting for 15% of sales.

The digital sovereignty debate has heated up in Europe since the advent of the second Trump administration. The U.S. president’s threats to annex Greenland – sovereign to Denmark – caused widespread concern over reliance on American tech, and the White House’s brief export controls on Anthropic’s most powerful models were perceived by many as a demonstration of what was effectively a kill switch (see: Austria Urges Anthropic to Move to EU to Avoid US Controls).

European suppliers also benefit from regulation including cybersecurity directive Network and Information Security 2, which mandates supply chain risk management in a range of critical infrastructure, and the finance sector-specific Digital Operational Resilience Act.

Neither of those laws outright demands that organizations source their cybersecurity products within Europe although Brussels could step up regulatory pressure to buy local through a revised Cybersecurity Act that would step up supply-chain risk assessments for NIS2-designated sectors, with emphasis on non-technical risks such as influence by a third country (see: Europe Readies Law to Eject Chinese Equipment From Telecoms).

Similar concerns were apparent in a European Commission proposal that would shut out vendors from selling to government if they are “subject to the control of a third country or a legal entity established in a third country” – a big issue for U.S. vendors, as their country’s Cloud Act says American law enforcement agencies can theoretically access customer data held on those vendors’ non-U.S. servers (see: EU Prepares Path for Shutting Out US Cloud Providers).

Context also said the ongoing switch to EU vendors is fueled by stricter national cybersecurity frameworks in France and Germany.

According to Context’s figures, EU-headquartered vendors dominate in Europe when it comes to security awareness training – 92% of tracked sales – and vulnerability management, with an 82% share. They also account for just over half of sales in security information and event management, and log management.

U.S.-headquartered vendors still make up three quarters of identity and access management sales, and slightly more than half of cloud security sales. “An organization can keep its existing identity platform and still choose a European supplier to manage its security logs,” said Turner. “That’s the kind of decision that gives European vendors an opening.”

Gartner on Wednesday predicted that more than 90% of EU organizations will have a digital sovereignty strategy by 2029. The consultancy also said every country in the world will have made digital sovereignty a “core component” of its national security strategy by 2030.

Europe has “passed a point of no return on digital sovereignty,” said Gartner Senior Director Rene Buest. “Dependencies that once delivered efficiency must now be treated as potential business continuity risks.”

Gartner also warned against the idea that any organization can truly run on a completely sovereign tech stack, with Vice President Bettina Tratz-Ryan suggesting that “many critical dependencies cannot be replaced at a commercially viable scale.”

“The immediate priority for business and IT leaders should be strategic optionality: identifying where dependencies create unacceptable risk, where resilience is sufficient and where managed interdependence remains the most viable option,” she said.

Context told ISMG that the U.K. cybersecurity market looks quite different from that on the continent, with EU-based vendors capturing a mere 5% of the market. “Unencumbered by EU sovereignty rules, U.K. CISOs aren’t buying based on flag of origin – they are pooling budgets into global platform consolidation and domestic AI innovators like Darktrace, which saw spend leap 164% over the two-year cycle,” the market intelligence firm said in an email.

Coincidentally, the U.K.’s Institute for Public Policy Research also weighed into the issue with its own report on Wednesday. In it, the IPPR said “less than one pound in six” that the British public sector spends on tech goes to truly British firms, and the government “cannot see the full extent of its own dependence” on foreign technology.

The institute said the U.K. should focus on parts of the stack where it “can win,” such as chip design and AI safety. It recommended avoiding nationality preferences in tech procurement. It called on the British government to “work toward a unified approach with the EU, including U.K. startup access under the EU’s Cloud and AI Development Act.”

The report is “honest about where Britain cannot go further alone,” wrote lawmaker Darren Jones in the forward, in which he called on the U.K. to work with allies such as France, Germany, Japan and Korea to maintain access to frontier AI technology. “The point of such a coalition is not to stand against the U.S., but to make ourselves indispensable together.”