"Digital sovereignty is becoming a buying decision. As customers and resellers get clearer about what it means in practice, they're asking who holds the encryption keys, who can access sensitive logs and where that data is stored," said Context veep of research Joe Turner.
Context sales data: European cybersecurity vendors are growing, but have far to go
Distributor sales in EMEA of cybersecurity products from EU‑headquartered vendors jumped 35 percent in the two years to calendar Q3 2026, according to sales figures compiled by Context. That gain outpaced overall tracked cybersecurity sales, which rose 10 percent over the same period, and sales by US‑run companies, which climbed 8 percent.
Despite the faster growth rate, the market share picture remains heavily skewed. EU‑headquartered vendors reached 15 percent of tracked sales by value — an increase of nearly three percentage points — while US‑headquartered companies still accounted for 62 percent. Context characterises the shift as measurable but starting from a relatively small base.
Regulation: NIS2 and DORA are forcing procurement choices
Context stopped short of assigning geopolitical blame, but it said organisations are reviewing their reliance on third‑party technology in light of EU compliance regimes: the NIS2 Directive and the Digital Operational Resilience Act (DORA). NIS2, transposed into national law in October 2024, requires organisations in the bloc to raise their common level of security against risks to critical infrastructure. DORA, introduced in January last year, is designed to strengthen cyber security in the financial sector.
Those regulatory pressures help explain why procurement teams now ask technical, specific questions about key control and data flows, Turner said. He pointed to practical decisions — for example, an organisation can keep its existing identity platform and still choose a European supplier to manage its security logs — as the kinds of tradeoffs giving EU vendors an opening.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhere European vendors are winning — and where US firms still dominate
Context’s sector breakdown shows the shift is uneven across product types. EU‑headquartered firms comprised 92 percent of tracked sales in security awareness training and 82 percent in vulnerability management. They also captured 52 percent of the market for SIEM and log management.
By contrast, US‑headquartered companies retained dominant shares in identity and access management (74 percent of tracked sales) and cloud security (54 percent). Those category footprints explain how a modest increase in EU vendor sales can coexist with continued American leadership across the broader market.
Sovereign AI claims under scrutiny — Omdia’s contract and transparency findings
“Sovereign AI” is another battleground. Analyst Omdia reported that almost a third of AI providers disclose no proof of sovereignty and that some expect enterprise customers to pay for audits to verify their claims. Omdia also found that 80 percent of contracts state network resilience is "out of providers control or responsibility."
Omdia’s assessment further concluded that "US‑headquartered AI providers offer better service transparency and contract terms than a majority of local sovereign AI providers, with providers in India a notable exception." The firm’s classification of sovereign services includes data residency, operational autonomy, jurisdictional sovereignty and technological autonomy.
“Local hosting is not sovereignty. Serious providers must demonstrate their credibility through transparent operations, fair contracts and proof of competence. That includes the network, because data in transit must be sovereign too,” said Camille Mendler, research director for telco B2B at Omdia.
UK public spending, political messaging and the buyer’s dilemma
The Reg asked Context for UK‑specific figures to see whether British customers are also voting with their wallets for European alternatives. Public‑sector procurement data released by the Institute for Public Policy Research yesterday showed just £1 in every £6 spent by government with the biggest technology suppliers goes to British businesses.
The article notes Prime Minister Andy Burnham’s professed desire to "buy British," while also pointing out he only came to power in July — an observation framed as leaving time for policy to catch up with rhetoric. The wider trend the piece links to a loss of trust in the Trump administration among customers outside America, after it "cosied up to autocratic rulers while criticizing and punishing allies with tariffs and more," language the report cites as context for shifting procurement preferences.
Taken together, the figures sketch a practical market reality: European vendors are capitalising on regulatory pressure and procurement concerns about key control and data residency, but much of the cyber‑security and cloud market value remains with US‑headquartered suppliers. Sovereignty claims without transparent proof, and contract terms that push network and resilience risk off providers’ balance sheets, leave a gap between marketing and the buyer protections regulators and procurement teams are now demanding. Someone should tell Microsoft and Anthropic.
