European businesses are cutting back on cybersecurity suppliers, putting specialist vendors under pressure to demonstrate what their products add to existing systems. Buyers increasingly want evidence of better protection, less work for their security teams and clear responsibility when an attack occurs.<\/p>\n
European companies are trying to reduce the number of cybersecurity products they use, making life harder for vendors selling specialist tools. In a December 2025 survey by research firm IDC, 84% of respondents said their organisations were prioritising security platform consolidation. A separate survey in March 2026 found that almost two-thirds of senior security decision-makers believed they already had a security platform, although the capabilities included under that description varied considerably.<\/p>\n
Years of buying separate tools for different threats have left many businesses with complicated security arrangements. A company may use one system to protect employee computers, another to monitor networks and several more to manage access, identify vulnerabilities and investigate suspicious activity. Each comes with licences, configuration work and maintenance, while IT employees must keep track of information arriving from several places.<\/p>\n
For cybersecurity vendors, the difficulty is no longer simply persuading customers that they need protection. They must explain why their particular product deserves a place alongside systems the customer already pays for.<\/p>\n
Corporate security teams have accumulated products as threats have changed and suppliers have introduced new technology. Endpoint protection, network monitoring, identity security and cloud security have developed into separate markets, each with specialist vendors and established product categories.<\/p>\n
Combining those systems is less straightforward than buying them individually. Software must exchange information, employees need training and security teams must decide which system to use when an incident appears in several places.<\/p>\n
A suspicious login, for instance, may trigger alerts from an identity-management system, an endpoint security product and a central monitoring platform. Analysts then have to establish whether the warnings relate to the same event and determine which requires attention.<\/p>\n
Duplicate alerts consume time, while poorly connected systems risk leaving important information out of an investigation.<\/p>\n
IDC’s 2026 research identifies the proliferation of security products, technical debt and shortages of skilled employees among the problems confronting European security executives. Consolidating suppliers promises simpler management, though replacing established products can be costly and disrupt existing operations.<\/p>\n
Companies therefore have an incentive to extend the platforms they already use before purchasing additional software. Larger vendors benefit from their existing customer relationships and the range of security functions they offer under one contract.<\/p>\n
Specialist providers face a more demanding sales process. Their products have to address a problem the customer’s current platform does not solve adequately, rather than offer another version of capabilities already available.<\/p>\n
Cybersecurity suppliers have developed a vocabulary that helps technical specialists distinguish between products but provides limited guidance to executives approving purchases.<\/p>\n
Endpoint detection and response, or EDR, monitors activity on computers and servers. Extended detection and response, known as XDR, brings together information from several sources, while security information and event management systems, or SIEM, collect and analyse security logs.<\/p>\n
The boundaries between these categories have become less clear as suppliers expand their products. A vendor selling endpoint protection may also offer threat intelligence, automated investigation and incident response. Competitors provide similar combinations under different product names.<\/p>\n
Marketing descriptions have changed less than the technology. Faster detection, comprehensive visibility, automated protection and AI-powered analysis appear across competing offers, even when the services differ considerably.<\/p>\n
A security manager evaluating endpoint software needs to know which devices it supports, what information it collects and how accurately it identifies malicious activity. The IT department will examine integration requirements and the work involved in maintaining the system. Procurement needs the contractual terms and total cost.<\/p>\n
A demonstration showing that software detects a simulated attack answers only part of that assessment. It says little about the number of alerts employees will receive, how easily they can investigate them or whether the product fills a gap in the company’s existing defences.<\/p>\n
Gartner’s April 2026 research on cybersecurity vendor selection addresses the difficulty of evaluating competing suppliers. Its framework separates purchasing criteria to help organisations avoid expensive investments in products that do not meet their requirements.<\/p>\n
For vendors, the implication is practical. Technical specifications establish what a product is designed to do, but a sales case needs to explain how it will perform within the customer’s security arrangements.<\/p>\n
French cybersecurity company HarfangLab operates in one of the industry’s most competitive markets: endpoint detection and response. Its software competes with products from international suppliers whose broader security platforms are already installed in many businesses.<\/p>\n
HarfangLab has used MITRE ATT&CK Evaluations to demonstrate its detection capabilities. These exercises assess security products against defined sequences of attacker behaviour, recording how participating systems identify different techniques.<\/p>\n
In the 2023 evaluation, HarfangLab reported detecting all 19 attack steps and all 11 tactics included in the tested scenario. The company has also taken part in subsequent evaluations.<\/p>\n
The results give prospective customers technical evidence to examine rather than relying on general promises about threat detection. They do not establish that HarfangLab outperforms every competitor. MITRE does not publish an overall ranking, and performance under controlled conditions cannot establish how a product will behave in every customer’s environment.<\/p>\n
An organisation considering HarfangLab would still need to assess the devices and operating systems covered, the quality of the alerts, integration with its existing tools and the resources needed to operate the software.<\/p>\n
Independent testing helps establish technical credibility, particularly for a smaller company competing against familiar international brands. Winning a contract also requires a clear explanation of what the customer gains by adding or replacing a product.<\/p>\n
Managed security services present a different purchasing problem because customers pay for people and operational support as well as technology.<\/p>\n
A company installing security software may rely on its employees to review alerts and investigate incidents. A managed detection and response provider supplies some of that expertise externally, monitoring customer systems and carrying out agreed investigative work.<\/p>\n
The responsibilities differ between providers.<\/p>\n
Some investigate suspicious activity and advise customers on the next steps. Others have authority to isolate compromised devices, disable accounts or carry out predefined containment measures. Both may advertise continuous monitoring and rapid response, despite offering different levels of intervention.<\/p>\n
ENISA’s June 2025 analysis of the European managed security services market examined the services suppliers offer and the reasons businesses purchase external security support. Access to specialist expertise is particularly relevant for organisations without sufficient employees to operate a security function internally.<\/p>\n
The commercial value of a managed service depends partly on how much work it takes away from the customer.<\/p>\n
A contract for continuous monitoring does not necessarily guarantee immediate investigation of every alert. Nor does a commitment to incident response establish whether the supplier will contain an attack or leave that decision and the resulting work to the customer’s IT team.<\/p>\n
Buyers need to know when analysts are available, which events trigger an investigation, how incidents are escalated and who is authorised to act. The arrangements become particularly important outside normal working hours, when businesses may have few technical employees available.<\/p>\n
For a provider selling managed security, these operational details explain the service more clearly than a description of the software used to detect threats.<\/p>\n
A company buying accounting software can assess how accurately it processes transactions and how much work employees save. Cybersecurity presents a less straightforward comparison because the purpose of many products is to prevent incidents that may never occur.<\/p>\n
Vendors commonly report the number of threats detected, security events processed or alerts examined by their systems. Such figures demonstrate activity, though they reveal little about whether the product identifies the incidents that pose the greatest danger.<\/p>\n
A system handling millions of events may still miss a serious intrusion. Another may detect suspicious behaviour promptly but generate so many unnecessary warnings that analysts struggle to identify what requires investigation.<\/p>\n
Security buyers therefore need more than detection figures.<\/p>\n
The proportion of devices covered, the quality of information accompanying an alert and the time employees spend investigating incidents all affect how a product performs in daily operations. False positives are particularly relevant because every unnecessary investigation consumes staff time.<\/p>\n
Managed service providers face additional scrutiny over response times and the work their analysts undertake. A commitment to begin investigating within a specified period differs from a promise to contain an incident within that period.<\/p>\n
Customer case studies can establish how those differences affect operations. A supplier might demonstrate that its product reduced unnecessary investigations, improved coverage or allowed existing employees to monitor additional systems without increasing their workload.<\/p>\n
Such claims need clear measurement periods and explanations of the conditions under which results were obtained. Performance in a controlled test is not directly comparable with that of a system operating across thousands of devices and applications.<\/p>\n
Financial benefits are equally difficult to establish without evidence. A reduction in analyst workload may save money, but a supplier cannot reliably claim to have prevented a particular financial loss simply because no major attack occurred during the contract period.<\/p>\n
For customers comparing vendors, documented operating results provide a firmer basis for purchasing decisions than hypothetical estimates of losses avoided.<\/p>\n
Cybersecurity procurement is becoming more closely connected to legal obligations, particularly among businesses covered by the EU’s Network and Information Security Directive, NIS2.<\/p>\n
The framework requires organisations in specified sectors to adopt appropriate security measures covering areas such as incident handling, business continuity, supply-chain security and access management.<\/p>\n
ENISA’s June 2025 implementation guidance sets out practical measures and examples of documentation relevant to certain digital infrastructure companies, managed service providers and other organisations covered by the applicable implementing rules.<\/p>\n
Customers need evidence that security controls operate as intended. A monitoring platform may supply records for incident investigations, while a managed provider may document its response procedures and the actions taken during an event.<\/p>\n
Purchasing either service does not automatically establish compliance. The customer remains responsible for determining which requirements apply and ensuring that its arrangements meet them.<\/p>\n
Switzerland has introduced reporting obligations for certain critical infrastructure operators. Since April 2025, covered organisations have had to report specified cyberattacks to the National Cyber Security Centre within 24 hours of discovery.<\/p>\n
During the first half of 2026, the NCSC received 200 mandatory notifications and 27’128 voluntary reports. The figures describe reported incidents, not demand for cybersecurity products, but they show the operational demands placed on Swiss organisations and the authorities responsible for handling them.<\/p>\n
A security provider supporting a regulated customer needs procedures for supplying the information required after an incident, including the systems affected, the nature of the attack and the actions taken.<\/p>\n
For smaller European suppliers, expertise in a particular regulatory environment or industry can strengthen their commercial position, especially when larger competitors offer more standardised services.<\/p>\n
Cybersecurity vendors are incorporating artificial intelligence into products that detect suspicious behaviour, analyse alerts and assist investigations.<\/p>\n
Machine learning has long been used in security software. Newer AI systems can also summarise incidents, retrieve related information and recommend or initiate responses.<\/p>\n
The applications vary considerably. A tool that prepares summaries may save analysts time, while one capable of automatically isolating devices performs a different task and carries greater operational responsibility.<\/p>\n
Yet the distinction can disappear in marketing that describes both products as AI-powered security platforms.<\/p>\n
Buyers need to establish which activities the technology handles, how its output is checked and what happens when it makes a mistake.<\/p>\n
An automated system that incorrectly blocks an authorised application or disables an employee’s account can interrupt legitimate business activity. The controls governing those actions matter as much as the model’s ability to recognise suspicious behaviour.<\/p>\n
Suppliers able to demonstrate fewer unnecessary alerts, faster investigations or more consistent handling of routine incidents have evidence that purchasing teams can assess. Simply including AI among a product’s features provides little basis for comparison when competing vendors make the same claim.<\/p>\n
The move towards fewer security suppliers presents a particular challenge for smaller European companies. Established platforms have the advantage of offering several functions under one contract, and customers may prefer to use capabilities they already licence before introducing another product.<\/p>\n
Specialists can still win business where they offer stronger protection in a particular area, better support for an industry’s requirements or services that existing suppliers do not provide adequately.<\/p>\n
Their sales proposition must explain those differences in terms of the customer’s operations.<\/p>\n
A vendor offering endpoint protection needs to establish where the customer’s current system falls short and demonstrate how its product addresses that weakness. A managed security provider must show which investigations and response activities its employees undertake, together with the commitments governing that work.<\/p>\n
Integration requirements, internal staffing and support arrangements belong in the comparison alongside detection performance. A product with strong technical capabilities may be an unattractive purchase if operating it creates more work than the customer can reasonably accommodate.<\/p>\n
European providers have opportunities to distinguish themselves through specialist expertise, knowledge of local regulatory requirements and documented experience with particular business environments. Those advantages carry weight when suppliers can demonstrate them through testing, customer projects and clearly defined services.<\/p>\n
The challenge for vendors is to make that evidence accessible to everyone involved in the purchasing decision, from security analysts to the executives approving the contract.<\/p>\n
As businesses reduce the number of security products they operate, a specialist supplier needs to show precisely what existing systems fail to provide and why closing that gap justifies another commercial relationship.<\/p>\n
Cybersecurity companies sell complex products to buyers with different responsibilities. Effective product communications need to establish what a service does, where it fits within the customer’s existing arrangements and what evidence supports the supplier’s claims.<\/p>\n