Sales from EU HQ'd vendor rocket in two years. The Trump affect? Yes but NIS2 and DORA are factors too

European tech buyers are increasingly choosing cybersecurity vendors from their own continent in a bid to reduce their reliance on American technology. 

Digital sovereignty isn't only prompting enterprise customers to question their clouds of choice, it is also reshaping other parts of the industry too, and the shift is marked. 

According to sales figures compiled by Context, distributor sales in EMEA of cybersecurity products from EU-headquartered vendors jumped 35 percent in the two years to calendar Q3 2026. Total cybersecurity sales grew up 10 percent over the same period, and sales by US-run companies went up just 8 percent. 

That growth is from a relatively small base, though EU vendors gained nearly three percentage points to reach 15 percent of tracked sales by value. There is still a long way to go as US-headquartered vendors accounted for 62 percent. 

The trend coincides with a loss of trust in the Trump administration among customers outside of America, after it cosied up to autocratic rulers while criticizing and punishing allies with tariffs and more.  

Context stopped short of assigning blame. It said organizations are reviewing their reliance on third-party tech in light of the NIS2 Directive and Digital Operational Resilience Act (DORA).

transposed into national law in October 2024, requires organizations in the bloc to raise their common level of security in the face of digital threats and risks to critical infrastructure. DORA, introduced in January last year, is designed to strengthen cyber security in the financial sector. 

"Digital sovereignty is becoming a buying decision. As customers and resellers get clearer about what it means in practice, they're asking who holds the encryption keys, who can access sensitive logs and where that data is stored," said Context veep of research Joe Turner. 

"We're seeing a measurable shift in the EMEA channel. EU vendors gained nearly three points of sales share in two years. An organization can keep its existing identity platform and still choose a European supplier to manage its security logs. That's the kind of decision that gives European vendors an opening."

The stats indicate that EU-HQd vendors comprised 92 percent of tracked sales in security awareness training, 82 percent in vulnerability management, and 52 percent for SIEM and log management. US-headquartered companies held into 74 percent of identity and access management sales and 54 percent of cloud security sales. 

has asked Context for UK-specific figures to see whether British customers are also voting with their wallets for European alternatives. That certainly isn’t the case for tech purchases in the British public sector, despite Prime Minister Andy Burnham’s professed desire to buy British. 

Data released yesterday by the Institute for Public Policy Research showed just spent by government with the biggest technology suppliers goes to Brit businesses. 

Still, Burnham only came to power in July so there is time yet for him to put his money where his mouth is. 

Sovereign AI is another area of concern for enterprise customers. Analyst Omdia said last month that despite the marketing adjective meaning "local assets," almost a third AI providers disclose no proof of sovereignty, and some "expect enterprise to pay for audits to verify their claims." 

Omdia also found that 80 percent of contracts say network resilience is "out of providers control or responsibility," and "US-headquartered AI providers offer better service transparency and contract terms than a majority of local sovereign AI providers, with providers in India a notable exception."

Sovereign services in Omdia's classification include data residency, operational autonomy, jurisdictional sovereignty, and technological autonomy. 

"Local hosting is not sovereignty. Serious providers must demonstrate their credibility through transparent operations, fair contracts and proof of competence. That includes the network, because data in transit must be sovereign too," said Camille Mendler, research director for telco B2B at Omdia. 

Someone should tell Microsoft and Anthropic.  ®