CYBEROPS lands €1.15bn Lisbon cybersecurity contract
A €1.15bn signed Lisbon award sits beside Austria’s €149.2m Cybersecurity 2027 framework call, while bid depth remains thin in several markets.
For live business, the Republic of Austria, Bundesbeschaffung GmbH and other contracting authorities have opened Cybersecurity 2027, a €149.2m framework whose ceiling covers future purchases rather than one committed order. Bids close on 19 October 2026.
Where this market is going
Cybersecurity accounted for 23.89% of all classified notices in the window, 0.31 percentage points above the 23.58% share in the 84-day baseline from 13 June 2026.
Cybersecurity: share of all classified public IT tenders
Share, not volume. Weekly, only weeks classified by the same classifier generation.
Where the tenders were published
Notices of every kind by buyer country, 14 days to 2026-09-18.
How hard the competition is
The weekly share series was uneven: 23.33% to 3 July, 23.79% to 10 July, 22.55% to 17 July, 21.29% to 24 July, 23.4% to 31 July, 24.03% to 7 August, 23.98% to 14 August, 25.19% to 21 August, 24.07% to 28 August, 23.4% to 4 September, 22.81% to 11 September and 24.97% to 18 September.
How these tenders will be decided
Stated award criterion, for the 84 new calls that declared one.
Bids are counted on contract awards from competitive procedures only. Direct awards (negotiated without a call, single-source) have one bidder by design and are counted separately. Shown only when at least 10 awards reported a bid count. Direct awards this window: 4.
What is driving it
Spain and Poland are the relatively more crowded measured markets, where technical quality and differentiation will matter most. Ukraine and Czechia are thinner, where qualification and delivery capacity are more likely to constrain the field. Buyers used price alone in 72 of the 84 awards with recorded criteria, against 10 using quality and two using cost.
Regulations named in Cybersecurity tenders
Notices in this vertical citing each framework, past 12 months.
The calendar ahead
| Date | Framework | Milestone | Where |
|---|---|---|---|
| 2027-07-10 | EU AML Package (AMLR 2024/1624 + AMLA 2024/1620) | applies from | EU |
| 2027-12-11 | Cyber Resilience Act (Regulation 2024/2847) | applies from | EU |
What shifted this week
Type of work requested, against the usual mix
Percentage difference from the count expected at this vertical’s mix over the previous 84 days.
Whose technology is being named
Competitive awards with reported bid counts averaged 2.5 bids across 155 records, with a median of two. Spain recorded 2.5 bids on average, Poland 2.3, Czechia 1.9 and Ukraine 1.1. Germany, Lithuania, Finland and France did not have a published average in this window. Single-bid outcomes accounted for 41% of measured competitive awards, or 64 awards; four direct awards sit outside that competitive measure. SMEs supplied 86% of bids.
Vendors named in this window’s notices
Procedures naming each vendor, calls and awards together.
Who is buying repeatedly
| Calls | Buyer | Country | Largest call |
|---|---|---|---|
| 3 | Bundesamt für Sicherheit in der Informationstechnik | DE | P 700 - KI-Methoden in der Seitenkanalanalyse II (KISKA II) |
| 2 | Bundesrepublik Deutschland, vertreten durch das Bundesministerium des Innern, vertreten durch das Beschaffungs | DE | Rahmenvereinbarung über Technologiespezifische IT-Betriebsunterstützun |
| 2 | Miejski Zakład Komunalny w Kazimierzu Dolnym Sp. z o.o | PL | Dostawa i wdrożenie rozwiązań cyberbezpieczeństwa dla Miejskiego Zakładu Komunalnego w Kazimierzu Dolnym Sp. z |
| 2 | OPOLSKI URZĄD WOJEWÓDZKI W OPOLU | PL | Przedłużenie licencji na dostęp do aktualizacji, gwarancji i wsparcia technicznego dla urządzeń or |
| 2 | Zakład Gospodarki Komunalnej Czernica Sp. z o. o. | PL | Dostawa i wdrożenie infrastruktury IT/OT oraz systemów cyberbezpieczeństwa w ramach projektu „Cyberbezpieczne |
| 2 | Територіальне управління Державної судової адміністрації України в Одеській області | UA | Послуги з забезпечення функціонування засобів криптографічного захисту інформації в ТУ ДСА України в Одеській |
Buyers that published more than one call for tender in this window. An organisation running several at once is usually working through a programme rather than buying once.
The biggest new open tenders
Fortinet was named in 16 notices, 10% more often than the vertical’s usual mix would predict. Microsoft appeared in 10, 1% less often; Cisco in six, 24% more often; and Check Point in five, 1% less often. The Check Point reference illustrates the distinction between a named technology and a winner: Komenda Główna Policji’s award for Check Point licences, hardware and consulting went to Apius Technologies S.A.
| Estimated value | Tender | Buyer | Closes |
|---|---|---|---|
| €149.2m (framework ceiling) | Cybersecurity 2027 | Auftraggeber sind die Republik Österreich (Bund), die Bundesbeschaffung GmbH sowie alle weiteren Auftraggeber gemäß der AT | 2026-10-19 |
| €72.2m | Telecommunications and Cybersecurity Services of the Administration of Castilla-La Mancha | Secretaría General de la Consejería de Hacienda, Administraciones Públicas y Transformación Digital de la Junta de Comun ES | 2026-10-14 |
| €30.9m | Tender for a contract for IT workstations, unit administration and service desk | Danmarks Nationalbank DK | 2026-10-19 |
| €16.0m | Managed Workplace, Cloud & Security Services | Stichting Participatiefonds voor het Onderwijs NL | 2026-11-02 |
| €7.7m (framework ceiling) | Secure web gateway systems | Land Hessen, vertreten durch die Hessische Zentrale für Datenverarbeitung DE | 2026-10-05 |
| €3.1m | SERVICIOS DE CIBERSEGURIDAD PARA CANAL DE ISABEL II, S.A., M.P. | CANAL DE ISABEL II, S.A., M.P. ES | 2026-10-08 |
| €3.0m | Acquisition and implementation of an integrated EDR/XDR and SIEM solution | Fakultní nemocnice Plzeň CZ | 2026-11-25 |
| €2.6m | Managed communications and security services for the information system of the Ombudsman's institution | Junta de Coordinación del Defensor del Pueblo ES | 2026-10-13 |
Calls for tender published in this window and still open, by the buyer’s estimated value in EUR; 49 of 174 new calls stated one. A framework agreement states a ceiling for several purchases, not one contract.
Contracts awarded
Palo Alto Networks appeared in five notices, 7% less often than the usual mix would predict, while Splunk appeared in four, 28% more often. ESET appeared in two, 66% less often. Sophos appeared in three notices, and F5 and Oracle in two each, with no baseline comparison supplied. Among repeat callers, the Bundesamt für Sicherheit in der Informationstechnik issued three calls, including KISKA II on AI methods in side-channel analysis.
| Contract value | Contract | Buyer | Winner |
|---|---|---|---|
| €1.15bn | Prestação de serviços para reforço de capacidade técnica e humana de cibersegurança | Santa Casa da Misericórdia de Lisboa PT | CYBEROPS, LDA |
| €12.3m (direct award) | ,,Wsparcie techniczne systemu KSSPW oraz LSS. Znak postępowania 256/2026. | 16 WOJSKOWY ODDZIAŁ GOSPODARCZY PL | SAAB Aktiebolag |
| €8.9m | Zakup usługi serwisu gwarancyjnego Oprogramowania oraz świadczenie Usług utrzymania posiadanego przez Zamawiającego systemu SIEM | Prokuratura Krajowa PL | Axians IT Solutions Poland Sp. z o. o. |
| €8.4m (framework ceiling) | Dostawa licencji, sprzętu, usług konsultacyjnych dla technologii Check Point stosowanej w CWI oraz infrastrukturze specjalnej, w | KOMENDA GŁÓWNA POLICJI PL | Apius Technologies S.A. |
| €6.9m | Rahmenvertrag über Splunk Enterprise Security Premier Edition | Landesbetrieb Information und Technik NRW DE | NTT Germany AG & Co. KG |
| €6.9m | IT Security Partner | Norsk Tipping NO | Mnemonic AS |
| €6.6m | Servicio de asistencias técnicas para apoyo al centro de ciberdefensa 5G | Jefatura de Asuntos Económicos del Estado Mayor de la Defensa ES | Telefónica Soluciones de Informática y Comunicaciones de España S.A.U. |
| €5.8m | Sistema de protección Antimalware corporativo para el Gobierno de Canarias | Viceconsejería de la Presidencia del Gobierno de Canarias ES | CENTRO REGIONAL DE SERVICIOS AVANZADOS S.A. |
Contract award notices published in this window, by the signed contract value in EUR. These are contracts already placed, not open opportunities.
Who won
Suppliers with the most contract awards this window
Award notices naming each supplier; call-offs under one agreement count separately.
Browse every open public IT tender on SalesDots
Current-window citations include one notice each referencing NIS2, Poland’s uKSC, eIDAS 2 and the Web Accessibility Directive. The regulatory calendar points to both product procurement and compliance work: the EU AML package applies from 10 July 2027, while the Cyber Resilience Act applies from 11 December 2027 and brings secure-by-design, vulnerability handling, software bills of materials, security updates and CE-marking requirements for digital products.
Method
Built from 386 public procurement notices published from 2026-09-05 to 2026-09-18 and classified into the Cybersecurity vertical: 174 calls for tender, 192 contract awards, 2 prior information notices and 8 other notices. A tender republished in a new version is counted once. Values are converted to EUR at reference rates. Comparisons use the previous 84 days, classified by the same classifier generation. Every figure on this page is computed from the notices; the commentary is written around them. Sources: TED, e-Zamówienia (BZP), Prozorro, CVP IS (Lithuania), IUB (Latvia), DOE, World Bank (STEP), SEAP / SICAP (e-licitatie.ro). Tenders named in earlier editions of this column are not named again.
Frequently Asked Questions
Which major framework call is open?
Cybersecurity 2027 is a €149.2m framework ceiling with a deadline of 19 October 2026.
How many cybersecurity notices were recorded?
The window recorded 174 calls, 192 awards and 386 notices.
How competitive were measured awards?
Measured competitive awards averaged 2.5 bids, with 41% single-bid awards and four direct awards.
