ZSSK’s €9.3m ETCS tender leads cyber buying
A Slovak railway security-equipment tender leads a lumpy rise in cybersecurity procurement share, while France crowds bidders and Czech contests test supplier qualification.
Železničná spoločnosť Slovensko, a.s. leads the tender list with a €9,321,750 security-equipment notice for ETCS installation on LOK 757. That is a very different buying signal from a routine software renewal: the Slovak railway buyer is procuring security equipment around a named rail-modernisation project. Its wider programme includes onboard-connectivity modernisation with associated cybersecurity measures, making delivery credentials in transport systems as relevant as product capability.
The immediate field is still actionable. There are 15 notices with an open deadline, and the largest named software opportunity is Viešoji įstaiga CPO LT’s €578,512.4 IBM QRadar licence-rental tender. Buyers are not moving as one: the work spans rail equipment, security-software licensing, CCTV infrastructure and access registration.
Where this market is going
Cybersecurity’s share of the classified notice corpus is 6.04%, a coverage-neutral rise of 4.25 points. Treat that as a shift in procurement attention, not market growth: the underlying raw-count comparison is affected by changes in harvested coverage.
The monthly line is lumpy rather than steady. Share rose from 4.46% in 2025-09 to 4.98% in 2025-10, then fell to 4.4% in 2025-11 and 4.25% in 2025-12. It recovered through 4.44% in 2026-01, 4.71% in 2026-02, 4.78% in 2026-03 and 5.03% in 2026-04, before jumping to 5.84% in 2026-05 and 6.1% in 2026-06. The retreat to 5.55% in 2026-07, followed by 5.87% in 2026-08 and 6.04% now, suggests episodic project releases rather than a smooth expansion.
Cybersecurity: share of all classified public IT tenders
Share, not volume. Monthly, last 12 complete months.
Where the tenders were published
Notices by buyer country, 1 days to 2026-09-21.
How hard the competition is
Do not treat the 2.9 average bids as a market-wide bidding rule. France is the crowded contest, at 8 average bids, where differentiation and technical quality decide whether a bidder remains credible. Poland averages 3 bids, while Germany and Spain each average 2. Czechia is the clearest thin field at 1 average bid: there, the constraint is qualification and delivery capacity, not price alone.
The winner picture is shaped by access as much as commercial competition. Single-bid procedures account for 33% of measured competitions, so a qualified lone supplier can secure work without a price contest. SMEs account for 50% of bids, which means the field is not reserved for large integrators. Price is the stated award criterion in 18 procedures and quality in 5, but that aggregate should not tempt bidders into a price-only Czech or Polish approach when buyer confidence in delivery may be the harder threshold.
How these contracts are awarded
Stated award criterion, for the tenders that declared one.
What is driving it
Poland’s uKSC is the live regulatory demand signal. It requires covered essential and important entities to operate an information-security management system, report incidents to sectoral CSIRTs, undergo cybersecurity audits and register in the national list. uKSC citations stand at 282 in the latest 30-day period, against 218 in the preceding 30-day period. That is both compliance work and product procurement: advisory, audit and operating-model work will sit alongside tools that support monitoring, incident handling and managed control operation.
NIS2 requires risk-management measures and incident-reporting duties for essential and important entities, but its cited-tender movement is flat at 3 in the latest 30-day period and 3 in the preceding period. That presently reads more as compliance preparation than a broad product wave. The next financial-services timing marker is the Solvency II Review, Directive 2025/2: insurers and supervisors must adapt reporting and risk frameworks by the 2027-01-29 transposition deadline, with the rules applying from 2027-01-30. That is principally compliance work, but the resulting reporting and control changes can create cybersecurity implementation demand.
Regulations named in live tenders
Tenders citing each framework, last 30 days.
The calendar ahead
| Date | Framework | Milestone | Where |
|---|---|---|---|
| 2027-01-29 | Solvency II Review (Directive 2025/2) | transposition deadline | EU |
| 2027-01-30 | Solvency II Review (Directive 2025/2) | applies from | EU |
| 2027-07-10 | Bank Account Registries + BARIS (AMLD6 2024/1640 art. 16) | applies from | EU |
| 2027-07-10 | EU AML Package (AMLR 2024/1624 + AMLA 2024/1620) | applies from | EU |
What shifted this week
Demand by type of work, against its own 12-week average
Percentage difference from the same vertical’s recent baseline.
Whose technology is being named
The named-vendor data does not support a claimed vendor opening or displacement yet. Check Point appears in 1 notice across 1 country, IBM Cloud in 1 notice across 1 country and Splunk in 1 notice across 1 country. Their 12-week weekly averages are 0.4, 0.1 and 0.2 respectively, but no positive or negative vendor delta is supplied for any of them. There is therefore no reported falling vendor to characterise as a displacement, and no reported vendor delta to treat as an opening.
The movement is clearer at offering level. Licences SaaS has 6 notices, a 42% delta against its 12-week weekly average of 4.2, while system implementation has 8 notices and a 14% delta against an average of 7. IBM Cloud is named where the competition is concrete: CPO LT’s IBM QRadar licence-rental tender. In Spain, Dirección General de Racionalización y Centralización de la Contratación-Junta de Contratación Centralizada is flagged as a repeat buyer with 2 tenders, making central procurement-account coverage more valuable than treating each notice as an isolated chase.
Vendors named in this window’s tenders
Notices naming each vendor, with movement against the same vertical’s 12-week average.
Who is buying repeatedly
| Tenders | Buyer | Country | Example |
|---|---|---|---|
| 2 | Dirección General de Racionalización y Centralización de la Contratación-Junta de Contratación Centralizada | ES | Spain – Radio, television, communication, telecommunication and related equipment – Contrato Específico Del Si |
An organisation running several tenders in one window is usually working through a programme rather than buying once.
The biggest tenders
The published-value subset totals €10,689,262.4 across 8 notices that disclosed a value in euros, so it is not the size of the market. ZSSK’s €9,321,750 ETCS security-equipment tender dominates that subset. CPO LT follows with €578,512.4 for IBM QRadar licence rental; Edia - Empresa de Desenvolvimento e Infra-Estruturas do Alqueva, SA has €450,000 for CCTV at EFMA infrastructure; and Gemeente Barneveld has €339,000 for CCTV and an access-registration system. These are distinct buying motions: rail equipment, SIEM licensing, infrastructure surveillance and municipal physical-security integration.
| Value | Tender | Buyer | Country |
|---|---|---|---|
| €9.3m | Slovakia – Security equipment – Zvýšenie bezpečnosti montážou ETCS do LOK 757 | Železničná spoločnosť Slovensko, a.s. | SK |
| €579k | Lithuania – Security software package – IBM Qradar licencijų nuoma (VSSA) | Viešoji įstaiga CPO LT | LT |
| €450k | Portugal – Video-surveillance system – Fornecimento, instalação e configuração de sistemas de videovigilância (CCTV) para infraestruturas do EFMA | Edia - Empresa de Desenvolvimento e Infra-Estruturas do Alqueva, SA | PT |
| €339k | Netherlands – Surveillance and security systems and devices – Camerabeveiliging (CCTV) en toegangsregistratiesysteem (TRS) | Gemeente Barneveld | NL |
Values as published by the buyer, for the 8 of 27 tenders in this window that stated one in EUR.
Deadlines worth watching
| Closes | Tender | Buyer | Country |
|---|---|---|---|
| 2026-09-22 | Czechia – Network equipment – Ochrana Anti-DDoS | ČEPS, a.s. | CZ |
| 2026-09-23 | Portugal – Video-surveillance system – Fornecimento, instalação e configuração de sistemas de videovigilância (CCTV) para infraestruturas do EFMA | Edia - Empresa de Desenvolvimento e Infra-Estruturas do Alqueva, SA | PT |
| 2026-09-23 | Czechia – Computer accessories – I771 - Bezpečnostní síť a sběrač událostí z technologických systémů ETE s napojením na SIEM SKČ | ČEZ, a. s. | CZ |
| 2026-10-01 | Romania – Software package and information systems – Sistem securizare contoare PKI-HSM | DISTRIBUȚIE ENERGIE ELECTRICĂ ROMANIA S.A. | RO |
| 2026-10-06 | Liechtenstein – Software package and information systems – Intelligence-, Analyse- und Investigationsplattform | Amt für Informatik | LI |
| 2026-10-12 | Germany – Software package and information systems – Splunk Enterprise Security | Techniker Krankenkasse | DE |
| 2026-10-12 | Poland – License management software package – Dostawa licencji bezpieczeństwa do Systemu DNS | Poczta Polska S.A. | PL |
Who won
Suppliers with the most awards this window
Awards published in the window, by named winner.
Sources consulted
Pages the writer read for context while drafting this column. The figures above come from the notices, not from these.
For the 15 notices still open, lead with the delivery evidence that makes a buyer comfortable awarding to a qualified supplier, then tailor the commercial approach to the country’s bid density rather than assuming a single European cyber-sales playbook.
Method
Built from 27 public procurement notices published between 2026-09-20 and 2026-09-21, classified into the Cybersecurity vertical. Every figure on this page is computed from those notices; the commentary is written around them. Sources: bzp, ted. Tenders featured in earlier editions of this column are excluded from the named lists above.
Frequently Asked Questions
What share of classified notices is cybersecurity?
Cybersecurity represents 6.04% of the classified corpus, with a coverage-neutral rise of 4.25 points.
Where is bidding most and least crowded?
France averages 8 bids, Poland 3, Germany 2, Spain 2 and Czechia 1.
What do the published euro values cover?
The €10,689,262.4 total covers 8 notices with published euro values; ZSSK’s tender is €9,321,750.
