ADIF’s €181m GSM-R core refresh leads cyber buying
ADIF’s rail-network tender is the largest published-value notice, while low-bid markets and a Cisco surge reshape qualification choices.
Across the current window, 259 notices from 224 buyers are competing for attention, with 141 still carrying an open deadline. The offering mix reinforces the operational theme: support and maintenance appears in 53 notices, 339% above its 12-week average, while hardware supply appears in 75 notices, up 128%, and system implementation in 76, up 64%.
Where this market is going
The raw notice count is 259, against 262 in the previous-year window, but that is not a market-growth measure because collection coverage changed. Bid teams should read the share movement instead: cyber has regained some procurement attention since the early-year trough, without returning to its 2025-10 share.
Cybersecurity: share of all classified public IT tenders
Share, not volume. Monthly, last 12 complete months.
Where the tenders were published
Notices by buyer country, 7 days to 2026-10-12.
How hard the competition is
The 91 procedures with bid data show SMEs winning 75% of the work, while the single-bid share is 33%. That combination rewards a disciplined local-partner strategy: established suppliers cannot treat lower-bid markets as automatic territory, and smaller qualified firms have evidence that they are converting opportunities.
How these contracts are awarded
Stated award criterion, for the tenders that declared one.
What is driving it
NIS2 is cited in 1 current notice, but its 30-day references have moved to 4 from 2. The directive requires national strategies addressing supply-chain security, vulnerability management and cybersecurity awareness, making it a source of both advisory work and security-product demand. Solvency II Review is a different proposition: the calendar gives a 2027-01-29 transposition deadline and application from 2027-01-30 for insurance reporting and risk frameworks. It is compliance work, not a cybersecurity programme.
Regulations named in live tenders
Tenders citing each framework, last 30 days.
The calendar ahead
| Date | Framework | Milestone | Where |
|---|---|---|---|
| 2027-01-29 | Solvency II Review (Directive 2025/2) | transposition deadline | EU |
| 2027-01-30 | Solvency II Review (Directive 2025/2) | applies from | EU |
| 2027-07-10 | Bank Account Registries + BARIS (AMLD6 2024/1640 art. 16) | applies from | EU |
| 2027-07-10 | EU AML Package (AMLR 2024/1624 + AMLA 2024/1620) | applies from | EU |
What shifted this week
Demand by type of work, against its own 12-week average
Percentage difference from the same vertical’s recent baseline.
Whose technology is being named
ESET has 4 notices, up 45%; Palo Alto Networks has 4, up 45%; and Check Point has 3, up 16%. Bitdefender has 4 notices, Oracle 3, Veeam 3 and IBM Cloud 3, but no comparable delta is reported for those vendors. No named vendor has a negative measured delta in this extract, so there is no evidenced displacement story yet. The Austrian BBG buyer grouping is a repeat buyer with 3 tenders, led by its €149.2m Cybersecurity 2027 framework, and its central-procurement role makes it a route worth tracking for each of these vendor ecosystems.
Vendors named in this window’s tenders
Notices naming each vendor, with movement against the same vertical’s 12-week average.
Who is buying repeatedly
| Tenders | Buyer | Country | Example |
|---|---|---|---|
| 5 | Dirección General de Racionalización y Centralización de la Contratación-Junta de Contratación Centralizada | ES | Spain – Access control system – Adquisición De Equipamiento De Seguridad Electrónica (Circuito Cerrado De Tele |
| 4 | Міністерство оборони України (Головне управління інформаційних технологій) | UA | послуги з оцінювання дотримання вимог цільового профілю безпеки |
| 4 | НАЦІОНАЛЬНЕ АНТИКОРУПЦІЙНЕ БЮРО УКРАЇНИ | UA | Послуги з розширеної технічної підтримки програмної продукції IBM Security QRadar (код 72260000-5 національног |
| 3 | CENTRUM INFORMATYCZNYCH USŁUG WSPÓLNYCH OLSZTYNA | PL | Poland – Software package and information systems – Wdrożenie infrastruktury klucza publicznego PKI |
| 3 | Державна установа "Центр обслуговування підрозділів Національної поліції України" | UA | Код ДК 021:2015 - 48210000-3 - Пакети мережевого програмного забезпечення (Розширене шифрування промислового т |
| 3 | Auftraggeber sind die Republik Österreich (Bund), die Bundesbeschaffung GmbH sowie alle weiteren Auftraggeber | AT | Austria – IT services: consulting, software development, Internet and support – Cybersecurity 2027 |
| 2 | ZAKŁAD GOSPODARKI KOMUNALNEJ W KĘSOWIE | PL | Dostawa sprzętu i oprogramowania w ramach "Zwiększenie cyberbezpieczeństwa w Zakładzie Gospodarki Komunalnej w |
| 2 | IZSAM - Istituto Zooprofilattico Sperimentale dell Abruzzo e del Molise G. Caporale | IT | Italy – Computer equipment and supplies – GARA EUROPEA A PROCEDURA APERTA AI SENSI DELL'ART. 71 DEL D.LGS. N. |
An organisation running several tenders in one window is usually working through a programme rather than buying once.
The biggest tenders
The reported €455.7m total covers only the 106 notices that published a value in euros, not the size of the market. Within that subset, ADIF leads with €181.3m for its GSM-R core work; Austria’s BBG buyer grouping has €149.2m for Cybersecurity 2027; Slovakia’s NASES has €37.9m for network and ICT components, following its endpoint-vulnerability-detection work; Zuse-Institut Berlin has €25m for a network and security framework alongside its data and AI centre development; and Stichting Tijdelijk Noodfonds Energie has €8.6m for support to execute Noodfonds 2026-2027.
Values as published by the buyer, for the 106 of 259 tenders in this window that stated one in EUR.
Deadlines worth watching
Who won
Suppliers with the most awards this window
Awards published in the window, by named winner.
Sources consulted
Pages the writer read for context while drafting this column. The figures above come from the notices, not from these.
With 141 deadlines still open, pursue the operational-network opportunities early, but shape bids by country: capacity proof in thinner fields and technical differentiation where Germany and Spain draw deeper competition.
Method
Built from 259 public procurement notices published between 2026-10-05 and 2026-10-12, classified into the Cybersecurity vertical. Every figure on this page is computed from those notices; the commentary is written around them. Sources: bzp, doe, ted, eop_bg, iub_lv, cvpis_lt, prozorro, sicap_ro. Tenders featured in earlier editions of this column are excluded from the named lists above.
Frequently Asked Questions
What is cybersecurity’s current share of classified notices?
Cybersecurity represents 7.14% of classified notices, a fall of 0.9 percentage points on the coverage-neutral comparison.
Where is bid competition deepest and thinnest?
Germany averages 4.8 bids and Spain 3.7, while Poland averages 2.8 and the Czech Republic 1.7.
Which buyer published the largest tender value?
Administrador de Infraestructuras Ferroviarias published the largest listed value at €181.3m.
