CAIH opens €415m secure-network framework
CAIH’s framework leads a cybersecurity window where thin national bid fields, vendor momentum and Polish compliance demand should change account priorities.
CAIH has opened a €415,000,000 French framework for the supply, integration and maintenance of secure network equipment and solutions. That is a serious account signal for suppliers able to combine network hardware, security integration and long-term support. CAIH’s cyber activity supports France’s CaRE programme, so this is not simply a replacement cycle: it sits within hospital resilience work.
The immediate opportunity is broad but uneven. The window contains 273 notices from 235 buyers, while 166 deadlines remain open. Cisco is the sharpest named-vendor mover, appearing in 9 notices with a 248% increase against its 12-week average, but the more useful bid decision is where to pursue a technical contest and where to prove that the delivery team is qualified to turn up.
Where this market is going
Cybersecurity accounts for 7.45% of the classified corpus, a fall of 0.11 points on the coverage-neutral measure. The monthly path is lumpy, not steady: 7.81% in October 2025 moved to 7.02% in November, 6.31% in December and 4.27% in January 2026. It then sat at 4.59% in February and 4.58% in March, before rising to 4.91% in April, 5.7% in May and 5.92% in June. July was 5.55%, August 5.73% and September 5.56%, before the current 7.45% reading. Do not call the raw count movement market growth: 273 notices now versus 262 in the prior-year window sits alongside a classified corpus of 3,662 versus 3,464.
The mix is moving towards operational work. Support and maintenance has 52 notices, 203% above its 12-week average; licences and SaaS has 79, up 112%; managed services has 38, up 80%; and hardware supply has 62, up 65%. That is a practical reason to take account plans beyond a standalone product response: buyers are publishing demand for supply, subscription and ongoing operation in the same window.
Cybersecurity: share of all classified public IT tenders
Share, not volume. Monthly, last 12 complete months.
Where the tenders were published
Notices by buyer country, 7 days to 2026-10-19.
How hard the competition is
Spain is the comparatively crowded market in the leading-country group at 2.6 bids on average, with Poland at 2.3. In those contests, differentiation and technical quality should decide the bid strategy, even though price is the stated award criterion in 125 notices and quality in 30. A generic firewall or network-security response will be exposed where several credible suppliers can meet the baseline.
Germany averages 1.8 bids, Czechia 1.6 and Lithuania 2. In these thinner fields, the constraint is qualification and delivery capacity, not price alone: make certifications, local support, implementation resource and referenceability easy for the buyer to verify. The outcome profile reinforces that point. Single-bid procedures account for 46%, while the SME-bid measure is 68%, identifying qualified SMEs as a central winner cohort rather than a peripheral subcontracting route.
How these contracts are awarded
Stated award criterion, for the tenders that declared one.
What is driving it
Poland’s uKSC is the dominant regulatory citation signal: it appears in 20 tenders in this window, with 210 tender references in the current 30-day period and 290 in the preceding 30-day period. The act requires covered entities to put registration, incident-information connectivity, security management and reporting arrangements in place. NIS2 appears in 1 tender in the window and has 3 references in both 30-day periods; it creates cybersecurity risk-management and incident-reporting duties for essential and important entities. Together, these are signals for both product procurement and compliance work: tooling, managed security and integration sit alongside governance, reporting and incident-process engagements.
The calendar also matters for financial-sector account teams, but the Solvency II Review should not be misread as a cybersecurity programme. Its transposition deadline is 29 January 2027 and it applies from 30 January 2027; the work is insurance reporting and supervisory adaptation, making it principally a compliance and data-flow opportunity rather than a cyber-product trigger.
Regulations named in live tenders
Tenders citing each framework, last 30 days.
The calendar ahead
| Date | Framework | Milestone | Where |
|---|---|---|---|
| 2027-01-29 | Solvency II Review (Directive 2025/2) | transposition deadline | EU |
| 2027-01-30 | Solvency II Review (Directive 2025/2) | applies from | EU |
| 2027-07-10 | Bank Account Registries + BARIS (AMLD6 2024/1640 art. 16) | applies from | EU |
| 2027-07-10 | EU AML Package (AMLR 2024/1624 + AMLA 2024/1620) | applies from | EU |
What shifted this week
Demand by type of work, against its own 12-week average
Percentage difference from the same vertical’s recent baseline.
Whose technology is being named
Cisco’s 9 notices and 248% increase make it the clearest opening among named suppliers. Fortinet also has 9 notices, up 23%; Microsoft has 7, up 31%; Palo Alto Networks has 6, up 106%; and Check Point has 5, up 87%. These are all above-baseline signals, not displacement signals. No named vendor in the comparative set has a reported negative delta, so the data does not yet show a supplier losing notice presence to a rival.
F5 has 4 notices, VMware 3, and Cellebrite, Synology and HPE 2 each; no delta is reported for any of those suppliers. Repeat buying is where sales teams should look for a route into the next competition: Spain’s Dirección General de Racionalización y Centralización de la Contratación-Junta de Contratación Centralizada has 5 tenders, Bulgaria’s ИНФОРМАЦИОННО ОБСЛУЖВАНЕ АД has 5, and Regione Toscana has 4. The largest-tender records do not identify vendors, so it would be unsafe to attribute Cisco, Fortinet or any other named supplier to CAIH’s framework or the other largest procurements; those are account targets, not disclosed incumbent positions.
Vendors named in this window’s tenders
Notices naming each vendor, with movement against the same vertical’s 12-week average.
Who is buying repeatedly
| Tenders | Buyer | Country | Example |
|---|---|---|---|
| 5 | Dirección General de Racionalización y Centralización de la Contratación-Junta de Contratación Centralizada | ES | Spain – Radio, television, communication, telecommunication and related equipment – Adquisición De Firewalls P |
| 5 | ИНФОРМАЦИОННО ОБСЛУЖВАНЕ АД | BG | Bulgaria – IT services: consulting, software development, Internet and support – „Поддръжка и обновяване на мр |
| 4 | Regione Toscana | IT | Italy – Networks – Fornitura di prodotti e soluzioni di rete e sicurezza, hardware e software e relativa manut |
| 3 | Szpital Powiatowy im. Jana Mikulicza w Biskupcu | PL | „Zwiększenie poziomu cyberbezpieczeństwa w Szpitalu Powiatowym im. Jana Mikulicza w Biskupcu w ramach projektu |
| 3 | Nemocnice Pardubického kraje, a.s. | CZ | Czechia – Application service providers – Poskytování cloudových služeb pro pokročilou ochranu koncových zaříz |
| 3 | TenneT TSO GmbH | DE | Germany – IT services: consulting, software development, Internet and support – Implementierung und Betrieb ei |
| 3 | Bundesamt für Sicherheit in der Informationstechnik | DE | Germany – IT services: consulting, software development, Internet and support – Durchführung von Sicherheitsan |
| 2 | Norsk Tipping | NO | Norway – IT services: consulting, software development, Internet and support – Application Security System - F |
An organisation running several tenders in one window is usually working through a programme rather than buying once.
The biggest tenders
The published-value subset covers 120 notices and records €850,869,560.65, not the size of the cybersecurity market. Within that subset, CAIH leads with €415,000,000 for secure networks; CANUT has a €150,000,000 framework for urban videoprotection and videosurveillance systems; the German Länder development association has €86,461,451.10 for testing and acceptance support in the GeFa programme; the European Union Agency for the Space Programme has €45,000,000 for a multi-component security-monitoring system for the EU Space Security Operations Centre; and NS Groep N.V. has €35,000,000 for SAP expertise. CAIH is building procurement capacity around hospital cyber resilience, while EUSPA’s tender is a concrete security-monitoring build-out for space-programme operations.
Values as published by the buyer, for the 120 of 273 tenders in this window that stated one in EUR.
Deadlines worth watching
Who won
Suppliers with the most awards this window
Awards published in the window, by named winner.
Sources consulted
Pages the writer read for context while drafting this column. The figures above come from the notices, not from these.
With 166 deadlines still open, pursue the thin German and Czech fields with a qualification-led delivery case, while preparing a sharper technical and account-specific response for CAIH, the Spanish central buyer and other repeat purchasers before the next regulation-led requirements harden into frameworks.
Method
Built from 273 public procurement notices published between 2026-10-12 and 2026-10-19, classified into the Cybersecurity vertical. Every figure on this page is computed from those notices; the commentary is written around them. Sources: bzp, doe, ted, eop_bg, iub_lv, cvpis_lt, prozorro. Tenders featured in earlier editions of this column are excluded from the named lists above.
Frequently Asked Questions
What is cybersecurity’s current procurement share?
7.45%, a fall of 0.11 points on the coverage-neutral measure.
Where are bid fields thinnest among the leading countries?
Czechia averages 1.6 bids, Germany 1.8 and Lithuania 2; Spain averages 2.6 and Poland 2.3.
What is the largest published-value tender?
CAIH’s secure-network framework at €415,000,000; values cover only the 120 notices that published a value in EUR.
