Catalonia’s €962m platform change resets cyber tender week
CTTI’s platform modification leads a week in which vendor activity rose, but country-level bid depth still dictates whether to lead on differentiation or delivery qualification.
Centre de Telecomunicacions i Tecnologies de la Informació de la Generalitat de Catalunya has put a €962m modification to its Plataforma de Servicios Transversales contract at the top of this week’s cyber-related tenders. The same buyer also appears with an €8.2m procurement for quantum key-distribution equipment. That pairs a large platform intervention with a specialist security technology purchase from the Generalitat’s technology delivery body.
Where this market is going
Cybersecurity’s current procurement share is 7.68%, a fall of 0.13 points on the comparable share. The 302 current notices and 284 a year earlier are harvested counts, not evidence of market growth. The coverage-neutral measure says the vertical is fractionally softer now, even as the current share has moved sharply above September’s monthly reading.
Cybersecurity: share of all classified public IT tenders
Share, not volume. Monthly, last 12 complete months.
Where the tenders were published
Notices by buyer country, 7 days to 2026-10-26.
How hard the competition is
The monthly shape is lumpy rather than steady. Share fell from 7.81% in October 2025 to 7.02% in November, 6.31% in December and 4.27% in January 2026. It then moved through 4.59% in February, 4.58% in March, 4.91% in April, 5.7% in May and 5.92% in June, before slipping to 5.55% in July, recovering to 5.73% in August and ending September at 5.56%. The current 7.68% reading is therefore a jump after an uneven recovery, not a smooth upward trend.
How these contracts are awarded
Stated award criterion, for the tenders that declared one.
What is driving it
Microsoft leads the named vendors with 12 notices, up 118% against its 12-week average. Fortinet has 9 notices, up 17%; Palo Alto Networks has 8, up 140%; Cisco has 6, up 89%; ESET has 6, up 140%; and Check Point has 6, up 125%. These are openings rather than displacement signals. No named vendor has a reported negative delta. The negative movement is in custom development, at 11 notices and down 42%, while licences and SaaS are up 150%, support and maintenance up 140%, managed services up 99%, hardware supply up 74% and system implementation up 37%. VMware has 4 notices, Oracle 3, Cellebrite 2 and Broadcom 2, with no delta reported for those vendors.
Regulations named in live tenders
Tenders citing each framework, last 30 days.
The calendar ahead
| Date | Framework | Milestone | Where |
|---|---|---|---|
| 2027-01-29 | Solvency II Review (Directive 2025/2) | transposition deadline | EU |
| 2027-01-30 | Solvency II Review (Directive 2025/2) | applies from | EU |
| 2027-03-26 | European Health Data Space (Regulation 2025/327) | applies from | EU |
| 2027-07-10 | Bank Account Registries + BARIS (AMLD6 2024/1640 art. 16) | applies from | EU |
| 2027-07-10 | Bank Account Registries + BARIS (AMLD6 2024/1640 art. 16) | transposition deadline | EU |
| 2027-07-10 | EU AML Package (AMLR 2024/1624 + AMLA 2024/1620) | applies from | EU |
What shifted this week
Demand by type of work, against its own 12-week average
Percentage difference from the same vertical’s recent baseline.
Whose technology is being named
Country averages make the blended 2.6 bids far less useful than they first appear. Poland is the most contested of the leading markets at 2.6 bids, Germany records 2.3, Czechia and Lithuania each record 2, Spain records 1.4 and Ukraine records 1. In Poland and Germany, lead with technical differentiation and quality evidence, because there is a real comparative field. In Ukraine and Spain, do not assume a low price will carry the day: qualification, local delivery capacity and the ability to execute are more likely constraints. With 54% single-bid outcomes and a 67% SME bid rate, much of this work is won before a price contest develops, while SMEs remain materially present in the bidder pool.
Vendors named in this window’s tenders
Notices naming each vendor, with movement against the same vertical’s 12-week average.
Who is buying repeatedly
| Tenders | Buyer | Country | Example |
|---|---|---|---|
| 8 | Komenda Wojewódzka Policji w Bydgoszczy | PL | Poland – Miscellaneous software package and computer systems – Aktualizacja oprogramowania |
| 4 | Dirección General de Racionalización y Centralización de la Contratación-Junta de Contratación Centralizada | ES | Spain – Computer equipment and supplies – Suministro De Hsms Hardware Security Modules Para La Infraestructura |
| 3 | СПЕЦІАЛІЗОВАНЕ КОМУНАЛЬНЕ ПІДПРИЄМСТВО "КИЇВТЕЛЕСЕРВІС" | UA | Послуги з налаштування та впровадження підсистеми оркестрації, автоматизації та реагування на події моніторинг |
| 3 | Ukraine's defense-industrial complex | UA | 48730000-4 Пакети програмного забезпечення для забезпечення безпеки (Програмна продукція Safetica Pro On- prem |
| 3 | Bundesamt für Sicherheit in der Informationstechnik | DE | Germany – IT services: consulting, software development, Internet and support – P 1029 - SDN-Produktanalyse (S |
| 3 | Державна установа "Центр обслуговування підрозділів Національної поліції України" | UA | Код ДК 021:2015- 48730000-4 - Пакети програмного забезпечення для забезпечення безпеки (Програмна продукція) |
| 2 | COMUNE DI LIVORNO - Ufficio Gare e Contratti | IT | Italy – Computer back-up services – PROCEDURA APERTA PER L’AFFIDAMENTO IN APPALTO DEL SERVIZIO IN CLOUD IN MOD |
| 2 | Zakład Wodociągów i Kanalizacji Spółka z o. o. | PL | Poland – Computer servers – Wzmocnienie cyberbezpieczeństwa infrastruktury wodociągowej ZWIK Andrychów |
An organisation running several tenders in one window is usually working through a programme rather than buying once.
The biggest tenders
For network-security suppliers, Zuse-Institut Berlin’s €25m framework for IT network and security systems is the large named account to inspect, although the data does not identify Fortinet, Palo Alto Networks or Cisco as a bidder or awardee on that tender. ZIB is building shared data and AI infrastructure with Helmholtz-Zentrum Berlin, which gives the framework a research-infrastructure context. Bundesamt für Sicherheit in der Informationstechnik is also a repeat buyer with 3 tenders, including its SDN product analysis procurement. Microsoft’s 12 notices make Munich’s €231m München Cloud II framework another account to qualify early, but again the dataset does not make a tender-level vendor attribution.
Values as published by the buyer, for the 117 of 302 tenders in this window that stated one in EUR.
Deadlines worth watching
Who won
Suppliers with the most awards this window
Awards published in the window, by named winner.
Sources consulted
Pages the writer read for context while drafting this column. The figures above come from the notices, not from these.
NIS2 is explicitly cited in 2 financial-services tenders across 2 countries in the current window, while its 30-day citation count is 4 versus 3 in the preceding 30 days. The directive’s risk-management and incident-reporting obligations make this both compliance work and a route to product procurement. eIDAS 2 holds at 8 citations in each 30-day period, while BSI IT-Grundschutz rises to 3 from 1, suggesting that identity and assurance requirements remain active alongside NIS2.
Method
Built from 302 public procurement notices published between 2026-10-19 and 2026-10-26, classified into the Cybersecurity vertical. Every figure on this page is computed from those notices; the commentary is written around them. Sources: bzp, doe, ted, eop_bg, cvpis_lt, prozorro, sicap_ro. Tenders featured in earlier editions of this column are excluded from the named lists above.
Frequently Asked Questions
What is cybersecurity’s current share of public procurement notices?
Cybersecurity represents 7.68% of the classified corpus, a fall of 0.13 points on the comparable share.
Where is cybersecurity competition thinnest?
Ukraine averages 1 bid and Spain averages 1.4 bids, compared with 2.6 in Poland and 2.3 in Germany.
What do the published tender values cover?
The €1.29bn total covers the 117 notices that published a value in euros, out of 302 notices. It is not the size of the market.
