DSB seeks €120.6m S-network IT outsourcing
DSB’s automation programme leads this week’s cybersecurity calls, while bid intensity ranges from 2.0 bids in Czechia to 7.8 in Germany.
DSB has put a €120.6m outsourcing agreement for IT infrastructure and services out to tender. The call, published on 4 November and closing on 3 December, supports the Copenhagen S-train operator’s Future S-Network Programme, which is moving the network towards full automation.
The DSB requirement leads 186 calls in the 2 to 8 November window. MD-IT GmbH also opened an €88m framework for AI-supported hospital billing audits, compliance, AI governance and management systems, with a 2 December deadline. That is a framework ceiling for future purchases, rather than one contract value.
Where this market is going
Cybersecurity represented 13% of all classified notices in the week to 8 November, a fall of 0.48 percentage points against the 13.48% baseline across the 28 days from 5 October. The measure compares like-for-like classifier output rather than raw harvest volumes.
The weekly share moved from 13.13% to 11 October, to 12.78% to 18 October, then 14.54% to 25 October, 13.4% to 1 November and 13% to 8 November. The shape is a late-October peak followed by two successive weekly declines.
Cybersecurity: share of all classified public IT tenders
Share, not volume. Weekly, only weeks classified by the same classifier generation.
Where the notices were published
Notices of every kind by buyer country, 7 days to 2026-11-08.
How hard the competition is
Competitive awards averaged 3.5 bids across 90 measured awards; 39% were single-bid awards, covering 35 awards. Germany recorded 7.8 bids on average and France 7.3, while Poland recorded 2.5, Spain 2.3 and Czechia 2.0. Ukraine, Romania and Lithuania have no published average because too few awards reported bid counts. Four direct awards are counted separately from the competitive-procedure measure.
Germany and France are the markets where technical quality and differentiation should decide the bid strategy. In Czechia, Spain and Poland, the more immediate constraint is qualification and delivery capacity. SMEs supplied 70% of bids in the measured competitive procedures, so large primes should expect capable smaller challengers even where bidder numbers are limited.
How these tenders will be decided
Stated award criterion, for the 87 new calls that declared one.
Bids are counted on contract awards from competitive procedures only. Direct awards (negotiated without a call, single-source) have one bidder by design and are counted separately. Shown only when at least 10 awards reported a bid count. Direct awards this window: 4.
What is driving it
BSI IT-Grundschutz, NIS2 and Poland’s uKSC were each cited in 1 tender in the window. BSI’s standards set out an information-security management methodology; NIS2 establishes risk-management and incident-reporting duties for covered entities; and uKSC is Poland’s cybersecurity-system law, which entered into force on 3 April 2026. The immediate effect is both compliance work and product procurement where buyers turn security controls into deployed tools and managed services.
The forward calendar adds the EU AML Package, applying from 10 July 2027, and the Cyber Resilience Act, applying from 11 December 2027. The AML rules require harmonised anti-money-laundering controls and data flows, while the Cyber Resilience Act brings secure-by-design, vulnerability-handling, software-bill-of-materials and security-update requirements for digital products. Both create compliance work, with product procurement where buyers need systems and services to meet those duties.
Regulations named in Cybersecurity tenders
Notices in this vertical citing each framework, past 12 months.
The calendar ahead
| Date | Framework | Milestone | Where |
|---|---|---|---|
| 2027-07-10 | EU AML Package (AMLR 2024/1624 + AMLA 2024/1620) | applies from | EU |
| 2027-12-11 | Cyber Resilience Act (Regulation 2024/2847) | applies from | EU |
What shifted this week
Type of work requested, against the usual mix
Percentage difference from the count expected at this vertical’s mix over the previous 28 days.
Whose technology is being named
Microsoft was named in 17 procedures, 57% more often than the vertical’s usual mix would predict. Fortinet appeared in 16, 44% above expectation, and ESET in 8, 138% above. These are notice-text mentions across calls and awards, not evidence that the named vendor won a contract.
Cisco appeared in 5 procedures, 33% below its expected mix; VMware appeared in 5, 76% above; Check Point appeared in 4, 14% below; and Palo Alto Networks appeared in 4, 35% below. Check Point is specifically named in Roma servizi per la mobilità’s firewall refresh call, which closes on 16 November. Tenable appeared in 3 procedures, while Google and Trellix appeared in 2 each; no comparison with the usual mix is available for those vendors.
Vendors named in this window’s notices
Procedures naming each vendor, calls and awards together.
Who is buying repeatedly
| Calls | Buyer | Country | Largest call |
|---|---|---|---|
| 3 | ДЕРЖАВНЕ ПІДПРИЄМСТВО "УКРАЇНСЬКІ СПЕЦІАЛЬНІ СИСТЕМИ" | UA | Комплект програмного забезпечення (ліцензія) CrowdStrike Falcon (або еквівалент) код за ДК 021:2015 48760000-3 |
| 3 | Калинопільська селищна рада | UA | Програмний продукт антивірусного захисту - Програмна продукція ESET PROTECT Entry On-prem 1 obj./1 y. -перше п |
| 2 | Bundesrepublik Deutschland, vertreten durch das Bundesministerium des Innern, vertreten durch das Beschaffungs | DE | Unterstützungsleistungen in der Standardisierung von Cyber- und Inform |
| 2 | GMINNY ZESPÓŁ USŁUG WODOCIĄGOWYCH I GOSPODARKI KOMUNALNEJ W DRELOWIE | PL | Cyberbezpieczne wodociągi w Drelowie – dostawa narzędzi dla OT |
| 2 | Ministerul Apararii - Unitatea militara 02415 Bucuresti | RO | Contract de furnizare "Complet firewall Fortigate " |
| 2 | Urząd Patentowy Rzeczypospolitej Polskiej | PL | Organizacja szkoleń z zakresu cyberbezpieczeństwa dla kadry zarządzającej, specjalistów IT i pracowników z nor |
| 2 | ZAKŁAD GOSPODARKI KOMUNALNEJ | PL | Wzrost poziomu Cyberbezpieczeństwa w ZGK w Goworowie realizowane w ramach projektu pn. „Cyberbezpieczne Wodoci |
| 2 | Żuromińskie Zakłady Komunalne Sp. z o. o. | PL | Dostawa sprzętu i oprogramowania oraz usługi wdrożenia w ramach projektu Wzmocnienie cyberodporności sieci IT |
Buyers that published more than one call for tender in this window. An organisation running several at once is usually working through a programme rather than buying once.
The biggest new open tenders
The largest new calls are DSB’s €120.6m IT infrastructure and services outsourcing requirement, closing 3 December; MD-IT GmbH’s €88m AI hospital-billing, compliance and governance framework, closing 2 December; and CANUT’s €12m framework for information-heritage protection, regulatory compliance and data security, closing 18 December. CANUT is a public purchasing centre that runs digital and telecom frameworks; its €12m figure is a framework ceiling. RAI is buying SOC management, monitoring and server and storage maintenance for €11.4m, closing 23 November. Transelectrica seeks monitoring, detection and protection for communications-network traffic for €6.7m, also closing 23 November, while Národná diaľničná spoločnosť seeks cybersecurity and information-security tools and services for €4.9m, closing 7 December. The buyer estimates cited here sit within the 73 of 186 calls that stated a value.
Calls for tender published in this window and still open, by the buyer’s estimated value in EUR; 73 of 186 new calls stated one. A framework agreement or a dynamic purchasing system (DPS) states a ceiling for several purchases, not one contract.
Closing in the next two weeks
Contracts awarded
These are signed contracts, not bid opportunities. CONSILEON Business Consultancy GmbH won the Austrian federal buyers’ IT-Dienstleistungen 2025-2 framework at a €141m ceiling; ECONOCOM PRODUCTS & SOLUTIONS SAS won the French Ministry of the Interior’s ACIM_CYBER_VOLET_2 framework at €93.6m; SITS Deutschland GmbH won Land Hessen’s Microsoft-platform architecture services framework at €24.5m; Accenture Limited won EirGrid’s telecoms consultancy, network support, asset management and network devices framework at €18m; SA Sopra Steria Group won technical assistance to protect Assurance Maladie’s information system at €16.1m; and Magnet Forensics LLC won the Austrian IT-Forensik 8 framework at €15m. Each is a framework ceiling rather than a single purchase. AUROTON COMPUTER, GiTy, SUNTAR and ΑΝΤΑΚΟΜ ΠΡΟΗΓΜΕΝΕΣ ΕΦΑΡΜΟΓΕΣ ΔΙΑΔΙΚΤΥΟΥ ΜΟΝΟΠΡΟΣΩΠΗ ΑΝΩΝΥΜΟΣ ΕΤΑΙΡΕΙΑ each recorded 2 awards; SUNTAR’s reported value was €348,083 and ΑΝΤΑΚΟΜ’s was €14,000.
| Contract value | Contract | Buyer | Winner |
|---|---|---|---|
| €141.0m (framework ceiling) | IT-Dienstleistungen 2025-2 | Auftraggeber sind die Republik Österreich (Bund), die Bundesbeschaffung GmbH sowie alle weiteren Auftraggeber gemäß der AT | CONSILEON Business Consultancy GmbH |
| €93.6m (framework ceiling) | ACIM_CYBER_VOLET_2 | Ministère de l'intérieur FR | ECONOCOM PRODUCTS & SOLUTIONS SAS |
| €24.5m (framework ceiling) | Microsoft Plattform bezogene Softwarebereitstellungs-Services - Architektur | Land Hessen, vertreten durch die Hessische Zentrale für Datenverarbeitung DE | SITS Deutschland GmbH |
| €18.0m (framework ceiling) | ENQEIR944 –Telecoms Consultancy, Network Support Services, Asset Management, Telecoms and Networks Devices and Works Framework | EirGrid plc IE | Accenture Limited (Primary Account) |
| €16.1m (framework ceiling) | Assistance Technique pour la protection du Système d’Information de l’Assurance Maladie | CAISSE NATIONALE DE L'ASSURANCE MALADIE FR | SA Sopra Steria Group |
| €15.0m (framework ceiling) | IT-Forensik 8 | Auftraggeber sind die Republik Österreich (Bund), die Bundesbeschaffung GmbH sowie alle weiteren Auftraggeber gemäß der AT | Magnet Forensics LLC |
| €7.7m | Poskytovanie služieb bezpečnej prevádzky IKT infraštruktúry a ochrany citlivých dátových aktív vrát | Úrad geodézie, kartografie a katastra Slovenskej republiky SK | Slovanet, a. s. |
| €4.7m (framework ceiling) | Acord-cadru de furnizare Soluție de securitate pentru stocare/analiză malware și furnizarea de informații despre actori cibernetici avansați | UM 02499 BUCURESTI RO | ORANGE ROMANIA |
Contract award notices published in this window, by the signed contract value in EUR. These are contracts already placed, not open opportunities.
Who won
Suppliers with the most contract awards this window
Award notices naming each supplier; call-offs under one agreement count separately.
Browse every open public IT tender on SalesDots
Sources consulted
Pages the writer read for context while drafting this column. The figures above come from the notices, not from these.
The nearest deadlines are on 16 November for Slovenská elektrizačná prenosová sústava’s RIS SED Monarch support, Roma servizi per la mobilità’s Check Point refresh, Ukraine’s gas-transmission operator support requirement and Greek public broadcaster network microsegmentation. Vulnerability testing for Všeobecná zdravotná poisťovňa closes on 17 November, followed by Narodowy Bank Polski’s SMTP anomaly-detection system on 19 November.
Method
Built from 316 public procurement notices published from 2026-11-02 to 2026-11-08 and classified into the Cybersecurity vertical: 186 calls for tender, 114 contract awards, 0 prior information notices and 11 other notices. A tender republished in a new version is counted once. Values are converted to EUR at reference rates. Comparisons use the previous 28 days, classified by the same classifier generation. Every figure on this page is computed from the notices; the commentary is written around them. Sources: TED, e-Zamówienia (BZP), Prozorro, Bekanntmachungsservice (DÖE), CVP IS (Lithuania), SEAP / SICAP (e-licitatie.ro), IUB (Latvia), ЦАИС ЕОП (CAIS EOP), World Bank (STEP). Tenders named in earlier editions of this column are not named again.
Frequently Asked Questions
How many cybersecurity notices were recorded from 2 November to 8 November 2026?
316 notices: 186 calls, 114 awards, 11 other notices and 0 planning notices.
What was the largest new open cybersecurity call?
DSB’s outsourcing of IT infrastructure and services, valued at €120,600,000 and closing on 3 December 2026.
How competitive were measured cybersecurity awards?
The average was 3.5 bids across 90 measured competitive awards; 39% were single-bid awards, and 4 direct awards were counted separately.
