Distributor sales in Europe, the Middle East, and Africa of cybersecurity products from EU-headquartered vendors jumped 35 percent in the two years ending in the third quarter of 2026, according to sales figures compiled by Context. The growth far outpaced overall cybersecurity sales, which rose 10 percent over the same period, while US-based companies saw sales increase just 8 percent. The shift reflects a growing trend among European tech buyers to reduce their dependence on American technology providers.
EU vendors gained nearly three percentage points to reach 15 percent of tracked sales by value, though US-headquartered vendors still accounted for 62 percent. The statistics show that EU-based vendors made up 92 percent of tracked sales in security awareness training, 82 percent in vulnerability management, and 52 percent for SIEM and log management. Meanwhile, US-headquartered companies retained 74 percent of identity and access management sales and 54 percent of cloud security sales.
Context veep of research Joe Turner said "digital sovereignty is becoming a buying decision," noting that customers and resellers are asking who holds the encryption keys, who can access sensitive logs, and where that data is stored. The research firm stopped short of attributing the trend to the Trump administration, though the report notes the shift coincides with a loss of trust among customers outside America after the administration "cosied up to autocratic rulers while criticizing and punishing allies with tariffs and more." Instead, Context said organizations are reviewing their reliance on third-party tech in light of EU compliance regimes: the NIS2 Directive and Digital Operational Resilience Act.
NIS2, which was transposed into national law in October 2024, requires organizations in the bloc to raise their common level of security against digital threats and risks to critical infrastructure. DORA, introduced in January 2025, is designed to strengthen cyber security in the financial sector. These regulatory frameworks are prompting enterprise customers to question not just their cloud providers but other parts of the technology stack as well. Turner said EU vendors are gaining an opening as organizations realize they can keep their existing identity platform while choosing a European supplier to manage security logs.
The report highlights that digital sovereignty extends beyond cybersecurity into other areas like artificial intelligence. Analyst firm Omdia found that despite the marketing term meaning "local assets," almost a third of AI providers disclose no proof of sovereignty, and some expect enterprises to pay for audits to verify their claims. Omdia research director Camille Mendler said local hosting isn't sovereignty, and serious providers must demonstrate credibility through transparent operations, fair contracts, and proof of competence, including the network, because data in transit must be sovereign too. As regulatory pressure mounts and customers become more sophisticated about what digital sovereignty means in practice, European vendors stand to capture a larger share of the market—though they're still playing catch-up from a relatively small base. Buyers will need to look beyond marketing claims and demand concrete evidence of operational autonomy and jurisdictional control.