European firms are ditching US cybersecurity firms as report claims 'digital sovereignty is becoming a buying decision'

European firms are increasingly turning away from US cybersecurity vendors in favor of locally-based alternatives, according to a new report. The Context report, published by The Register, reveals that EU-based vendors saw a 35% increase in sales over the past two years, compared to just an 8% growth for their US counterparts. This shift is driven by the growing emphasis on digital sovereignty, which is now becoming a key buying decision for many companies.

While European companies have already been moving their cloud providers to more local, homegrown options, the same trend is now extending to cybersecurity. The report highlights that sales from EU-based vendors have outpaced overall market growth, which only rose by 10% during the same period. Among the areas where EU-based vendors are seeing the most interest are security awareness training, vulnerability management, and security information and event management (SIEM).

Despite this shift, US vendors still dominate 62% of the EMEA (Europe, Middle East, and Africa) cybersecurity market. Among the areas where US companies continue to lead are identity and access management and cloud security. This could be due to many companies still relying on US cloud services.

Research VP Joe Turner explains that as customers and resellers gain a better understanding of digital sovereignty, they are increasingly asking critical questions such as who holds encryption keys, who can access sensitive logs, and where data is stored. However, there are also concerns about the lack of regulation surrounding digital sovereignty claims. A study by Omdia found that up to 28% of providers do not disclose evidence of their sovereignty status.

Camille Mandler, Telco B2B Research Director, warns that there is no regulation governing which companies can claim to be a sovereign AI provider. Nevertheless, nearly half (45%) of European enterprises plan to add or replace IT suppliers within the next 18 months due to sovereignty requirements, compared to just 30% in North America.