How governments buy cybersecurity: a $4.9 billion contract study

Rerun the selltostate.com study "How governments buy cybersecurity" with current data.
The article is at https://www.selltostate.com/blog/how-governments-buy-cybersecurity/.

1. Get access to the selltostate.com API.
   - If I give you an API key, use it in the header x-api-key: <key> and go to step 3.
   - If not, sign up as an agent: POST https://app.selltostate.com/api/oidc/register
     with the JSON body {"client_name": "<your name> for <my name>"}.
     Keep client_id and payment_link from the answer.
2. Pay for access. The price is at GET https://app.selltostate.com/api/v1/price.
   - Show me the price and the payment_link. Wait for my yes.
   - I pay on the payment_link. Then use the header Authorization: Bearer client:<client_id>.
3. Check access: GET https://app.selltostate.com/api/v1/whoami must show "active": true.
   Keep the key and the client_id private.
4. For these countries: [your countries, or all], search the awards and tenders whose title names
   cybersecurity. Use the terms of the article in each language: cyber, cybersecurity, information security,
   firewall, antivirus, endpoint protection, SIEM, SOC, penetration test, vulnerability, and the vendor
   names Fortinet, Sophos, ESET, Palo Alto Networks, Check Point, Kaspersky, Trellix, Tenable.
   Count a record when a term is in the title, or when the description names a security product, a vendor
   or a cybersecurity service. Drop the false matches that the article lists
   (antiviral drugs, building fire walls, intrusion alarms, forest firebreaks, soil penetration tests,
   and clauses such as "the supplier must guarantee information security").
5. Count the matches and all procurements by country, source and quarter from the same snapshot.
   Keep one consistent source per country, with the same deduplication rule for both counts.
   Divide the matches by all procurements and multiply by 10,000. The article's quarterly download
   reproduces its original snapshot; do not divide fresh matches by those old denominators.
   If access cannot provide a matching denominator, report counts only and name that limitation.
   Use complete quarters only: a quarter with fewer than 50 procurements or fewer than 60% of the
   country's median quarter is incomplete (the US Department of Defense publishes 90 days late).
6. Report: cyber procurements per 10,000 by country and year, what is bought (licences, appliances,
   managed services, testing, training, staff), the vendors named, the median contract in US dollars,
   and the cyber tenders that are open now, with links.
7. Compare your results with the article. Explain the differences: newer data, other sources,
   and the terms that you did not use.

Governments in our 59-country study awarded $4.9 billion in cybersecurity contracts in their last complete fiscal year. These countries hold 27% of the world’s people and 39% of its land. The annual total covers the 56 countries with a complete fiscal year; the United States accounts for 48% of it.

The real market is larger. Many purchases state no usable award value. Contracts where cyber is one part of a wider IT purchase are not in the total. Classified defence buying is not published.

We read 42,840 public procurements for cybersecurity in 59 countries, Q1 2024 to Q3 2026. They come from 27.8 million procurements of 34 sources.

Most countries buy cyber more often than in 2024. In 34 of 55 countries, a larger share of public procurements bought cybersecurity in the last four complete quarters than in 2024. The median country’s procurement rate grew 11.2%. In Europe, Poland accounts for most of the extra procurements, and notices that name EU funds grew. Outside Europe, the median country grew 2.8%, and almost no tender names a law or a fund.

Cybersecurity spending grew outside the United States and fell by half in it. Here, spending means published contract award values, which can cover several years of work. The records show commitments, with no measure of when buyers pay. On the same fiscal quarters, cybersecurity spending outside the United States grew 7.0%. US federal cybersecurity spending fell from $1.54 billion to $791 million. US agencies bought more often, in smaller contracts, and a few very large contracts of fiscal 2025 did not come back. Inside the median country, the median contract value rose 8%.

Who buys and what. In the United States, defence accounts for 43% of cybersecurity spending; in Europe it accounts for 2.7%. Licence renewals are 36% of cyber purchases. Fortinet is the most named vendor in 23 of 36 countries, and local resellers win those contracts. 98 cyber tenders with a known deadline were open on selltostate.com on 29 October 2026.

Government cybersecurity spending by country

The annual total combines each country’s last complete fiscal year. The $4.9 billion covers 56 countries with a complete year. The historical counts and procurement-rate comparisons cover a wider group of 59 countries. A published award can commit a buyer to several years of work. Missing award values make the spending totals lower bounds.

Cyber purchases were worth $4.3 billion in 2024 and $4.8 billion in 2025. The first three quarters of 2026 hold $3.1 billion, against $4.0 billion in the same quarters of 2025. The quarterly chart includes the partial US quarter. Q3 2026 holds 598,000 US procurements, against 1.52 million in Q3 2025, because of the defence reporting delay. Use the matched fiscal-quarter comparisons below for the change in spending.

US cybersecurity spending fell; spending elsewhere rose 7.0%

We compare fiscal years on the same complete quarters. Each country compares this fiscal year so far with the same fiscal quarters of last year. Outside the United States, cybersecurity spending went from $1.61 billion to $1.73 billion. With the United States, it went from $3.16 billion to $2.52 billion.

The US decline combines fewer large awards and smaller typical contracts. In the first three quarters of fiscal 2026, US agencies placed 673 cyber purchases, against 602 a year earlier. The median US purchase fell from $145k to $118k.

• The largest awards were smaller. The five largest US cyber purchases of the first three quarters of fiscal 2025 held $560 million; in fiscal 2026, $185 million. The largest was a $311.2 million interim award of the Department of State. The State Department went from $314 million to $3.1 million, the Department of Energy from $201 million to $25 million.
• Defence bought more often in smaller contracts. The Department of Defense placed 363 cyber purchases, against 291. Its median purchase fell from $193k to $108k, and its total from $687 million to $460 million.
• The decline extends beyond the largest awards. Without the five largest contracts, US cybersecurity spending went from $983 million to $606 million. The 90th percentile fell from $4.7 million to $2.6 million.

European cybersecurity spending rose through Poland

European cybersecurity spending rose 4.4%, while spending outside Poland fell 18.4%. On matched fiscal quarters, published award values rose from $1.01 billion to $1.06 billion. Those totals cover 850 awards with a value before and 1,110 after. Poland rose from $38 million to $262 million; the rest of Europe fell from $973 million to $794 million.

Spending rose in 22 of 55 countries on matched fiscal quarters. Large awards and missing values affect each country’s result. More frequent cybersecurity purchases can coincide with lower award totals.

Cybersecurity procurement frequency by country

Cyber buying is densest in Central Europe. Of the countries with 20,000 or more procurements, Slovakia buys cyber most often: 233 of every 10,000 procurements in the last four complete quarters. Poland follows with 215, Czechia with 180. The United States has 2.5, because its source counts every contract action, including each order under a framework.

The median country went from 38 cyber procurements per 10,000 in Q1 2024 to 59 in Q3 2026. The 25th and the 75th percentile moved up too. The number of countries per quarter changes because we use complete quarters only.

In 34 of 55 countries, the rate grew between 2024 and the last four complete quarters. Three countries more than doubled it: Poland, Slovakia and Luxembourg. The United Kingdom went from 81 to 111, Greece from 117 to 164. In 21 countries the rate fell, among them Germany (76 to 69), France (34 to 27) and the Netherlands (64 to 58).

Outside Europe, the median procurement rate grew 2.8%

Outside Europe, 13 of 24 countries grew, and the median one by 2.8%. Only 1.4% of their cyber procurements in 2026 name a fund or a law, against 1.0% in 2024. These counts describe explicit mentions. Programmes and regulations can affect a purchase without appearing in its notice.

• North America. Mexico went from 20 to 30, Canada from 61 to 59, the United States from 2.3 to 2.5. The US rate is low because its source counts every contract action.
• Latin America. The median country grew 1.7%. Colombia went from 13 to 12 and Brazil from 27 to 26. Licence renewals and individual specialists make up much of the region’s cyber purchases.
• Asia-Pacific. Singapore went from 123 to 121 and Japan from 46 to 54; 3 of 4 countries grew.
• Africa. The median country grew 0.7%. South Africa went from 66 to 81. Nigeria fell from 32 to 14 and Kenya from 44 to 37.

Cybersecurity funding and public-sector purchase waves

Europe placed 3,427 more cyber procurements a year in the last four complete quarters than in 2024, and 63% of the increase is Poland. The United Kingdom added 300, Spain 215 and Slovakia 148. Without Poland, 20 of 30 European countries grew, the median one by 15.7%.

Funds are named far more often than laws. European cyber procurements that name an EU fund went from 450 in 2024 to 909 in 2025 and 1,190 in the first nine months of 2026. 20.6% of the European cyber procurements in 2026 name a fund or a law, against 9.8% in 2024. The EU recovery fund appears most often among the named programmes. Its line falls in Q3 2026, after the last day for the work in Poland.

A mention identifies a programme or a rule in the notice. NIS2 extended the scope of EU cybersecurity rules, including to waste and wastewater management. Member states had to transpose it by 17 October 2024. Tenders that name NIS2 went from 44 in 2024 to 148 in 2025. GDPR appears in 200 European cyber procurements in the last four quarters, up from 74 in 2024. The notices cite it as a data clause; the law dates from 2018. The EU medical device regulation appears in 5.

Hospital cybersecurity: KHZG, IROP and KPO

Across the 59 countries, hospitals place 6.8% of cyber procurements; Poland, Czechia and Germany hold 72% of all hospital cyber procurements in the study. Each of these countries has a programme that pays hospitals for cyber security.

• Germany: the hospital future fund (KHZG). The law requires that at least 15% of each grant goes to IT security, and the first end date of the programme was in 2024. German hospitals placed 180 cyber procurements in 2024 and 55 in the first three quarters of 2026.
• Czechia: the EU regional programme (IROP). In 2022 the programme opened calls for the cyber security of hospitals, police, fire services and regions. Czech hospitals peaked at 89 cyber procurements in Q3 2025 and placed 24 in Q3 2026.
• Poland: the EU recovery plan (KPO). Investment D1.1.2 paid for digital records and cyber security in hospitals; its last day for the work was 7 August 2026. Polish tenders that name it went from 2 in 2024 to 558 in 2026. Polish hospitals went from 10% of the Polish cyber procurements in 2024 to 47% in 2026, with 498 in Q1 2026 and 67 in Q3 2026.

Water cybersecurity procurement and Poland’s Cyberbezpieczne Wodociągi programme

Water and sewage operators and sector authorities placed 388 cyber procurements in 27 countries. Their calendar-year inventory includes incomplete quarters. The growth check pairs the same complete quarters in both years.

Water-sector purchases rose from 69 to 104 on matched quarters, with Poland and the United Kingdom accounting for the increase. We compare Q1 to Q3 of 2024 and 2026, and keep each country-quarter only when it is complete in both years. Poland went from 0 to 29 and the United Kingdom from 3 to 13. The other countries together went from 66 to 62. Polish notices use the project name "Cyberbezpieczny Wodociąg". The CPPC programme page names it "Cyberbezpieczne Wodociągi" and identifies the EU recovery plan as its funding source.

Transport-sector purchases rose from 78 to 122; electricity, gas and heat purchases fell from 116 to 106. Waste and recycling went from 9 to 2, too few records for a broad conclusion. These are procurement counts. We lack the total number of all purchases by utilities, so we cannot calculate a procurement rate for each sector.

These sector patterns identify buyers and programmes for a closer check. The European Commission’s NIS2 summary lists cybersecurity duties for covered energy, transport, water, wastewater and waste operators. A seller can check each buyer’s compliance work, grant and renewal dates. The records cannot establish whether fear of terrorism or sabotage caused the purchase.

Government cybersecurity buyers

In the United States, defence accounts for 43% of cybersecurity spending; in Europe it accounts for 2.7%. US federal awards account for 94% of defence cybersecurity spending in the study. Across all countries, defence places 7% of cyber purchases and accounts for 23% of their value. In Europe, local and regional governments account for 13%, hospitals and health services 13%, tax, finance and customs 13%, police and justice 11%.

National governments place 44% of all cyber procurements, local governments 18%. In Europe and Latin America, regions, towns and public companies buy a large share. In North America, the sources cover mostly the national government.

The largest single buyers are US defence departments. The Navy placed 422 cyber procurements, the Air Force 374 and the Army 225. Outside the United States, the largest buyers are a Honduran buyer unit named Unidad Central (251) and the Bank of Zambia (132). The market is wide: 10,932 buyers placed at least one cyber procurement, and the 10 largest placed 4.8% of them.

What governments buy: cybersecurity products and services

Licence renewals are the largest purchase type. Licence renewals and subscriptions are 36% of the cyber purchases and 33% of their money. Managed security services are 7% of the purchases and 11% of the money. These services can cover people and operations over several years.

The service types divide the work by task and duration. An audit checks the security once. A compliance project writes the rules and the documents. A managed service runs the security every day. A licence renewal buys one product, while a new system buys several products and the labour to install them, so its median is 7.4 times as large.

The purchase mix is stable over time. Managed security services went from 6.3% of the cyber purchases in the first four quarters to 7.5% in the last four. The other types moved less.

Each region buys its own mix. North America buys the most licence renewals, 49% of its cyber purchases, many of them US federal orders for Trellix, Tenable or Cisco. Latin America buys the most individual specialists, 19%, because Colombia hires cyber specialists on personal service contracts. Central and Western Europe buy more new systems and services: their tenders come from TED, which shows the larger contracts.

Cybersecurity contract values: medians, percentiles and concentration

The median cyber purchase went from $28k in Q1 2024 to $80k in Q3 2026, but the mix of sources made most of that change. TED contracts, which are above the EU thresholds, were 8.6% of the purchases with a value in 2024 and 19.8% in 2026. Latin American contracts, which are small, went from 45.9% to 34.7%. In the 21 countries with 20 or more valued purchases in both fiscal years, the median contract rose 8%, and it rose in 13 of them.

Published contract values are larger in Europe than in Latin America. The median cyber purchase is $11k in Latin America, $12k in Africa, $97k in North America and $427k in Southern Europe. TED publishes only contracts above the EU thresholds. Purchase types also differ: a town’s antivirus renewal and a ministry’s managed service cover different work and periods.

Defence, police and tax agencies account for 63% of US cybersecurity spending and 27% of European cybersecurity spending. Every European sector has a median of $249k or more, and every Latin American sector $26k or less. These comparisons combine differences in source coverage, purchase types and buyers. They provide a starting range for a comparable contract.

A few contracts hold most of the money. The largest 1% of cyber purchases hold 46% of the money. The median cyber purchase is $51k, and the middle half costs $11k to $261k.

Cybersecurity vendors, suppliers and contract winners

Fortinet leads the vendor names in public procurements

23% of cyber procurements name at least one vendor, and Fortinet is in 27.2% of them. Kaspersky is second with 13.5%, Sophos third with 8.3%. Fortinet is the most named vendor in 23 of 36 countries. ESET leads in Ukraine, where Kaspersky is banned, and Trellix and McAfee in the United States.

Kaspersky fell from 15.3% to 5.5% of the vendor-naming procurements, and 98% of its mentions are in Latin America and Africa. Tanzania alone has 824 of the 1,355 mentions: 68.8% of the Kaspersky mentions sit inside a PC, laptop or office-supply tender that lists "Kaspersky antivirus" as one line. The EU and the United States have 12 together. The US Department of Commerce banned Kaspersky sales to US persons in 2024.

Who wins government cybersecurity contracts

Fortinet is named in the titles of 2,005 cyber purchases and won 0 of them. Sophos won 2, Microsoft 13. The observed winners include resellers and integrators. Précicom Technologies won 181 cyber purchases from Quebec buyers, FCN 165, Thundercat 156 and Carahsoft 150 from US federal buyers. Softcat won 129 in the United Kingdom and Ireland.

Most TED awards with a winner country went to a domestic supplier. In TED, 96.7% of the cyber contracts with a winner country went to a company registered in the buyer’s country. Across the title-layer records, 7,810 normalized supplier names won at least one cyber purchase. The 10 most frequent names took 6.3% of the recorded wins.

Open cybersecurity tenders: 29 October 2026 snapshot

On 29 October 2026, 98 cyber tenders with a known deadline were open on selltostate.com, in 19 countries. Poland had 18, Spain 14, Germany 12. 41 had deadlines within two weeks of the snapshot; the median tender closed in 18 days. 25 bought licence renewals, and 2 were for Polish water companies.

This is a dated inventory. Check the current deadline and documents in the live search before you plan a bid.

For sellers

• Size the market with comparable award data. The study records $4.9 billion in published awards across 56 countries’ last complete fiscal years. Check coverage, contract duration and the buyer’s purchase history before you treat an award total as annual demand.
• Check funding windows. Hospital procurements peaked at different times in Germany, Czechia and Poland. Polish water notices name a specific grant. Read the programme terms, eligible buyers and deadlines before you build a list.
• Check renewal conditions. Licence renewals are 36% of cyber purchases. Read the named product, licence period, reseller conditions and evaluation criteria in each tender. The study records winners; it cannot establish why a bid won.
• Assess local resellers and integrators. In TED, 96.7% of cyber awards with a winner country went to a domestic supplier. Use the supplier lists to identify possible partners, then check their capabilities and authorizations.
• Compare like contracts. Use the country, purchase type, contract duration and source threshold when you compare prices. The percentile charts show the spread that a single median hides.