Europe's Cybersecurity Crossroads: Why Sovereignty Is Now a Procurement Question

Europe's Cybersecurity Crossroads: Why Sovereignty Is Now a Procurement Question

The original version of this post was written as a 2025 forecast, priorities to watch, trends to prepare for. That framing has a shelf life of about a year before it reads as dated. Worse, it treats regulation and threat activity as things on the horizon, something to get ready for. They're not. DORA has been in force for financial entities since January 2025. NIS2 transposition is uneven across member states, but enforcement is closing that gap, not widening it. The organisations affected by both are not preparing, they are already exposed, right now, to obligations most of them are not fully meeting.

That's the actual starting point. Not "what should Europe prepare for", but "what is already required, and what is already happening on the network."

The regulatory floor is not aspirational

DORA's threat-led penetration testing requirement is not a suggestion for large financial entities in scope, it's a mandate, and it specifically calls for testing that simulates real adversary tradecraft rather than a generic vulnerability scan with a report attached. TIBER-EU, the framework several national regulators and central banks have adopted to operationalise exactly that requirement, has moved from a niche practice among the most sophisticated banks to something increasingly expected across the regulated financial sector, and NIS2's essential and important entity categories are pulling energy, transport, health, and digital infrastructure operators into a similar posture even where TIBER-EU itself doesn't formally apply.

The practical effect: a generic penetration test, the kind built around a checklist rather than a threat actor, no longer satisfies what regulators are actually asking for. Testing has to be threat-informed, meaning it has to be built around what a specific class of adversary would actually do, not a standard OWASP-style walkthrough. That's a different commercial category from traditional pentesting, and most organisations shopping for it don't yet know that distinction exists.

The threat behind the regulation is more specific than "cybercrime is rising"

Most cybersecurity content defaults to a vague, upward-trending threat narrative that applies everywhere and specifies nothing. For European critical infrastructure, energy, logistics, undersea cable and port infrastructure, telecoms, the actual picture is sharper and considerably less generic: state-linked pre-positioning consistent with sabotage and hybrid-warfare objectives rather than straightforward espionage, spillover from the war in Ukraine into Baltic and Nordic infrastructure, and activity that in several documented cases has continued regardless of whether it was publicly attributed.

That's a different threat model from the ransomware-and-phishing baseline most security budgets are still built around, and it's the one actually driving the regulatory tightening described above. Treating DORA and NIS2 as pure compliance exercises, disconnected from the specific threat picture that produced them, is how organisations end up technically compliant and still exposed to the thing the regulation was written to address.

Sovereignty is a procurement question, not a slogan

"European sovereignty" gets used as a talking point more often than it gets used as a criterion. In practice, it comes down to a specific, answerable question when you're buying threat intelligence or testing services: is this built on a single non-European source repackaged for the market, or does it genuinely reflect the threat picture relevant to European infrastructure and European regulatory obligations.

That's the gap we built SAFA to close. Our own research is offensive-led and European, and it sits alongside partners like TeamT5 for the regions where their visibility genuinely adds something, rather than a single feed standing in for the whole picture. For a deeper look at how fused sourcing actually works, and how that plays out against a specific threat category, our piece on what an advanced persistent threat actually is goes into the Russia-nexus and hybrid-threat picture in more depth.

What to actually do with this

If your organisation falls under DORA or NIS2, the question worth asking this quarter is not "are we compliant on paper" but "has our testing actually been built around the adversary tradecraft relevant to us, and is our intelligence sourced from somewhere that reflects the European threat picture rather than a generic global feed." Those two questions, answered honestly, tend to surface the gap faster than a compliance checklist does.