European buyers are moving more of their security spend to EU-headquartered vendors, according to Context distribution figures reported by The Register. In the UK the picture is less clear, and the public sector’s biggest technology suppliers remain heavily American.
What happened
On 12 November 2026 The Register published distribution sales data from market intelligence firm Context. The data suggests digital sovereignty has moved from conference panels into purchase orders. According to the Context figures reported by The Register, channel sales in EMEA of cyber security products from vendors headquartered in the EU rose 35% in the two years to the third calendar quarter of 2026. Over the same period the whole tracked market grew 10% and sales from US-run vendors grew 8%.
The starting base was small. The same Context figures reported by The Register put EU vendors at roughly 15% of tracked sales by value, a gain of close to three percentage points in two years. US-headquartered suppliers still account for 62%, so the market has not flipped, but growth at more than three times the market rate is notable.
Context’s vice president of research, Joe Turner, told The Register that customers now want to know who holds the encryption keys, who can see sensitive logs and where that data physically sits. He described sovereignty as “becoming a buying decision”. Context did not blame any particular government for the shift. It pointed instead to EU compliance regimes, chiefly the NIS2 Directive and the Digital Operational Resilience Act (DORA), which push organisations to scrutinise their dependence on third-party technology.
The detail
The category split shows where European suppliers have gained ground. In the Context figures reported by The Register, EU-headquartered vendors took 92% of tracked sales in security awareness training, 82% in vulnerability management and 52% in SIEM and log management. US vendors still held 74% of identity and access management and 54% of cloud security.
The pattern makes sense. Log platforms and vulnerability scanners collect exactly the telemetry that sovereignty questions are about: authentication records, asset inventories, configuration weaknesses and incident evidence. Turner’s point was that an organisation can keep its existing identity provider and still pick a European supplier to hold its security logs.
Context’s third-quarter figures, reported by IT Brief UK in late October, give some UK context. It showed EMEA buyers moving budget towards compliance, training and access control. Compliance, awareness and training revenue rose 75.9% year on year and identity and access management rose 33.7%. The UK did not share in the growth. UK and Ireland distribution sales slipped 0.8%, and UK sales alone fell 1.1%, which Context put down to enterprises delaying purchases. Benelux and the Nordics grew strongly over the same quarter. The Register said it had asked Context for UK-specific figures on EU vendor share and had not yet received them. As things stand, there is no evidence either way that British buyers are following the continental trend.
Why it matters for UK organisations
Public-sector buying gives the UK angle. On 11 November the Institute for Public Policy Research published Locked in: A realist’s agenda for digital sovereignty, using Tussell procurement data for 2024-25. It found that four-fifths of public-sector technology spend goes to just 150 suppliers. Of that spend, only about 15% reaches firms that are British on every count: UK-headquartered, UK-owned, with a mostly local workforce, and not reselling products made elsewhere. IPPR said almost twice as much ends up with US companies as with all other foreign countries combined, and it warned that critical infrastructure is “exposed to decisions taken in Washington”.
The report is not about security tooling specifically. But UK government and critical national infrastructure security estates sit on top of that same supplier base. That matters as the Cyber Security and Resilience Bill extends NIS-style duties to more operators and managed service providers. Firms that sell into the EU face a further pressure: their NIS2- and DORA-regulated customers are asking where logs live and who can reach them. UK suppliers and UK subsidiaries of EU groups should expect those questions in tenders and due diligence questionnaires.
There is a commercial angle for the domestic sector too. UK security vendors are not EU-headquartered, so they do not count towards the EU share in this data. If European buyers increasingly favour suppliers under their own jurisdiction, UK firms will need to show their data handling, key management and support arrangements meet buyers’ sovereignty tests. Being based nearby will not be enough.
Expert view
In my experience, sovereignty conversations go wrong when they turn into flag-waving about head office locations. What actually decides your exposure is technical and contractual. Who administers the platform? Can the vendor’s support staff, or a court in another country, compel access to your telemetry? Are you holding the keys, or is the supplier? When we test environments that rely on SaaS security tooling, the riskiest paths often run through the vendor’s own support and integration accounts, not through the customer’s network.
The Context category split is telling. Buyers are moving the things they can move cheaply, such as training, scanning and log storage, while staying with US incumbents for identity and cloud security, where switching costs are high. Analyst firm Omdia, as cited by The Register, made a related point in October about sovereign AI services. It found that nearly a third of providers offered no proof of sovereignty, and its research director Camille Mendler cautioned that “local hosting is not sovereignty”. The same scepticism should apply to security vendors who badge themselves as European.
I would also be wary of reading too much into a single dataset. These are distributor figures. They miss direct enterprise deals and much of the managed service market, which Context itself says is drawing spend away from traditional channels.
What to do now
- Map your security data flows. For each security tool (SIEM, EDR, email security, vulnerability scanning, backup), record where data is stored, which legal entity processes it and who holds the encryption keys.
- Review vendor and support access. List every vendor support account and integration with administrative rights. Under Cyber Essentials, these fall within user access control: least privilege, MFA and removal when no longer needed.
- Add sovereignty questions to procurement. Ask about data residency, customer-managed keys, sub-processors, cross-border legal access and exit terms, including how you get your logs out in a usable format.
- Plan for exit. Make sure you could retain security logs for your required period if a supplier relationship ended suddenly. Test the export before you need it.
- For UK suppliers selling into the EU: prepare clear documentation on data location, key management and support arrangements. NIS2 and DORA customers will increasingly ask for it.
Bottom line
The Context figures reported by The Register point to a real, if early, shift. European buyers are bringing parts of their security stack under EU control, starting where switching is easiest. The UK data so far shows a soft market rather than a sovereignty push, and IPPR’s work suggests public-sector spend is still heavily tied to US suppliers. Whatever your view of the politics, knowing exactly who can reach your security data is good practice. That is where UK organisations should start.
