Cybersecurity in Europe

What counts as cybersecurity here

Any company building software or hardware that protects systems, data, identity or infrastructure from attack – vulnerability management, threat intelligence, identity and access, cloud and OT security, and quantum-safe cryptography. We include physical-device and industrial security and exclude general enterprise IT tooling that has security as a feature rather than its core product.

Family: Cyber & security
Coverage since: 2019
Desks: 4
Reviewed: 20 Sep 2026

The four desks

Each one is a live page – this pillar is the way in

Live data

Funding rounds

Every European cybersecurity round we have verified with the company or the lead investor.

Startup directory

Who is building what, at which stage, in which country – filtered to the vertical.

Investors

Funds and angels with a cybersecurity thesis, ticket and stage – not a paid list.

Ranking

Events

Trade shows, deal rooms and buyer fairs assessed for this vertical.

The 8 sub-verticals

Filter the startup desk by any of these

Vulnerability management Threat intelligence Identity and access Cloud security OT and industrial security Quantum-safe cryptography Secure communications AI and model security

Where the companies are

Headquarters counted on the startup desk

UK United Kingdom London FR France Paris, Lyon DE Germany Munich, Berlin NL Netherlands Amsterdam IT Italy Rome, Milan ES Spain Madrid CH Switzerland Zurich FI Finland Helsinki, Oulu

Where the sector stands

Three eras, not a straight line

2020-22

Compliance-driven growth

Rounds were priced on the back of incoming regulation – GDPR, then NIS2 – and sold fear of the next audit rather than a specific threat.

2023-24

The AI attack surface arrives

Buyers realised AI systems themselves needed securing, and vulnerability discovery accelerated on both sides – attackers and defenders both started using AI to find flaws faster.

2025-26

Physical and sovereign security

The largest rounds now go to firmware, OT and quantum-safe security – physical devices, defence-adjacent infrastructure, and sovereignty-driven buyers like the EU Defence mandate.

Three open questions

Where informed people in this sector genuinely disagree

Does quantum-safe cryptography need to exist yet, or is it a decade early?

No large-scale quantum computer can break current encryption today – but several rounds on this desk are being priced as if one is close.

The case forHarvest-now-decrypt-later attacks mean data encrypted today can be stored and broken once quantum computing matures – migration takes years, so waiting until the threat is imminent is already too late for long-lived sensitive data.

The case againstCryptographically relevant quantum computers remain years to decades away by most credible estimates, and companies selling quantum-safe migration today are pricing urgency that outpaces the actual threat timeline.

Where we land: The harvest-now risk is real for a narrow set of long-lived secrets – defence, health records, state data – and thin everywhere else. The rounds that make sense target that narrow set specifically, not blanket enterprise migration.

Is European cybersecurity sovereignty capital or just expensive nationalism?

EU Defence mandates and national security funds are increasingly co-investing alongside traditional VCs in this vertical.

The case forRelying on US or Israeli security vendors for critical infrastructure is a genuine strategic dependency, and European buyers increasingly cannot or will not accept that risk for state and defence-adjacent systems.

The case againstSovereignty-driven procurement can prop up vendors that would not survive open competition on technical merit alone, and the premium European buyers pay for a domestic vendor is not always justified by the product.

Where we land: Sovereignty capital is real and growing, and it is disciplining itself faster than expected – funds like the NATO Innovation Fund still demand technical diligence, not just a European passport.

Can AI find vulnerabilities faster than it creates new ones?

Every fund on this desk now asks founders about AI-assisted vulnerability discovery, on both the offence and defence side.

The case forAI-assisted fuzzing and code analysis is already finding classes of vulnerabilities humans routinely miss, and the tooling improves faster than the code it is scanning.

The case againstThe same techniques lower the barrier for attackers, and AI-generated code itself is shipping with new categories of flaws – the net effect on total vulnerability count is genuinely unclear.

Where we land: The race is real and roughly even for now. The companies worth watching are the ones selling triage and prioritisation – Hackuity's billion-findings problem – not just discovery, because discovery alone is starting to be a commodity.

How to get in

Three audiences, three short lists

If you are building

Pick a specific threat class or buyer, not “security” broadly – the strongest rounds on this desk all sell one clear problem.
Expect diligence on your own security posture before a fund will write a cheque; it is the one sector where the investor checks your product themselves.
Name a design partner from a regulated industry early – it de-risks the entire round.
Pick two events: one buyer-facing trade show, one investor-facing deal room.

If you are investing

Start on the investor desk filtered to stage and ticket, not a conference badge scan.
Ask for real detection or triage numbers, not marketing claims – false-positive rate matters as much as coverage.
Underwrite regulatory tailwinds explicitly (NIS2, DORA) but do not price the round on regulation alone.
Use the funding desk to see who actually led rounds in the last 24 months.

If you are buying or partnering

Map your actual threat model before you look at vendors – the category is too broad to shop by buzzword.
Ask for a live reference customer in your regulated sector, not a logo wall.
Check integration depth with your existing stack before the pitch, not after signature.
Use the startup desk for a shortlist; use events for discovery, not for due diligence.

Who to know

Start on the desks – profiles update as we verify them

IN Investor desk Funds with a cybersecurity thesis Open desk ST Startup desk Companies filtered to cybersecurity Open desk FD Funding desk Verified rounds Live EV Events desk Assessed rooms Ranking

Glossary

Terms that keep coming up on this vertical

Vulnerability Operations Center (VOC)

A platform that pulls findings from many security tools, adds threat and business context, and prioritises which vulnerabilities actually need human attention this week.

Harvest now, decrypt later

An attack pattern where encrypted data is stolen today and stored, to be decrypted once quantum computing makes current encryption breakable.

OT security

Operational technology security – protecting industrial control systems, robots and physical machinery, as distinct from IT security for conventional computers.

NIS2

The EU's updated Network and Information Security directive, expanding cybersecurity obligations to a much wider set of companies from 2024 onward.

Zero trust

A security model that assumes no device or user is trusted by default, even inside the network perimeter, and verifies continuously instead.

Latest coverage

Reporting and analysis tagged to this vertical

Open the cybersecurity news feedNews →

Articles tagged to this vertical

All verticals, by family

Twelve families – each carries its own icon and accent token

Agrifood 8 verticals Climate & energy 7 verticals AI & data 6 verticals Deep tech 6 verticals Health 5 verticals Consumer & media 5 verticals Hardware 5 verticals Space 4 verticals Software & SaaS 5 verticals Web3 & crypto 4 verticals Cyber & security 4 verticals Mobility 4 verticals

Frequently asked

About this vertical and how we cover it

Is defence tech the same vertical as cybersecurity?

No, but they overlap heavily – several funds and events cover both, and dual-use companies (secure comms, OT security) are often tagged to both verticals.

Why are only 4 investors verified out of 14 tagged?

Every fund shown on the investor desk has a disclosed ticket range or fund size we can verify directly. The remaining funds carry the vertical tag but have not yet published enough data to rank honestly.

How often does this page change?

The numbers come from the four desks and move weekly. The written analysis is reviewed quarterly and the review date at the top is the honest one – if it is stale, the analysis is stale.

Can I suggest a company or fund for the desks?

Yes. Use the suggest links on each desk. We verify before publishing; paid placement does not get you onto a ranking or directory.