Experimental and operational deployments, openness to third countries, and expanding the scope through awarded contracts… The European Cybersecurity Reserve is gradually gaining momentum.
Brussels had announced its establishment at the end of August 2025, with a budget of €36 million. Objective: to build, via MSSPs, a mobilizable incident-response capacity against major cyber events. The scheme targets three types of beneficiaries:
- Critical entities of the Member States
- EU institutions, bodies and agencies
- Third-country partners in the Digital Europe programme
A pool of 47 providers as a first operational baseline
To ensure immediate availability while calls for proposals were launched, the reserve began with a pool of 47 suppliers, selected under the pilot mechanism known as the “cybersecurity support action.” Also led by ENISA, it was nonetheless oriented as much toward preparedness as toward response. Its total budget stood at €28.3 million, comprising €4 million for a single EU-wide lot and €24.3 million spread across 27 lots of the same amount for the Member States.
France has a single representative on the providers list: Airbus Protect. The safety and (cyber)security subsidiary of the aerospace and space group is among the awardees of the EU-wide lot, as well as those for Austria and Belgium. It alone secured the lots for France, Germany and Luxembourg.
Four tenders to expand the scope of the reserve
ENISA launched calls for proposals* to replace the pilot contracts that were due to expire. It did the same to open the reserve to EU institutions and third countries.
The “EU institutions” lot went to Certisign (Romania), NVISO (Belgium) and Span (Croatia). Projected value: €1.2 million excluding VAT over three years.
Results of the “third-country” tender—organized between December 2025 and February 2026—have not been published. It involves €1.5 million over three years. Framework contracts will be awarded to up to five economic operators.
An procurement combining the implementation of the reserve and the cybersecurity-support action took place in September–October 2025. Amount: €3.6 million over three years, split into four lots of €900,000 for four beneficiaries: Bulgaria, Malta, the Netherlands, Poland. A Bulgarian supplier, a Romanian, a Luxembourgish and two Spanish entities are co-awardees for Bulgaria. A Belgian, a Luxembourgish and two Spanish entities are co-awardees for the Netherlands.
More recently (May–July 2026), a larger call for proposals was conducted: €18 million over four years, evenly distributed among nine Member States. Specifically: Austria, Belgium, Denmark, Estonia, Finland, Luxembourg, Czech Republic, Slovakia, and Sweden.
ENISA is also preparing, in parallel, a procurement for legal services related to the implementation of the reserve.
A “field intervention” during Moldova’s parliamentary elections
In June 2026, the EU opened the reserve to Ukraine. It had done the same in July 2025 for Moldova. With the September parliamentary elections in view, Moldova faced a hybrid destabilization campaign attributed to pro-Russian actors. An intervention unit drawn from the reserve intervened to, among other things, isolate malicious flows targeting the electricity network and ensure remediation of institutional servers.
A field test of the reserve was also conducted in June 2026 under the CyberEurope umbrella. It involved a large-scale incident-response exercise focusing on maritime and rail transport.
Obstacles, including the “fungibility” of services
The reserve establishes a fungibility mechanism: credits not used for incident response can be converted into preparedness services.
This has become the predominant practice, noted the European Court of Auditors. The trend appeared from the pilot phase and has since entrenched itself: the majority of Member States preferred to allocate their entire share to preparedness.
The lack of a harmonized taxonomy for classifying “important” or “major” incidents did not help. ENISA and the European Commission are working on it, while also seeking to remove the legal uncertainty that drives countries to conceal the real scale of cyberattacks.
* Price weighs 30% of the score. Quality makes up the rest, with one-third of the points tied to the proposed response to three attack scenarios. Notably, for each expert profile sought (preparation, incident management, exercises/training), at least one team member must have a C1 level in the official language of the recipient country. All systems used for management and response must be hosted in the European Economic Area.
