On the Mandos platform, 30 European companies sit under Offensive Security, and together they've raised $94M. The 48 North American ones have raised $2.29B. Hadrian is filed under exposure management, so add its $65M and Europe still has less than 7% of the North American total.
Nobody wins a spending race from there, so I looked at how the European companies describe themselves. Of the ten European offense companies on the platform with disclosed funding, four make a point of where the data sits or which EU rule they meet: hosting in the EU, all processing in Germany, built for DORA and NIS2.
It works because an offense product's output is a map of working routes into your company, and that's one of the most sensitive files a vendor can hold. DORA already requires threat-led penetration tests from the EU financial firms their regulators select, so a buyer under that rule has a real reason to care which country the map lives in.
Offense isn't the only place this shows up. This week WALLIX launched Sovereign Identity Access, built with a government ministry and able to run with no outside cloud. FusionAuth, an American identity vendor, opened a UK sales team and said its European recurring revenue grew 72% in two years as buyers asked for control of their data.
If you're a European founder, sovereignty gets you the first meeting at a bank, a ministry or a utility, and it stops helping after that. Hadrian's release leads with product and customers, and three of the seven customers it names are American, so it wins or loses on what the agent finds. If you're an American founder selling into Europe, expect "where does it run, and who can read it" in the first call. Have a real answer: an EU region, or a version the customer hosts.
If you're an investor, the gap is both the opportunity and the risk. European offense is cheap to back, but $94M across 30 companies won't pay for a US sales team at most of them. I'd look for the ones that already sell outside Europe, the way Hadrian does.
Through the eyes of a CISO buyer it's simpler, because a leaked pentest report is a gift to an attacker. So before the demo I'd ask three things about the findings: where they're stored, who can be forced to hand them over, and when they're deleted. I'd ask that of any offense vendor, in any country.
Where I could be wrong: sovereignty has been next year's budget line in Europe for years, and plenty of buyers say sovereign and then sign American. One quiet week of small rounds isn't a trend either, and if the big American offense vendors open EU regions, most of this edge goes with it.
Where I land: in Europe, offense gets bought from whoever keeps the map at home.
Radar signals
- Hadrian changed its homepage headline between 2 and 6 October, from "The AI that hacks you should be working for you." to "Know your attack surface, Pentest it continuously". The round was announced on the 6th.
- Torq took a report on what 450 CISOs and security leaders want in an AI SOC off its homepage and put up a guide on how to evaluate and buy one. The swap happened between 4 and 8 October.
- Nudge Security dropped the homepage line "IT & security can't keep up" for "The attack surface is growing where security can't see it." between 5 and 8 October.
- NeuralTrust added a Pricing link to its homepage menu between 5 and 9 October, right next to "Book a demo".
- Filigran moved its homepage counter from "6,000+ cybersecurity practitioners" to "7,000+" between 6 and 9 October.
One question
If you're building or backing a security company in Europe: is "runs in Europe" a reason customers buy from you, or only a reason they take the first meeting? Reply and tell me what closed your last deal. The best replies get quoted, anonymously, next week.
Thank you for reading.
If you want more than the newsletter: get the full market picture on the Mandos platform, and if you are building or investing in this space, let's talk.
Talk to you next Monday.
Nikoloz
