In 2025, NRD Cyber Security saw growth in both its project-based activities and ongoing services

NRD Cyber Security says 2025 demand for cybersecurity services is rising in Europe, driven most by the NIS2 Directive and more mature client security practices. The firm highlights a sharp increase in demand for ongoing services like CISO support and SOC operations, including its Natrix cyber threat monitoring platform, which it is now expanding to other EU organizations.

Analysis

This is more important as a budget-shift signal than as a company-specific growth update. NIS2 turns cybersecurity from episodic project spend into recurring compliance spend, which should favor providers that can package monitoring, incident response, and governance into multi-year retainers. The second-order winner is the labor-light end of the value chain only if it can attach to those retainers; otherwise the larger margin capture likely sits with managed-service and consulting platforms that can absorb the operational burden.

Near term, the market may overreact by assuming every cyber vendor benefits equally. In practice, the incremental euro is more likely to flow to firms with EU delivery capacity and sticky service contracts than to pure-play point solutions, while smaller local shops could get squeezed on pricing as procurement standardizes. Over 6-18 months, the real upside comes if NIS2 enforcement creates audit remediation cycles that force renewals and expand seat counts; if it becomes a box-checking exercise, revenue grows but margins do not.

The contrarian risk is that consensus is already treating European cyber as a structural winner while underappreciating substitution into internal teams and big integrators. The key falsifier is delayed enforcement or evidence that clients are buying one-off assessments rather than recurring SOC/CISO coverage. For public-market proxies, this argues for selective exposure to consulting/IT services with security mix rather than chasing the highest-multiple software names solely on the back of regulation headlines.

Key Decisions for Investors

• No immediate standalone trade: treat this as a confirming data point, not a catalyst. Wait for evidence in upcoming earnings that EU recurring-security bookings are accelerating before adding risk.
• Relative-value idea: long ACN / short IGV over 6-12 months. Thesis: regulatory compliance spend migrates toward implementation, managed services, and governance work faster than seat-based software multiples can expand. Target 10-15% spread if the theme is validated; falsify if software billings re-accelerate faster than services revenue.
• On pullbacks, favor PANW or CRWD only if management commentary shows EU billings or subscription growth inflecting. Use 3-6 month call spreads instead of outright longs to cap multiple-compression risk; avoid chasing if the move is already in the stock.
• Set an alert for NIS2 enforcement milestones and any EU cybersecurity procurement/renewal data. If enforcement slips or renewal rates weaken, de-rate the theme and cut any exposure to cyber baskets like CIBR/HACK.