That government contract a founder landed three years ago might have felt like validation. The cybersecurity firm was credible enough to serve defence agencies and critical infrastructure, revenue was predictable, margins were healthy, and investors loved the recurring nature of public sector work.
Now the founder is planning an exit, and the same customer list that boosted the valuation is throttling buyer options. This is increasingly how cybersecurity exits in Europe begin, in a market where foreign direct investment screening turns the customer roster into a regulatory obstacle course.
Why government revenue triggers regulatory scrutiny
EU member states processed over 3,100 foreign investment filings in 2024, a 75 per cent jump from 2023, although around 86 per cent of in-scope cases were cleared unconditionally. Outside the EU, the UK received 1,324 notifications under the National Security and Investment Act in the 2025-26 period, a 15 per cent increase year on year, with defence being the area of the economy most often involved in both notifications and call-ins. Meanwhile, cybersecurity M&A hit record levels with $96 billion deployed across 400 transactions in 2025, and deals involving government customers can face timelines of nine to twelve months or more where several screening regimes apply.
Three types of customer relationship now create regulatory complexity. First, contracts with defence ministries or military agencies are among the strongest indicators that a mandatory filing will apply, since most European regimes treat defence suppliers as their most sensitive category. Second, serving entities covered by the NIS2 Directive, which expanded cybersecurity obligations to an estimated 160,000 organisations across 18 critical sectors, creates indirect exposure. Third, even commercial cybersecurity providers that process sensitive government data face scrutiny based on data access alone.
The regulatory perimeter keeps widening. The EU has adopted a revised Screening Regulation, Regulation (EU) 2026/1386, which will require every member state to operate a screening regime meeting common minimum standards from January 2028. Germany currently requires a filing once a non-EU investor reaches a 10 per cent stake in companies active in defence, certain IT security products or critical infrastructure, with a 20 per cent threshold for other sensitive sectors, and a draft Investment Screening Act published in October 2026 would keep the 10 per cent threshold while raising the 20 per cent threshold to 25 per cent. The UK’s NSI Act operates with no deal-value floor whatsoever. France’s review process stretches to around 75 business days across two phases. The Netherlands requires notification for acquisitions of companies active in sensitive technologies, including high-assurance cybersecurity products, and of vital infrastructure providers themselves.
European FDI thresholds for tech and cyber
| Jurisdiction | Ownership threshold | Review timeline |
| United Kingdom | More than 25, 50 or 75 per cent of shares or votes, or material influence; no deal-value floor; mandatory in 17 sectors | 30 working days initial review; called-in deals a further 30 working days, extendable by 45 |
| Germany | 10 per cent for defence, IT security and critical infrastructure; 20 per cent for other sensitive sectors (25 per cent under the October 2026 draft law) | Two-month initial phase; four-month main review, extendable |
| France | 25 per cent (10 per cent for listed entities) | Up to 75 business days across two phases |
How FDI screening shrinks the buyer pool
When regulators pay attention to who’s buying a business, three commercial problems emerge. First, the choice of buyers can narrow: foreign strategic acquirers from geopolitically sensitive jurisdictions face heightened risk of prohibition or onerous conditions. Private equity funds backed by foreign limited partners run into similar challenges, as regulators scrutinise not just the fund but the nationality of underlying investors.
Second, valuations may drop. Fewer credible bidders usually means less pricing tension, and when the number drops from, say, eight potential acquirers to three, the remaining buyers likely adjust their bids accordingly.
Third, integration gets harder: even when clearance is granted, it often comes with conditions that restrict operations. Structural remedies may require ring-fencing certain business units, maintaining separate legal entities, or divesting specific assets. Behavioural remedies commonly include government-nominated directors, restrictions on personnel transfers, limitations on technology integration, and prohibitions on moving sensitive data or intellectual property outside the jurisdiction. These conditions make it difficult to realise synergies and can impair future exit options for financial buyers.
The change-of-control problem
Beyond FDI clearance, government contracts typically contain change-of-control provisions that allow the contracting authority to approve, renegotiate or terminate the contract when ownership of the supplier changes, and where a sale is structured as an asset deal, each contract must be formally novated to the buyer. Both routes add timeline risk and substantive uncertainty, because an agency with concerns about the acquirer’s capabilities, financial stability or foreign ties can withhold its consent, and even where it agrees it may impose new conditions, narrow the scope or accelerate its termination rights.
This risk becomes significant when government revenue represents a substantial portion of EBITDA. If key customers withhold consent or terminate, the acquirer buys a business with a materially reduced revenue base. Sellers who fail to address change-of-control risk during due diligence and negotiation of the sale and purchase agreement (SPA) may find themselves unable to achieve earn-out payments or facing indemnity claims post-closing.
Building regulatory screening into the process
Integrating regulatory mapping into initial buyer selection is critical. Begin with a granular assessment of your customer base and map which FDI regimes apply, then construct a buyer typology matrix ranking potential acquirers by regulatory risk.
High-risk acquirers may be excluded entirely if clearance appears unlikely, or engaged later once low- and medium-risk buyers have established a valuation floor. When buyers advance to the indicative offer stage, consider early informal engagement with relevant FDI authorities where permissible to gauge likely concerns and identify potential conditions before committing to binding terms.
Negotiating SPAs that allocate FDI risk properly
The SPA should allocate this risk explicitly, through four mechanisms in particular:
- Jurisdiction-specific conditions precedent: Each required clearance should be listed as a separate condition to closing, with its own filing deadline and a clear statement of which party prepares and submits it.
- Calibrated long-stop dates: Set the long-stop date to reflect the slowest likely review, which for deals requiring several FDI clearances often means nine to twelve months, with an extension mechanism if a regulator opens an in-depth review.
- Reverse break fees: Negotiate a fee payable by the buyer if clearance is refused or the long-stop date passes without it, which compensates the seller for a failed process and gives the buyer a reason to pursue clearance in earnest.
- Regulatory efforts covenant: Agree in advance which remedies the buyer must accept to obtain clearance, such as ring-fencing, government-nominated directors or data localisation, because this clause, more than any other, decides who bears the cost of the conditions described earlier.
Planning a cyber exit around regulatory constraints
The regulatory environment surrounding cybersecurity M&A in Europe has shifted from temporary friction to structural reality. Government and regulated revenue, once a source of competitive advantage and valuation premium, now introduces execution risk and buyer constraints that sellers must manage proactively.
For the founder with the defence contract, this changes the shape of the process rather than its outcome. The buyer list is built around who can realistically be cleared, the timetable assumes the reviews that will apply, and the SPA settles in advance who carries the cost of any conditions, so the government revenue that once looked like a constraint can still be sold at a strong price.
For cybersecurity companies with significant exposure to government contracts or critical infrastructure customers, engaging with FDI risk has to be part of strategic planning and exit preparation. That means early asset characterisation, buyer risk mapping and SPA negotiation that protects value whilst accommodating regulatory realities.
Specialist M&A advisers who understand both the commercial and regulatory dimensions of these transactions bring regulatory mapping expertise alongside valuation skills and buyer relationships, and early engagement, particularly when dealing with complex buyer scenarios, can position founders for a strong exit rather than a protracted process that ends in prohibition or value-destroying conditions. Contact us today for an initial consultation.
