The European Commission has put forward the EU Cyber Solidarity Act, a roughly €1 billion programme aimed at hardening the bloc's collective cyber response. The proposal includes a pan-European Cyber Shield built on interconnected Security Operations Centers (SOCs) and an emergency mechanism for large-scale incidents.
Check Point VP of Sales Engineering EMEA Peter Sandkuijl argues that the law's success will hinge on staffing, standards, and a willingness to share intelligence across borders.
The short version
- The EU Cyber Solidarity Act proposes a €1 billion programme.
- It includes a "European Cyber Shield" of interconnected SOCs across member states.
- It proposes an emergency mechanism for large-scale cyber incidents.
- Sandkuijl advocates for baseline security requirements with third-party verification for critical infrastructure.
- Staffing and cross-border intelligence sharing are flagged as the hardest obstacles.
Background: why the EU is leaning into collective cyber defence
The war in Ukraine exposed how dependent EU member states are on each other for basic services like energy, and how quickly those dependencies become security risks. Cyberattacks on critical infrastructure have moved from hypothetical to operational, and member states have been left coordinating case by case. The Cyber Solidarity Act is the Commission's attempt to put structure around that coordination before the next major incident forces another ad-hoc scramble.
Sandkuijl's framing is direct: cybersecurity is no longer an IT concern, it is a societal one. Treating it as a national silo leaves the bloc exposed.
Our analysis: the proposal is necessary, the execution will be brutal
The proposal solves a real problem. Cross-border incidents—think compromised energy infrastructure spanning three member states—need a shared detection layer and a tested response mechanism. The Cyber Shield concept addresses detection; the emergency mechanism addresses response. That much tracks.
The operational reality is less comfortable. Sandkuijl flags the staffing gap bluntly. Governments cannot outbid the private sector for senior SOC analysts, and the talent market is already overheating. Mandating a SOC in every member state does not produce the analysts to staff it. The EU will need to grow talent rather than poach it, which means sustained investment in training pipelines, not just procurement budgets.
Intelligence sharing presents a different problem. National incidents quickly become national security matters, and member states are protective by instinct. Sandkuijl points to the Magen model—a structured approach where shared processes are codified and alerts move through documented channels—as a workable starting framework. But the real friction will be cultural, not technical. Member states have sound reasons for secrecy; the Act must give them reasons to share anyway.
The trade-off is predictable: the more prescriptive the mandate, the more member states will resist on sovereignty grounds. The softer the mandate, the less the Cyber Shield actually shields.
Who should care
Critical infrastructure operators** (energy, utilities, transport): Uniform security baselines with formal verification are coming. Map assets against likely baseline requirements now, invest in clean detection data, and build relationships with national CSIRTs before you need them.
Managed security providers and MSSPs**: The proposed reserve creates openings for organizations positioned as translation layers between information sources and end defenders. Participation may yield policy-inclusion benefits and reference-customer status.
EU member state governments**: The hardest part is not technical architecture—it is convincing domestic agencies that shared telemetry serves national interests. Watch how the Parliament and Council balance mandates against opt-out provisions.
The security talent market**: If the reserve model requires altruistic or reduced-rate participation, it will compete with, rather than complement, private-sector demand for senior analysts. Watch for funding mechanisms that create sustainable participation models rather than one-time contributions.
What to watch next
Watch the legislative path. The proposal will be debated in the European Parliament and Council, and the final shape of the Cyber Shield, the emergency mechanism, and the funding split will shift with national interests. Member states will push back on any mandate that exposes national-security-sensitive data. Expect a longer negotiation and a softer final text than the current draft.
Key takeaways
- The proposal addresses a genuine coordination gap; the intent is sound.
- Execution bottlenecks are staffing and the cultural resistance to intelligence sharing.
- Critical infrastructure operators should begin baseline preparation now.
- The final Act will likely be weaker than the draft—watch for what gets cut.
Frequently asked questions
What does the EU Cyber Solidarity Act propose?
It proposes a €1 billion programme to build a pan-European Cyber Shield of interconnected SOCs and an emergency mechanism for large-scale cyber incidents.
Who is Peter Sandkuijl?
He is VP of Sales Engineering EMEA at Check Point, with over 25 years in the security market, including roles as Technical Director and SE Manager Northern Europe at Check Point's Benelux office.
What is the biggest operational challenge?
Staffing. Sandkuijl notes that the talent market is overheated and governments struggle to compete with the private sector for senior analysts. The continuous nature of SOC work means talent acquisition and retention will remain difficult.
How realistic is the intelligence-sharing component?
Sandkuijl describes intelligence sharing as difficult due to the sensitivity of national security matters. He suggests the Magen model—codified processes and documented alert channels—as a starting framework, but acknowledges the cultural barriers will be harder to solve than the technical ones.
What should critical infrastructure operators do now?
Sandkuijl pushes for uniform security baselines with formal verification. Operators should map assets against likely baseline requirements, identify gaps in logging and incident reporting, and invest in detection engineering before the mandate arrives.
Source: cybertalk.org