Three cyber security grants, 257.5 million euros: what European SMBs need to know
If you run a small or medium business in Italy or elsewhere in the EU, the cost of security has probably been the reason you postponed a project at least once. Three new funding programmes now put 257.5 million euros on the table, and a meaningful share of it is aimed squarely at companies your size. These cyber security grants for SMEs cover everything from the purchase of a firewall and managed cloud services, through Cyber Resilience Act compliance work, up to large consortium projects on AI, NIS2 and critical infrastructure protection.
The important detail is not the headline figure. It is that the three programmes sit at different levels: one is close to a simple voucher you can use for equipment and services, one targets manufacturers of connected products facing new EU product rules, and one funds multi-country research and deployment projects. Knowing which door to knock on saves months.
Why public money is flowing toward smaller companies
The reasoning behind this wave of funding is not generosity. It is supply chain arithmetic. European regulators have worked out that a large manufacturer with a mature security programme can still be breached through a 15-person supplier with an unpatched VPN appliance, and that the cheapest way to reduce systemic risk is to raise the floor across the whole base of smaller firms.
The numbers back this up. ENISA and national CERTs consistently report that small and medium organisations account for the majority of incidents handled each year, with ransomware and business email compromise leading the list. Italian CERT-AGID and ACN data over recent years have shown ransomware incidents affecting Italian organisations in the high hundreds annually, with SMBs heavily represented among the victims. Meanwhile, the average cost of a serious incident for a smaller company (downtime, recovery, lost orders, legal costs) regularly exceeds 100,000 euros, which is a figure many businesses in this bracket cannot absorb twice.
There is also a compliance driver. NIS2 is now in force across the Union, and its October deadlines have already passed in most member states. Many SMBs discovered they were in scope not because of their own size but because they supply someone who is. The grants are, in part, an attempt to stop that obligation from becoming an unfunded mandate.
Grant one: vouchers for firewalls, cloud services and basic hardening
The most immediately usable of the three programmes works like a classic voucher. It reimburses a percentage of eligible spend on security goods and services: next-generation firewalls, endpoint protection, secure cloud migration, managed detection and response, backup and disaster recovery platforms, vulnerability assessment and penetration testing, and staff awareness training.
For most businesses reading this, firewall purchase grants for businesses are the practical entry point. The perimeter device is often the oldest item in the rack, bought five or six years ago, still running because it technically still forwards packets. A modern firewall with current threat intelligence, TLS inspection and proper segmentation capability is a different product, and co-funding at 40 to 50 percent changes the conversation from “next year” to “this quarter”.
What tends to be eligible, and what does not
Eligibility rules vary by programme and region, but the pattern across Italian and EU schemes is consistent. Capital expenditure on security hardware and software is usually eligible, as are first-year subscription and licensing costs and the consulting work needed to design and deploy the solution. Training budgets are frequently eligible too, since human error remains the dominant initial access vector.
What is normally excluded: ongoing operational costs beyond the initial period, general-purpose IT equipment that happens to have security features, internal staff salaries, and anything purchased before the application was approved. That last point catches people out every year. If you buy the firewall in November and apply in December, the invoice is usually dead for grant purposes.
Getting your documentation in order first
Applications under these schemes are typically assessed on a first-come basis until funds are exhausted, or scored against a short technical rubric. Either way, speed and completeness win. Before the window opens, assemble three things: a current inventory of your IT estate, a short risk assessment identifying the gaps you intend to close, and formal quotations from your supplier that break down hardware, software, licensing and professional services as separate lines.
A documented risk assessment does double duty here. It strengthens the application and it is exactly what a NIS2 or ISO 27001 audit will ask for later. If you have never done one, this is the moment. Our team covers this groundwork as part of our cybersecurity services, and the output is reusable across every subsequent funding round.
Grant two: Cyber Resilience Act compliance support
The second programme addresses a problem that has crept up on a lot of European manufacturers. The Cyber Resilience Act applies to products with digital elements sold in the EU, and its main obligations bite from late 2027, with vulnerability and incident reporting duties arriving earlier, in September 2026. If your company makes anything with firmware, a network stack or a companion app, you are in scope.
The Cyber Resilience Act for SMEs is genuinely demanding. It requires secure-by-design development, a software bill of materials for every product, vulnerability handling processes with defined response times, security update provision across the support period, conformity assessment and CE marking that now covers cyber security properties. For a company of 30 engineers that has never run a formal product security programme, this is a structural change, not a checkbox.
Who is affected more than they realise
Mechanical and electromechanical manufacturers are the group most often caught off guard. An industrial pump with a Modbus interface and a remote monitoring module is a product with digital elements. So is a commercial espresso machine with a Wi-Fi configuration portal, or a lighting controller with a mobile app. Italy’s manufacturing base is full of exactly these companies, and many still treat firmware as a one-time engineering deliverable rather than something requiring maintenance for a decade.
The funding here covers gap analysis against CRA requirements, secure development lifecycle implementation, SBOM tooling, penetration testing of products rather than just corporate networks, and the documentation needed for conformity assessment. Spending grant money on this in 2026 is considerably cheaper than discovering in 2027 that your flagship product cannot legally be placed on the EU market.
Grant three: large collaborative projects on AI, NIS2 and critical infrastructure
The third strand is the biggest in budget terms and the least accessible individually. It funds consortium projects across multiple member states on AI-driven threat detection, NIS2 implementation tooling, security operations capacity, and protection of critical infrastructure in energy, water, transport and healthcare.
A 40-person SMB does not lead one of these. But it can participate, and that is where the real opportunity sits. Consortia need partners with specific technical capability, sector knowledge or pilot environments. A company with deep expertise in industrial protocols, or a hospital IT supplier willing to host a pilot deployment, becomes a valuable partner. Participation brings funded development work, European visibility and reference projects that are worth far more commercially than the grant itself.
A practical plan for the next ninety days
Spread across all three programmes, cybersecurity funding for businesses is only useful if you can move when the windows open. Here is the sequence that works.
First, run the inventory and risk assessment now, before any call is published. This is the gating item for every scheme and the one that takes longest.
Second, decide which programme fits. If you need to replace infrastructure and improve monitoring, the voucher scheme is your route. If you manufacture connected products, CRA support is more valuable and more urgent. If you have research-grade capability, start conversations with potential consortium partners.
Third, get technical quotations ready, properly itemised. Architecture matters here: choosing a platform because it was cheapest on the day, then finding that it does not integrate with your backup or identity systems, wastes the grant and your time. Technology choice should follow the risk assessment, not precede it. The platforms we work with daily, including Sophos, Fortinet and WatchGuard, each suit different estate sizes and management models, and the right answer depends on what you actually run.
Fourth, check regional layers. Italian regions frequently add their own co-funding on top of national schemes, and chambers of commerce run smaller digitalisation vouchers that can be combined if the expense categories do not overlap.
The underlying point
A cybersecurity voucher scheme 2026 will not make your business secure. It reduces the price of doing work you should be doing regardless, and it imposes a deadline, which for most organisations is the more useful of the two effects.
Treat the funding as an accelerator for a plan you already have, not as a reason to invent one. The companies that get the most out of these programmes are the ones that knew their three biggest security gaps before the call was announced, and simply had the paperwork ready when the money appeared.