Cybersecurity in European software development: a 2025 outlook through the lens of the CONSOLE project.

by the CONSOLE consortium | 30/06/2025

As European software development companies contend with a rapidly evolving cybersecurity threat landscape in 2025, a new layer of urgency has emerged, one that is both regulatory and operational. From daily vulnerability disclosures to sweeping EU legislative mandates, the software sector now stands at the convergence of opportunity and risk. Within this context, the CONSOLE project, funded under the Digital Europe Programme, offers a critical response: a cost-effective, integrated, and regulation-ready cybersecurity platform explicitly tailored to the needs of European SMEs and development teams.

Subscribe to the CONSOLE Newsletter!

A crisis of vulnerability and regulation.

The data is sobering. By June 2025, over 21,500 new software vulnerabilities had been disclosed, an average of 133 per day. Software development is the most affected industry, accounting for 22.4% of all vulnerabilities. Meanwhile, EU cybersecurity regulations such as the Cyber Resilience Act (CRA), NIS2 Directive, and DORA have introduced strict new compliance frameworks with enforcement already underway or imminent.

The CRA alone mandates the integration of Software Bill of Materials (SBOM), secure-by-design principles, and 24-hour breach notification by December 2027. Yet for the majority of small and mid-sized software companies, the cost and complexity of compliance remain prohibitive.

How the CONSOLE platform responds.

CONSOLE effectively tackles the dual challenges of vulnerability overload and regulatory pressure by providing an integrated, modular platform that incorporates security throughout the Software Development Lifecycle (SDLC). With features such as automated vulnerability scanning, Software Bill of Materials (SBOM) generation, and compliance-ready reporting aligned with CRA and NIS2, CONSOLE enables development teams to embrace “shift-left” security while maintaining their agility.

Key innovations already delivered by the project include:

An AI-powered code analysis module integrating over 17 static and dynamic tools across Dockerised containers.
A training platform that assigns security courses based on the developer’s tech stack.
A visualisation dashboard for forensic analytics and threat traceability.
Seamless GitHub-based version control automation that ensures developers don’t need to upload code for validation manually.

All of this is offered within a cloud-native, GDPR-aligned infrastructure, with flexible deployment options for cloud and on-premises environments.

Addressing SME-specific needs.

CONSOLE’s value proposition is powerful for SMEs, entities that comprise 99% of EU businesses, yet consistently underinvest in cybersecurity due to high tool costs and skills shortages. According to the project’s extensive stakeholder survey, over 80% of SMEs cited the lack of best practices and automation as their most significant cybersecurity pain point. Less than half currently use specialised tools, and virtually none offer in-house training.

CONSOLE remedies this by:

Embedding developer-centric training modules directly into the platform.
Offering CRA/NIS2 alignment features to replace expensive consultancy-based approaches.
Delivering a unified toolchain that consolidates vulnerability scanning, compliance tracking, and threat analysis.

Aligning with market trends and policy.

The 2025 cybersecurity market is undergoing profound shifts. The European DevSecOps segment alone is projected to reach €5.3 billion by 2030, growing at 13.9% CAGR. The broader cybersecurity market in Europe is forecast to reach up to €70 billion by the end of the year. Yet regulatory deadlines are accelerating faster than market adoption. NIS2 is already in effect; DORA became mandatory in January 2025.

Here, CONSOLE provides timely value, not just as a technological solution but as a policy-aligned enabler of SME readiness. Its focus on SBOM generation, third-party risk visibility, and real-time alerting directly maps to regulatory imperatives, positioning the platform as an early compliance accelerator.