Orange Cyberdefense: From MSS to AI-Driven Resilience

Orange Cyberdefense is moving beyond traditional managed security services.

At its October 22, 2026, Analyst Day in Lyon, the company outlined its strategy for AI-driven security operations, cyber resilience, and European expansion. PAC examines these strategic changes, their implications for customers, and the growing competitive pressure on cybersecurity service providers.

Under the theme “Frontier Shifts,” the company discussed how artificial intelligence, evolving cyber threats, geopolitical uncertainty, and tightening regulatory requirements are reshaping the cybersecurity services landscape.

Our main takeaway is that Orange Cyberdefense aims to move beyond the traditional role of a managed security service provider (MSSP). The ambition is to become a more integrated security partner by combining threat intelligence, AI-driven operations, consulting, and the broader Orange Group’s capabilities.

This is a logical direction, but also a challenging one. The cybersecurity market is increasingly competitive, and customers expect more measurable results from their security investments.

1. Main Changes: How Orange Cyberdefense Is Evolving

From traditional SOC services to AI-driven security operations

One of the clearest changes is the evolution of the Security Operations Center (SOC). Orange Cyberdefense is moving toward a more automated operating model, with AI agents supporting threat detection, investigation, and response.

Orange Cyberdefense reports a sixfold reduction in response time when using Qevlar AI in SOC operations. This is encouraging, though the extent to which these gains can be replicated across different customer environments, technologies, and incident types remains to be seen.

The longer-term ambition goes beyond automation. Orange Cyberdefense aims to transition from industrialized SOC operations to agentic detection and, ultimately, what the company calls Collective Immunity. The idea is to combine security telemetry, threat intelligence, and operational experience across its customer base to improve protection for everyone.

With Entry+, Orange Cyberdefense is also translating its Collective Intelligence strategy into a commercial offering. Built on the MSS Engine platform and supported by the company’s Collective Defense Engine, Entry+ enables customers to benefit from shared threat intelligence while contributing to collective protection. The offering extends this approach to customers using security services such as secure service edge, email protection, web application firewalls, and next-generation firewalls. This marks an important step from a largely SOC-centric approach toward a broader model of collective, intelligence-driven protection.

This collective intelligence approach could become a meaningful competitive advantage. However, the number of customers or the volume of telemetry alone does not guarantee better detection. The ability to correlate information, maintain data quality, protect customer confidentiality, and translate intelligence into effective action will determine its value.

This development reflects a broader market shift examined in PAC’s AI Security, Secure AI Lifecycle, and Security Automation – Market View, which explores the evolution toward agentic security operations and the growing importance of governance and human oversight.

A broader portfolio focused on cyber resilience

Orange Cyberdefense seeks to integrate its existing managed security, advisory, and risk management capabilities more tightly.

Its evolving Catalyst service model aims to unify exposure intelligence, posture management, and threat detection and response across a continuous operating cycle. Continuous Threat Exposure Management (CTEM) links technical findings to business risk and to remediation priorities.

This reflects an important market development: customers increasingly need help prioritizing security issues rather than simply receiving more alerts and vulnerability reports.

The same applies to professional services. Orange Cyberdefense is emphasizing its ability to integrate consulting, implementation, and ongoing operations. This could help customers address a common problem: security strategies that look convincing on paper but are difficult to execute given limited internal resources.

Nevertheless, integrating these activities into a consistent customer experience will be challenging. Combining existing services under a common framework is only the first step. The real test will be whether customers perceive measurable improvements in security and resilience.

Expansion through Orange’s telecommunications footprint

Geographic expansion and closer cooperation with Orange Business are also key elements of the strategy.

Orange Cyberdefense reported 15% growth in order intake in the first half of 2026 as it pursues its ambition to reach €2 billion in revenue by 2030.

The expansion into Spain reflects the company’s intention to leverage the Orange Group’s existing telecommunications relationships and distribution channels to reach new customers.

Closer integration with Orange Business also creates opportunities to combine connectivity, cloud, SASE, and managed security services into a more cohesive offering. The potential is reflected in the reported 35% year-over-year growth in security order intake for Orange Business-related activities in H1 2026. This figure covers a different reporting scope than the 15% growth reported for Orange Cyberdefense and should not be considered directly comparable.

This positioning makes sense, especially for multinational organizations seeking to simplify their supplier landscape. While existing telecommunications relationships can facilitate market access, cybersecurity contracts still hinge on demonstrated expertise, service quality, and appropriate local delivery capabilities.

Digital sovereignty is another element of this positioning. Orange Cyberdefense can combine security services with European infrastructure and sovereign cloud capabilities. However, customers will need to examine which elements of a service are actually operated under sovereign control, especially when global technology partners are involved.

Greater attention to AI security and operational technology

Two additional areas merit attention.

First, Orange Cyberdefense is broadening its approach to AI security to include AI governance, model and application testing, shadow AI discovery, and runtime protection. The company sees an opportunity to serve as a trusted third party for AI technology providers and enterprise customers.

Second, the company continues to develop its operational technology (OT) security capabilities, focusing on visibility, detection, and operational maturity. The Lyon location, with its dedicated OT demonstration environment, provided a useful illustration of how industrial security differs from conventional IT protection.

Identifying vulnerabilities in industrial environments can be challenging, especially when legacy systems, proprietary protocols, and operational constraints limit conventional security assessments. Prioritizing and remediating vulnerabilities without disrupting production adds another layer of complexity.

Both AI and OT security offer growth opportunities, but they require specialized expertise that automation alone cannot deliver.

2. What It Means for Customers

Security services should deliver measurable business results

The direction presented in Lyon broadly aligns with evolving customer expectations.

Organizations increasingly expect security providers to demonstrate improvements in resilience, reduced exposure, incident response, and operational efficiency.

For customers, this means that service evaluation should move beyond traditional metrics, such as the number of alerts processed or the number of tickets closed.

More relevant questions include:

• Whether critical exposures are being reduced
• Whether incidents can be contained more quickly
• Whether security operations support business continuity

Orange Cyberdefense’s focus on outcomes is welcome. The challenge will be translating this ambition into transparent, contractually meaningful service commitments. The planned introduction of protection-level agreements could be a promising step, provided the underlying metrics are understandable, verifiable, and relevant to the customer’s business.

AI creates opportunities but also new dependencies

AI-assisted security operations could help organizations address skills shortages, reduce repetitive work, and respond more quickly to threats.

At the same time, customers should distinguish between automation that is already operational and more advanced agentic capabilities still under development.

The following will be key selection criteria:

• The degree of human oversight
• The reliability of AI-generated decisions
• Accountability when things go wrong

Customers should also examine how their information is used in shared threat intelligence environments and whether the provider can explain the decisions made by automated systems.

AI security will increasingly be a distinct investment priority as organizations deploy more generative AI applications and autonomous agents.

Integrated services can simplify operations, but flexibility matters

Combining network, cloud, and security capabilities under a single provider can reduce coordination effort and improve visibility across complex environments.

Orange Cyberdefense, together with Orange Business, is well positioned to meet this demand.

However, customers should avoid assuming that integration is always preferable to a multi-provider approach.

Interoperability, technology selection, data portability, and clear responsibilities remain important, especially for organizations with established security architectures and multiple cloud environments.

The strongest proposition will therefore be one that offers integration without unnecessary lock-in.

The same considerations apply to digital sovereignty. European delivery capabilities and sovereign infrastructure can meet regulatory and operational requirements, but customers still need clarity on data processing, technology dependencies, operational control, and jurisdiction.

3. What It Means for Other Service Providers

Traditional MSSPs face mounting pressure to differentiate

The developments presented in Lyon reflect broader shifts in the managed security services market.

Basic monitoring, alert handling, and standardized response activities are increasingly automated, though automation maturity varies widely across providers and processes. As a result, traditional SOC capabilities alone will be less effective as differentiators.

Providers will need to demonstrate how their services improve customer security outcomes rather than competing primarily on operational capacity or staffing levels.

AI will support this transition, but simply adding AI capabilities to existing services will not suffice.

The real differentiation will come from the combination of automation, expertise, contextual intelligence, and effective response processes.

Threat intelligence and operational scale are becoming more important

Orange Cyberdefense’s collective intelligence strategy illustrates another potential shift in market competition.

Large providers can benefit from information collected across multiple customers, technologies, industries, and geographic markets. If properly managed, this information can improve threat detection and accelerate the development of new protective measures.

Smaller and regional MSSPs may find it difficult to independently replicate this breadth.

However, scale is not everything. Specialized expertise, industry knowledge, customer proximity, and responsiveness remain significant competitive advantages, especially in regulated industries and OT environments.

For smaller providers, partnerships and selective specialization may be more attractive than trying to replicate the full capabilities of larger competitors.

Competition increasingly crosses traditional market boundaries

Orange Cyberdefense’s closer cooperation with Orange Business also illustrates how the lines among telecommunications, infrastructure, cloud, and cybersecurity services are blurring.

This intensifies competition among traditional IT service providers, systems integrators, and cybersecurity specialists.

Providers with robust infrastructure and cloud capabilities will increasingly seek to integrate security services into their existing customer relationships. Conversely, security specialists will increasingly focus on consulting, risk management, and operational resilience.

The competitive question is shifting from who can operate a SOC to who can coordinate security across the customer’s entire technology environment.

For European providers, digital sovereignty also offers opportunities for differentiation. However, sovereign delivery claims will need to be backed by concrete operational and contractual capabilities, not by geographical positioning alone.

That does not mean every provider needs to offer everything. In fact, focused specialists may benefit if broad-portfolio providers struggle to maintain consistent service quality across disciplines.

Final Perspective

The Orange Cyberdefense Analyst Day 2026 showcased a company with a clear direction.

• Deeper use of AI
• More integrated security operations
• Greater emphasis on business outcomes
• Closer cooperation across the Orange Group

The combination of cybersecurity expertise, international operations, telecommunications infrastructure, and an established customer base provides a solid foundation for this strategy. This strategy’s emphasis on collective intelligence, integrated service delivery, and digital sovereignty is especially relevant to the European market.

Expansion is another important element of the strategy, with two complementary directions. Geographically, Orange Cyberdefense is taking a measured approach to entering markets where the Orange Group already has an established presence. Spain exemplifies this model, combining local cybersecurity expertise and SOC capabilities with Orange Spain’s customer relationships and distribution channels.

At the same time, Orange Cyberdefense is expanding its reach into the SMB and consumer markets through more standardized, highly automated security offerings. These include Dynamic SOC, formerly Micro-SOC, for smaller businesses, and integrated cybersecurity services for consumers and small offices. By combining centralized platforms and automation with local Orange distribution channels, the company aims to enter new market segments and geographies without replicating its entire service infrastructure in each country. This could provide a scalable expansion model, though its success will depend on local market requirements, customer adoption, and the economics of service delivery.

Final Assessment: Orange Cyberdefense’s Strategy for AI-Driven Cyber Resilience

Orange Cyberdefense’s strategy combines AI-driven security operations, integrated services, and expansion, leveraging the Orange Group’s established market presence. While these ambitions build on credible strengths, similar priorities are emerging across the cybersecurity services market. Success will depend on translating scale, automation, and portfolio breadth into measurable customer value and sustainable growth.