ESET Puts Its Money Where the Models Are: A $40 Million Bet on AI Sovereignty

At ESET World 2026 in Berlin, the message from the stage was clear: the era of AI as a mere defensive add-on is over. ESET CEO Richard Marko pulled back the curtain on a €40 million (roughly $43 million) investment designed to overhaul the company’s R&D efforts. This isn’t just a bigger budget for existing tools; it’s a strategic pivot toward "cybersecurity-first" foundational models and a next-generation AI Security Operations Center (SOC). As reported by , the move comes as ESET researchers identify a staggering 13-fold increase in malicious "AI Skills"—the modular components that drive autonomous AI agents—since the beginning of the year.

The investment reflects a growing anxiety within the industry about the "Big Tech" monopoly over advanced AI. Marko pointed out that the future of digital defense shouldn't depend on models controlled by a handful of global giants, framing the investment as a win for European cybersecurity sovereignty. By building its own foundational models trained on 35 years of proprietary threat telemetry, ESET is looking to bypass the generic biases of general-purpose AI. This three-year roadmap includes a massive hiring spree, aiming to push their R&D headcount to 1,000 engineers, ensuring they have the human muscle to keep pace with increasingly automated adversaries as noted by TechWire Asia.

The Agentic Frontier: Why $40 Million Matters Now

What Most Reports Miss: While many headlines focus on the dollar amount, the real story lies in the specific focus on "agentic AI" and the supply chain of AI skills. ESET isn't just watching for traditional malware anymore; they are now scanning the very instructions that tell AI agents how to interact with external systems. Since March 2026 alone, the company has analyzed nearly 800,000 unique AI skills, flagging 25,000 as suspicious. This highlights a shift where the "attack surface" has moved from the software itself to the autonomous interactions between AI systems. As CRN Asia highlights, Marko’s vision involves creating a "Secure AI Relay"—a buffer zone designed to sit between users, their AI assistants, and the business applications they control.

This deep-dive into AI sovereignty also addresses the "black box" problem of modern security. By developing a layered AI stack, ESET intends to make world-class protection accessible to mid-sized firms that can't afford a fleet of elite human analysts. The goal is to move beyond the "alert fatigue" that currently plagues security teams. Instead of flooding dashboards with more data, the new AI SOC is designed to correlate and understand telemetry in a way that feels effortless to the end-user. It’s a calculated attempt to democratize high-end security by letting the AI do the heavy lifting of contextual analysis.

Historically, ESET has leaned on its "Made in Europe" credentials to distinguish itself from Silicon Valley competitors. This latest investment doubles down on that heritage. In an environment where data privacy and digital independence are becoming top-tier corporate priorities, ESET is positioning its independent AI as a safer, more transparent alternative to the sprawling ecosystems of Microsoft or Google. This isn't just about catching viruses; it’s about ensuring that the tools used to protect an organization don't become its greatest liability by leaking sensitive prompts or credentials to a third-party cloud.

The roadmap also includes the expansion of ESET Private, a portfolio specifically for government and high-stakes defense sectors. By weaving their new foundational models into this architecture, they are essentially building a private, secure brain for sensitive networks. As the industry watches this $40 million rollout over the next three years, the success of the initiative will likely be measured by how well these models handle "World Models"—AI that can actually understand the intent and context behind a digital interaction rather than just matching patterns. It’s an ambitious leap that seeks to turn the tide against autonomous threats before they become the new normal.

At ESET World 2026 in Berlin, the message from the stage was clear: the era of AI as a mere defensive add-on is over. ESET CEO Richard Marko pulled back the curtain on a €40 million (roughly $43 million) investment designed to overhaul the company’s R&D efforts. This isn’t just a bigger budget for existing tools; it’s a strategic pivot toward "cybersecurity-first" foundational models and a next-generation AI Security Operations Center (SOC). As reported by GlobeNewswire, the move comes as ESET researchers identify a staggering 13-fold increase in malicious "AI Skills"—the modular components that drive autonomous AI agents—since the beginning of the year.

The investment reflects a growing anxiety within the industry about the "Big Tech" monopoly over advanced AI. Marko pointed out that the future of digital defense shouldn't depend on models controlled by a handful of global giants, framing the investment as a win for European cybersecurity sovereignty. By building its own foundational models trained on 35 years of proprietary threat telemetry, ESET is looking to bypass the generic biases of general-purpose AI. This three-year roadmap includes a massive hiring spree, aiming to push their R&D headcount to 1,000 engineers, ensuring they have the human muscle to keep pace with increasingly automated adversaries as noted by TechWire Asia.

The Agentic Frontier: Why $40 Million Matters Now

What Most Reports Miss: While many headlines focus on the dollar amount, the real story lies in the specific focus on "agentic AI" and the supply chain of AI skills. ESET isn't just watching for traditional malware anymore; they are now scanning the very instructions that tell AI agents how to interact with external systems. Since March 2026 alone, the company has analyzed nearly 800,000 unique AI skills, flagging 25,000 as suspicious. This highlights a shift where the "attack surface" has moved from the software itself to the autonomous interactions between AI systems. As CRN Asia highlights, Marko’s vision involves creating a "Secure AI Relay"—a buffer zone designed to sit between users, their AI assistants, and the business applications they control.

This deep-dive into AI sovereignty also addresses the "black box" problem of modern security. By developing a layered AI stack, ESET intends to make world-class protection accessible to mid-sized firms that can't afford a fleet of elite human analysts. The goal is to move beyond the "alert fatigue" that currently plagues security teams. Instead of flooding dashboards with more data, the new AI SOC is designed to correlate and understand telemetry in a way that feels effortless to the end-user. It’s a calculated attempt to democratize high-end security by letting the AI do the heavy lifting of contextual analysis.

Historically, ESET has leaned on its "Made in Europe" credentials to distinguish itself from Silicon Valley competitors. This latest investment doubles down on that heritage. In an environment where data privacy and digital independence are becoming top-tier corporate priorities, ESET is positioning its independent AI as a safer, more transparent alternative to the sprawling ecosystems of Microsoft or Google. This isn't just about catching viruses; it’s about ensuring that the tools used to protect an organization don't become its greatest liability by leaking sensitive prompts or credentials to a third-party cloud.

The Sovereign Dilemma: Ambition vs. Scale

Reading Between the Lines: ESET’s move toward "AI sovereignty" is a masterclass in regional branding, but it carries a distinct scent of defensive posturing against the gravitational pull of hyperscalers. While $40 million sounds like a king's ransom in a press release, it is essentially pocket change compared to the multi-billion-dollar R&D cycles of OpenAI or Anthropic. The contradiction ESET must resolve is how a specialized "sovereign" model can stay competitive when the underlying compute power required to train such models remains largely in the hands of the very American giants they are trying to circumvent. There is a real risk that "European AI" becomes a boutique label that struggles to match the raw predictive power of general-purpose models trained on infinitely larger datasets.

Furthermore, the pivot to securing "AI Skills" reveals an industry-wide panic about a threat landscape that is evolving faster than our vocabulary for it. ESET is betting that the future of cybercrime is modular and agent-based, which is a sound hypothesis, but it also creates a new form of vendor lock-in. By positioning themselves as the "Secure AI Relay," ESET isn't just selling software; they are trying to become the mandatory toll booth through which all AI traffic must pass. For enterprises, this means trusting one black box to monitor another, adding layers of complexity to an already fragile digital supply chain that might break under the weight of its own security protocols.

The hiring spree to reach 1,000 engineers also highlights a quiet desperation in the talent market. Throwing money at "foundational models" is the easy part; finding a thousand specialists who aren't already being recruited by Big Tech with seven-figure stock options is the real hurdle. If ESET fails to secure this top-tier talent, the "sovereign AI" initiative risks becoming a rebranding of existing machine learning heuristics rather than the revolutionary leap promised in Berlin. Success depends entirely on whether ESET can prove that specialized, "small" models can actually outsmart the giants through precision rather than brute force.

Cybersecurity is the only industry where we spend $40 million to build a digital brain just to stop a $10 script from ruining our Tuesday, proving once and for all that while the AI might be getting smarter, the criminals are still much better at staying under budget.

Artūras Malašauskas is an AI Systems Integrator with 20+ years of production-grade web engineering experience. He has designed, shipped, and scaled enterprise Python/PHP systems for logistics, SaaS, and public-sector clients. For the past year, he has focused exclusively on AI integrations: deploying open-source LLMs, building generative media pipelines (image, audio, video), and engineering multi-agent workflows for real production environments. His standard: reproducibility, security, cost-efficient inference—no vaporware. He documents and evaluates emerging AI tooling, separating verified capabilities from marketing noise. Technical editor at: muza-ai.eu, ai-verslas.lt, ai-naujinos.lt Connect on LinkedIn