Six months into 2026, China’s cybersecurity companies are moving in very different directions. While some are finding new growth and improving profitability, others remain under pressure, revealing a market that is becoming increasingly divided in both performance and strategy.

688561.SH | Revenue: RMB 1.497B | YoY: -14.09%

QAX reported revenue of RMB 1.497 billion in the first half of 2026, down 14.09% year on year. Net loss attributable to shareholders narrowed to RMB 411 million, representing a 46.58% year-on-year improvement from a loss of approximately RMB 769 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 755 million, narrowing by 1.94% year on year.

002268.SZ | Revenue: RMB 469M | YoY: -4.04%

CETC reported revenue of RMB 469 million in the first half of 2026, down 4.04% year on year. Net loss attributable to shareholders narrowed to RMB 171 million, representing a 1.53% year-on-year improvement. Net loss attributable to shareholders excluding non-recurring items was RMB 179 million, narrowing by 3.49% year on year.

300229.SZ | Revenue: RMB 126M | YoY: -48.40%

TRS reported revenue of RMB 126 million in the first half of 2026, down 48.40% year on year. Net loss attributable to shareholders reached RMB 169 million, widening 129.56% year on year from a loss of RMB 73.63 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 177 million, widening 97.87% year on year from a loss of RMB 89.45 million a year earlier.

002212.SZ | Revenue: RMB 545M | YoY: -33.99%

TOPSEC reported revenue of RMB 545 million in the first half of 2026, down 33.99% year on year. Net loss attributable to shareholders reached RMB 273 million, widening 321.80% year on year from a loss of RMB 64.69 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 287 million, widening 274.82% year on year from a loss of RMB 76.58 million a year earlier.

300369.SZ | Revenue: RMB 813M | YoY: +1.51%

NSFOCUS reported revenue of RMB 813 million in the first half of 2026, up 1.51% year on year. Net loss attributable to shareholders narrowed to RMB 129 million, representing a 24.56% year-on-year improvement from a loss of RMB 171 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 169 million, narrowing by 19.91% year on year from a loss of approximately RMB 211 million a year earlier.

300579.SZ | Revenue: RMB 340M | YoY: +4.52%

BJCA reported revenue of RMB 340 million in the first half of 2026, up 4.52% year on year. Net loss attributable to shareholders narrowed to RMB 48.67 million, representing a 46.13% year-on-year improvement from a loss of RMB 90.35 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 49.52 million, narrowing by 48.99% year on year from a loss of RMB 97.08 million a year earlier.

688435.SH | Revenue: RMB 73.07M | YoY: -13.38%

Information2 reported revenue of RMB 73.07 million in the first half of 2026, down 13.38% year on year. Net loss attributable to shareholders reached RMB 18.81 million, widening 97.43% year on year from a loss of RMB 9.53 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 28.65 million, widening 52.30% year on year from a loss of RMB 18.81 million a year earlier.

688489.SH | Revenue: RMB 209M | YoY: +7.38%

Sansec reported revenue of RMB 209 million in the first half of 2026, up 7.38% year on year. Net loss attributable to shareholders narrowed to RMB 12.56 million, representing a 57.25% year-on-year improvement from a loss of RMB 29.39 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 18.58 million, narrowing by 44.31% year on year from a loss of RMB 33.36 million a year earlier.

688201.SH | Revenue: RMB 186M | YoY: -19.37%

Infosec reported revenue of RMB 186 million in the first half of 2026, down 19.37% year on year. Net loss attributable to shareholders reached RMB 42.40 million, widening 59.41% year on year from a loss of RMB 26.60 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 44.28 million, widening 51.83% year on year from a loss of RMB 29.17 million a year earlier.

300659.SZ | Revenue: RMB 213M | YoY: -27.89%

Zhongfu reported revenue of RMB 213 million in the first half of 2026, down 27.89% year on year. Net loss attributable to shareholders reached RMB 120 million, widening approximately 13.21% year on year from a loss of RMB 106 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 129 million, widening approximately 11.21% year on year from a loss of approximately RMB 116 million a year earlier.

003029.SZ | Revenue: RMB 143M | YoY: -19.41%

JIT reported revenue of RMB 143 million in the first half of 2026, down 19.41% year on year. Net loss attributable to shareholders narrowed to RMB 35.10 million, representing an 18.62% year-on-year improvement from a loss of RMB 43.13 million in the same period last year. Net loss attributable to shareholders excluding non-recurring items was RMB 38.44 million.

More H1 2026 updates to come……

Share

On August 28, 2026, QAX (688561.SH) disclosed an announcement stating that the exercise conditions for the fourth exercise period of its 2022 Stock Option Incentive Plan and the third exercise period of its 2023 Stock Option Incentive Plan had not been met. The company plans to cancel a total of 4.4768 million stock options, including 2.1320 million under the 2022 plan and 2.3448 million under the 2023 plan.

With this cancellation, all options originally granted under the 2022 incentive plan will have been wiped out, formally bringing the plan to an end. In other words, the growth targets used to incentivize QAX’s core team four years ago were never converted into exercisable equity—not in the first exercise period, nor in the fourth.

The latest cancellation was not simply the result of employee turnover. Of the 4.4768 million options being cancelled, only 666,400, or less than 15%, are attributable to the departure of 53 participants under the 2022 plan and 65 under the 2023 plan. The overwhelming majority—3.8104 million options, or more than 85%—were cancelled because company-level performance targets were not met. A total of 603 participants under the 2022 plan and 689 under the 2023 plan failed to qualify for the respective exercise periods.

The performance requirements themselves were relatively straightforward. Both plans used revenue growth and gross profit growth as company-level performance indicators. If either metric fell below the specified threshold, the options for that exercise period would be forfeited in full.

According to the audit report issued by Dahua Certified Public Accountants, QAX recorded revenue of RMB 4.392 billion in 2025, down 29.43% from 2022, while gross profit fell 44.80% over the same period. Both metrics therefore missed the required thresholds, leaving the fourth exercise period under the 2022 plan and the third exercise period under the 2023 plan without any exercisable options.

Seven Exercise Periods, Zero Successes

The longer-term picture is even more striking.

Under the 2022 plan, the four exercise periods resulted in cancellations of 2.768 million, 2.798 million, 2.518 million and 2.132 million options, respectively, for a cumulative total of 10.216 million.

The 2023 plan made it through three exercise periods, with 2.993 million, 2.982 million and 2.345 million options cancelled in each period, bringing its cumulative cancellations to 8.320 million.

Across the two plans, all seven exercise periods ended without meeting the required conditions, resulting in approximately 18.536 million options being cancelled.

There was even an attempt to lower the bar. In August 2023, QAX revised the performance assessment rules for the 2022 plan, with the changes subsequently approved by shareholders. Yet even after the targets were adjusted downward, the second, third and fourth exercise periods still failed to meet the requirements.

The accounting impact of the cancellations themselves is limited, and King & Wood Mallesons also issued a legal opinion confirming their compliance. But the signal sent by seven consecutive failed exercise periods is far more significant than the accounting treatment.

Subscribe now

From Growth at All Costs to Survival Economics

When these stock option plans were designed in 2022 and 2023, China’s cybersecurity industry was still operating under a “revenue growth + gross profit growth” expansion model. Companies were competing for talent and market share on the assumption that rapid top-line growth would ultimately translate into stronger valuations and greater shareholder returns.

That environment has changed dramatically since 2023.

Government and enterprise cybersecurity budgets have tightened, project acceptance cycles have become longer, and price competition has put increasing pressure on margins. Even leading vendors have been forced to shift their priorities from pursuing scale to protecting cash flow and profitability.

QAX’s 2025 financial results illustrate the same structural shift from another angle. The company generated RMB 4.392 billion in revenue, recorded a net loss attributable to shareholders of RMB 1.287 billion, and saw its gross margin decline to 50.32%.

The complete failure of its stock option plans and these financial results are, in many ways, two sides of the same story.

There is also a less visible consequence on the talent side. Across the two plans, 118 incentive participants have left the company. When the prospect of exercising stock options shifts from a realistic future benefit to something that exists largely on paper, the retention value of equity incentives naturally begins to depreciate as well.

A Sign of a Broader Cybersecurity Reset

QAX’s experience is not simply an isolated corporate setback. It is a microcosm of how China’s cybersecurity sector is being forced to reset its coordinates.

For years, the industry largely operated on the assumption that bigger revenue, larger customer bases and faster growth would naturally translate into stronger competitive positions. But when growth slows, that equation no longer holds.

The metrics that matter are changing accordingly.

The question is no longer simply how fast a cybersecurity company can grow, but:

• How much gross margin can it protect?

• How much cash can it retain?

• And how many of its key people can it keep?

The cancellation of 18.536 million stock options may therefore be more than the closing chapter of two incentive plans. It is a reminder that in a colder cybersecurity market, the definition of “growth” itself is being rewritten.

Share

🧭 Monthly Snapshot

This month, key developments across China and Hong Kong’s cybersecurity sectors included H1 2026 financial performance, overseas expansion, AI-driven security services, industrial control security, hybrid cloud, regulatory enforcement, and cybersecurity reviews. New financing activity also highlighted continued investment in critical infrastructure security. Meanwhile, discussions around Hong Kong’s cybersecurity history and emerging service standards underscored the importance of industry collaboration, cross-border trust, and a more structured cybersecurity ecosystem.

Read more

Hong Kong’s cybersecurity industry has evolved for more than three decades. From the early emergence of Internet and security research communities, to the establishment of foundational security frameworks such as CERTs, and the continuous development of today’s ecosystem around critical infrastructure protection, there have been countless milestones worth documenting along the way.

Some milestones were driven by technological developments, while others were shaped by significant events. The Edison Chen photo scandal brought public attention to data privacy and digital forensics, while Edward Snowden’s transit through Hong Kong brought the intersection of global geopolitics and state-level cyber threats into the public spotlight in an unprecedentedly tangible way.

These events are not only snapshots of Hong Kong’s cybersecurity development, but also part of the collective memory of an industry that has evolved over more than three decades.

Yet much of this history remains scattered across personal experiences, institutional archives, news reports, and the memories of those who have been part of the industry. Every industry deserves to have its own history. This is also one of the founding motivations behind THE COI.

As an independent, non-profit research institute, THE COI seeks to observe the cybersecurity industry through a long-term, objective, and systematic lens, documenting its key stakeholders, significant events, and evolving landscape.

On August 19, 2026, THE COI (Cybersecurity Observatory Institute) hosted the inaugural THE COI Insight Series HK01 closed-door exchange in Hong Kong.

Under the theme “Building the Collective Memory of Hong Kong Cybersecurity,” the event brought together industry professionals from five different areas of Hong Kong’s cybersecurity ecosystem. Through presentations, discussions, and on-site contributions, participants reflected on key milestones that have shaped the industry—from changes in industry development and market dynamics to pivotal moments in Hong Kong’s cybersecurity history—and contributed to refining the first edition of The Chronicle of Hong Kong Cybersecurity.

This was more than an industry exchange. It was a collective effort to document, preserve, and remember the history of Hong Kong’s cybersecurity industry.

From Three Decades of China’s Cybersecurity Industry to Today

Following the opening of the event, THE COI first introduced its founding vision and long-term positioning as an independent research institute. This was followed by a keynote sharing on “Three Decades of China’s Cybersecurity Development” by Jon XU, Partner at Z-ONE and Nova Cyber Ventures.

Next, Xiaosheng Tan, Partner at Z-ONE and Founder of GENIUS CYBERTECH, reviewed the recent performance of China’s publicly listed cybersecurity companies through a data-driven analysis. Changes in market size, corporate performance, and the competitive landscape offered participants another perspective on how China’s cybersecurity industry has evolved over the years and reached where it is today.

The Chronicle of Hong Kong Cybersecurity (19??–2027): A History Still Being Written

The event then moved into its central session — a focused discussion on the development of Hong Kong’s cybersecurity industry.

The session was moderated by Bruce ZHANG, Founder of THE COI and Founder of Z-ONE. He first introduced the research rationale and overall structure of this local chronicle of Hong Kong’s cybersecurity history, as well as how the advisory team will contribute to the research. He also provided a preliminary review and analysis of the political, economic, cultural, and other relevant data collected so far, structured around the three major research directions currently being explored.

Unlike a traditional panel discussion, the roundtable that followed was not limited to a few speakers on stage. Instead, all participants were encouraged to join the conversation. Drawing on their own experiences and perspectives, professionals from different backgrounds came together to explore a question that sounds simple, but is surprisingly difficult to answer:

What do you remember most vividly from the history of Hong Kong’s cybersecurity industry?

Participants from different generations, roles, and professional backgrounds continued to add their own pieces to the story. The discussion quickly shifted from “looking through records” to “searching through memories.” From the early Internet and hacker culture to the development of Hong Kong’s security community; from the establishment of important security infrastructure such as CERTs to the evolution of cybersecurity regulation and critical infrastructure protection in recent years, participants contributed new events, corrected timelines, and shared first-hand experiences that had never appeared in publicly available records.

_{The introduction to “Hong Kong’s Collective Cybersecurity Memory” and the roundtable discussion were also recorded as a podcast. Those interested are welcome to listen to the full session.}

Some forgotten names were brought back into the conversation. Some unclear dates and milestones were further confirmed. And some events that once shaped the industry gradually began to take on a more complete form through the memories of different participants.

This is precisely the value THE COI hopes The Chronicle of Hong Kong Cybersecurity can create — a history shaped by the industry itself, continuously verified, enriched, and refined over time.

_{To learn more about the latest research progress and the key events currently documented, please visit the online, continuously updated version of this research. The living version will continue to incorporate new findings, feedback, and verified information as the research progresses.}

From Personal Memories to a Collective Memory of the Industry

As the inaugural event of the THE COI Insight Series, this exchange was never intended to answer every question at once. Instead, it was more like a formal beginning.

From personal memories to collective memory, from scattered events to a systematic timeline, and from individual experiences to a shared narrative of the industry, The Chronicle of Hong Kong Cybersecurity (19??–2027) still has much to be added, verified, and refined.

THE COI will continue to advance this research and use the Insight Series as an ongoing platform for bringing together industry participants to exchange ideas and share experiences. Through these regular conversations, THE COI will continue to observe the development of the cybersecurity industry, changes in the market, and the important milestones that have shaped its history.

The complete research findings on the development of Hong Kong’s cybersecurity industry are planned for official publication in the first half of 2027, marking the 30th anniversary of Hong Kong’s return to the motherland. The publication will document the three decades of Hong Kong’s cybersecurity journey while opening a new chapter for the years ahead.

Following the event, several participants also shared their experiences on social media. One guest noted that this approach to industry exchange and research, distinct from traditional industry events, offered a fresh perspective on their years of professional experience and encouraged participants to reconsider the development of Hong Kong’s cybersecurity industry from different dimensions.

We hope that when people look back on the development of Hong Kong’s cybersecurity industry in the future, they will see more than just a few familiar names and events. They will also see the many individuals who were part of the journey and helped move the industry forward.

The history of an industry has never belonged to a single institution, nor to a single era.

It belongs to everyone who has been part of it.

And this time, we began recording it together.

If you are interested in helping document this history, we welcome you to join us.

Share

This edition reviews the latest 2026 H1 financial disclosures from four publicly listed companies in China’s cybersecurity and digital security sector, covering revenue, profitability and key corporate developments.

601360.SH | Revenue: RMB 4.172B | YoY: +9.01%

360 reported revenue of RMB 4.172 billion in the first half of 2026, representing a 9.01% year-on-year increase. Net profit attributable to shareholders reached RMB 290 million, up 176.62% year on year, while net profit attributable to shareholders excluding non-recurring items was RMB 216 million, representing a 48.44% year-on-year increase.

300188.SZ | Revenue: RMB 486M | YoY: -12.89%

SDIC Intelligence reported revenue of RMB 486 million in the first half of 2026, down 12.89% year on year. Net loss attributable to shareholders reached RMB 255 million, representing a 22.42% year-on-year decline in profitability, while net loss attributable to shareholders excluding non-recurring items was RMB 261 million, down 18.81% year on year.

300386.SZ | Revenue: RMB 265M | YoY: -26.85%

Feitian reported revenue of RMB 265 million in the first half of 2026, down 26.85% year on year. Net loss attributable to shareholders reached RMB 60.67 million, representing a 1,101.00% year-on-year decline, while net loss attributable to shareholders excluding non-recurring items was RMB 61.75 million, down 2,063.79% year on year.

603232.SH | Shares Held: 18.02M | Current Stake: 7.7480%

Lu Haitian, one of KOAL’s actual controllers, currently holds 18.02 million shares in the company, representing 7.7480% of its total share capital. He plans to reduce his holdings by up to 4.65 million shares, or 1.9996% of the company’s total shares, over a three-month period starting September 10, 2026. The planned reduction includes up to 2.325 million shares through centralized bidding and up to 2.325 million shares through block trades, with the selling price to be determined based on market prices.

688225.SH | Revenue: RMB 2.737B | YoY: -12.40%

AsiaInfo Security reported revenue of RMB 2.737 billion in the first half of 2026, down 12.40% year on year. Net loss attributable to shareholders narrowed to RMB 255 million, compared with a loss of RMB 356 million in the same period last year, representing a 28.31% year-on-year improvement. However, net loss attributable to shareholders excluding non-recurring items increased slightly to RMB 261 million, compared with RMB 252 million a year earlier, representing a 3.23% year-on-year deterioration.

688023.SH | Revenue: RMB 739M | YoY: +0.86%

DAS-Security reported revenue of RMB 739 million in the first half of 2026, up 0.86% year on year. Net loss attributable to shareholders narrowed to RMB 176 million, compared with RMB 194 million in the same period last year, representing a 9.22% year-on-year improvement. Net loss attributable to shareholders excluding non-recurring items was RMB 190 million, compared with RMB 208 million a year earlier, narrowing by approximately 8.66% year on year.

300454.SZ | Revenue: RMB 3.998B | YoY: +32.85%

Sangfor Technologies reported revenue of RMB 3.998 billion in the first half of 2026, up 32.85% year on year. Net profit attributable to shareholders reached RMB 231 million, compared with a net loss of RMB 228 million in the same period last year, marking a return to profitability. Net profit attributable to shareholders excluding non-recurring items was RMB 179 million, also turning positive from a loss of RMB 259 million a year earlier.

002439.SZ | Revenue: RMB 1.235B | YoY: +9.01%

Venustech reported revenue of RMB 1.235 billion in the first half of 2026, up 9.01% year on year. Net profit attributable to shareholders reached RMB 30.79 million, compared with a net loss of RMB 93.35 million in the same period last year, marking a return to profitability. Net profit attributable to shareholders excluding non-recurring items was RMB 60.28 million, also turning positive from a loss of approximately RMB 164 million a year earlier.

300017.SZ | Revenue: RMB 2.318B | YoY: -1.38%

Wangsu Science & Technology reported revenue of RMB 2.318 billion in the first half of 2026, down 1.38% year on year. Net profit attributable to shareholders was RMB 348 million, down 6.61% year on year, while net profit attributable to shareholders excluding non-recurring items reached RMB 241 million, representing a 7.85% year-on-year decline.

300768.SZ | Revenue: RMB 537M | YoY: -2.52%

DPtech reported revenue of RMB 537 million in the first half of 2026, down 2.52% year on year. Net profit attributable to shareholders reached RMB 72.41 million, up 38.86% year on year, while net profit attributable to shareholders excluding non-recurring items was RMB 62.44 million, representing a 43.59% year-on-year increase.

More H1 2026 updates to come……

Share

Host / 主播： Bruce ZHANG

Guest / 嘉宾：香港网络安全专业人士们 | Hong Kong Cybersecurity Professionals

01｜为什么要写一个香港的网络安全历史？📖
01｜Why Write a History of Cybersecurity in Hong Kong? 📖

02｜政治、经济与文化：三个维度看香港网络安全🌏
02｜Politics, Economy and Culture: Three Dimensions of Hong Kong Cybersecurity 🌏

03｜2008.02.04｜陈冠希事件📸
03｜2008.02.04｜The Edison Chen Photo Scandal 📸

04｜2013.05.20｜斯诺登来到香港🕵️
04｜2013.05.20｜Edward Snowden Arrives in Hong Kong 🕵️

05｜这样的记忆，还有很多很多……🧠
05｜There Are So Many More Memories Like These… 🧠

06｜整理不仅为了过去，也是为了未来⏳
06｜Documenting the Past, Preparing for the Future ⏳

07｜群体互动环节：我们记得什么？💬
07｜Group Interaction: What Do We Remember? 💬

08｜重大的安全事件，需要被记录🚨
08｜Major Security Incidents Deserve to Be Recorded 🚨

09｜从活动的热度看香港发展脉络🎤
09｜Tracing Hong Kong’s Development Through the Momentum of Industry Events 🎤

10｜从警队监管职能的迭代，看安全发展👮‍♂️⚖️
10｜The Evolution of Police Regulatory Functions and the Development of Cybersecurity 👮‍♂️⚖️

11｜少年黑客记忆中的WannaCry🦠
11｜WannaCry Through the Eyes of a Young Hacker 🦠

12｜从数据合规执行力度，看变化与进步📋
12｜Changes and Progress Through the Enforcement of Data Compliance 📋

13｜从安全事件，看香港认知的进步🧠
13｜Cybersecurity Incidents and the Evolution of Awareness in Hong Kong 🧠

14｜以金管局为例，看监管机构如何与时俱进🏦
14｜The Hong Kong Monetary Authority: How Regulators Evolve with the Times 🏦

15｜Crypto行业的安全，与香港的千丝万缕 🔗
15｜The Intricate Connection Between Crypto Security and Hong Kong 🔗

16｜新香港网络安全人，差异化的视角与感受👥
16｜A New Generation of Hong Kong Cybersecurity Professionals: Diverse Perspectives and Experiences 👥

17｜记录香港网络安全的技术成就，点点滴滴💻
17｜Documenting Hong Kong’s Cybersecurity Achievements, One Milestone at a Time 💻

18｜携手，构建共同的香港网络安全回忆🤝🇭🇰
18｜Together, Building a Shared Memory of Hong Kong Cybersecurity 🤝🇭🇰

🎧 Listen to the full episode

🎧 Prefer other platforms?

小宇宙Xiaoyuzhou
→ https://www.xiaoyuzhoufm.com/podcast/69c390d66d45b5e7ad9dd71f

Apple Podcasts
→ Listen here

Share

Qi’An Technology recently announced the completion of its Series C strategic financing, with the round exclusively invested by the Ezhou Airport Industrial Development Fund and managed by FengShen Capital. As a national-level “Little Giant” enterprise specializing in industrial Internet security, the financing represents more than a capital injection. It marks Qi’An Technology’s entry into a new phase of dual-track growth centered on critical infrastructure security and low-altitude urban data governance, with the proceeds primarily earmarked for the development of its Central China headquarters and low-altitude economy center.

Founded in 2018, Qi’An Technology has maintained steady growth since its inception. Following early-stage technical validation during its angel round, the company deepened its presence in the power and energy sectors through subsequent Series A and Series B financing. It has since developed a full-cycle industrial control security product portfolio covering pre-event detection, in-event protection, and post-event auditing, with large-scale deployments across critical infrastructure sectors including power, rail transportation, and oil and petrochemicals.

With more than 100 intellectual property rights and comprehensive capabilities for localization and domestic technology adaptation, Qi’An Technology has become a core supplier to multiple central state-owned enterprises. The completion of its Series C financing marks the company’s transition from the product validation stage into a new phase of expansion driven by closer integration between industrial development and capital.

Behind the financing is a strategic alignment between the Ezhou Airport Economic Zone and Qi’An Technology. Zhao Xuyu, Partner at FengShen Capital, said the firm’s investment decision was based primarily on three dimensions of value. First, the company’s positioning across two strategic growth tracks is closely aligned with national development priorities, providing significant long-term growth potential. Second, its core technologies are independently controlled, supported by high technical barriers and substantial industry entry requirements. Third, Qi’An Technology has established a comprehensive qualification system and mature capabilities for real-world deployment, creating strong industry barriers and opportunities for long-term synergies with regional industrial development.

Leveraging the unique airspace resources and logistics scenarios of Ezhou Huahu Airport, Qi’An Technology plans to extend its proven capabilities in asset identification, secure access, and continuous auditing from industrial environments into the low-altitude sector. The two parties will jointly establish a technology innovation base integrating intelligent hardware manufacturing, technology R&D, and low-altitude operations.

Looking ahead, Qi’An Technology will leverage its Central China headquarters to achieve localized mass production of its proprietary industrial security hardware. At the same time, capitalizing on the airspace advantages of Huahu Airport, the company plans to develop a regional low-altitude unmanned aerial vehicle (UAV) management and operations platform. The platform will support scenarios including logistics delivery, urban inspection, and emergency response, with the goal of developing standardized and replicable solutions that create a mutually reinforcing cycle between regional industrial upgrading and corporate growth.

Share

In 2025, China’s cybersecurity industry officially entered a phase of deep structural adjustment. As policy-driven growth momentum in the domestic market continues to weaken, competition within the existing market intensifies, and overall industry profitability remains under pressure, overseas markets are gradually evolving from a “strategic option” into a key driver of long-term growth.

At present, more than 30 publicly listed Chinese companies are engaged in cybersecurity-related businesses, covering multiple segments including security hardware, security software, data security, cloud security, industrial cybersecurity, identity and access management, as well as integrated security services. Based on financial disclosures and public information released in 2025, it is possible to observe the broader internationalization trends of China’s cybersecurity industry, its regional expansion patterns, and the practical challenges companies face in global market development.

It should be noted that not all listed companies have established substantial overseas business execution capabilities, and some companies have yet to separately disclose overseas revenue or international business data in their financial reports. Therefore, the scope of this report is primarily based on publicly available annual reports, investor communication materials, and other public disclosures, with a focused analysis on 16 representative listed cybersecurity companies.

Based on a review of financial disclosures and globalization strategies, it can be observed that Chinese cybersecurity vendors are undergoing a critical transition from “product export” to “capability export,” and from “opportunity-driven expansion” to “systematic global operations.” Compared with earlier international business models centred on channel sales and project delivery, an increasing number of companies are beginning to establish localized teams, regional partnership networks, and long-term service capabilities, while gradually participating in overseas digital infrastructure, security operations, and ecosystem development.

This transition not only reflects the evolving role of China’s cybersecurity industry in the global market, but also highlights the emerging growth logic and international competitive landscape faced by Chinese security technology companies amid the restructuring of global digitalization and cybersecurity demand.

At present, the global expansion of Chinese cybersecurity companies is demonstrating three core characteristics.

First, regional focus continues to converge. Corporate resources are increasingly concentrated in high-certainty markets such as Southeast Asia and the Middle East, gradually forming a globalization framework centered around countries participating in the Belt and Road Initiative. Companies such as Sinovatio, Qi An Xin, NSFOCUS, and AsiaInfo Securityserve as representative examples. Southeast Asia has evolved from a “pilot market” into a “long-term operational market,” while the Middle East is emerging as a new growth region characterized by both high contract values and elevated localization requirements.

Second, the core capabilities underpinning international competition are evolving. AI enablement, SASE, cloud-native security, data security, and global security operations capabilities are gradually replacing traditional hardware-centric offerings as the primary drivers of international competitiveness. The industry’s globalization model is also shifting from one-time product sales toward sustained service and operational capability delivery.

Third, overseas operating models are undergoing structural change. The industry is transitioning from a relatively extensive model reliant on channel distribution and project-based delivery toward a more organized globalization phase characterized by “localized operations + ecosystem collaboration + long-term regional development.” Corporate priorities are correspondingly shifting from pure overseas revenue expansion toward regional service capability, ecosystem integration, and long-term operational resilience.

Overall, the international expansion of China’s cybersecurity industry is moving from a phase of “scale expansion” to one of “quality-driven competition.” Building on these trends, the following sections will further examine overseas revenue structures, regional deployment, capability evolution, and potential challenges based on listed company disclosures and publicly available data.

Share

I. Industry Macro Landscape

Slowing Domestic Growth Drives Global Expansion as a Core Strategic Pathway

1.1 China Market: Traditional Growth Drivers Reaching an Inflection Point

Over the past decade, the growth of China’s cybersecurity industry has been primarily driven by policy incentives, including classified protection regulations, critical information infrastructure development, and digital procurement initiatives from government and enterprise sectors, all of which collectively supported rapid industry expansion.

By 2025, this growth model is undergoing a structural shift. On one hand, budget growth among government and enterprise customers has slowed significantly, while traditional compliance-driven deployment is gradually reaching maturity. On the other hand, increasing product and service homogenization across the industry has intensified price competition, placing sustained pressure on corporate profitability.

The industry is exhibiting three defining characteristics: the gradual saturation of incremental markets, intensified competition within existing markets, and the need to restructure corporate growth models. An increasing number of vendors are facing structural challenges, including slowing revenue growth, declining profit margins, and high customer concentration.

Integrity Technology Group stated in its annual report that the global cybersecurity industry is currently at a critical stage where “challenges and opportunities coexist.” The company noted that, amid changing market conditions, security investment willingness among key downstream industries has weakened, placing pressure on overall industry growth. As a result, the cybersecurity sector is shifting away from a previous focus on scale expansion toward a new stage centred on “high-quality and sustainable development.” The company also emphasized that, with the rapid iteration of AI technologies, attackers are increasingly leveraging AI to accelerate code generation and social engineering attacks, rendering traditional detection methods less effective. Demand for “intelligent and systematic defence systems” is therefore rising rapidly. This observation not only reflects changes in industry demand structure, but also highlights the sector’s transition from “compliance-oriented security” toward “substantive defence capabilities.”

Sangfor Technologies reflected similar structural changes from an operational perspective. In its annual report, the company stated that current growth is primarily driven by cloud business, overseas markets, and domestic key-account (KA) customers, while traditional markets remain under pressure. The company further indicated that it will continue increasing investment in KA customers, leading industry clients, and overseas markets, while strengthening its solution and organizational capabilities for large-scale customers. This suggests that the cybersecurity industry is gradually shifting from a growth model driven by standardized products toward a competitive landscape centred on “high-value customers + integrated capability delivery.”

FEITIAN Technologies also noted in its annual report that overseas revenue contribution has continued to increase in recent years. At the same time, the company emphasized that intensified international competition, trade barriers, and exchange-rate volatility are significantly increasing the complexity of global operations. The company stated that it will continue strengthening overseas customer development and international marketing capabilities. This trend indicates that even for companies with relatively mature international operations, globalization has evolved from simple revenue expansion into a broader competition involving long-term operational and risk management capabilities.

Sinovatio more directly reflects the industry’s globalization transition. The company stated in its annual report that it will continue deepening its international market development strategy by expanding overseas marketing teams, strengthening regional outreach capabilities, and enhancing localized operational systems. According to the company, regional representative offices will be established in key Asia-Pacific markets, while a “tiered partnership + ecosystem co-development” approach will be adopted to build an international operating framework covering strategic markets. The company also emphasized that it is leveraging large-model capabilities from its AI innovation lab to strengthen product competitiveness, while optimizing mobile signal collection and analysis products for complex overseas mobile network environments to improve global market adaptability.

Sangfor Technologies also provided representative commentary regarding overseas strategy. In its annual report, the company explicitly stated that it will continue prioritizing investment in overseas markets in 2026, while further improving product quality and adaptability to enhance Sangfor’s international brand influence and overseas market share. The company additionally highlighted plans to deepen customer management systems and strengthen organizational and professional capabilities for serving large overseas clients and leading industry customers.

These developments collectively indicate that globalization is no longer merely an “optional strategy” for Chinese cybersecurity companies, but is increasingly becoming a core pathway for overcoming growth constraints and rebuilding long-term competitiveness.

Subscribe now

1.2 Global Market: Digitalization and AI Reshape Cybersecurity Demand

At the same time, the global cybersecurity market is entering a new cycle of demand expansion.

From the demand side, the continued acceleration of global digitalization and intelligent transformation — including cloud migration, AI adoption, cross-border data flows, and smart infrastructure development — is driving sustained growth in cybersecurity demand. Meanwhile, the large-scale globalization of Chinese enterprises is also fueling rapid growth in “accompanying security expansion” requirements, including capabilities related to cross-border network connectivity, global cloud security, data compliance, overseas SOC operations, as well as SASE and zero-trust architectures. In particular, the continued expansion of Chinese manufacturing companies, internet platforms, cross-border e-commerce firms, and cloud service providers across Southeast Asia, the Middle East, and Latin America is creating a natural customer base for Chinese cybersecurity vendors.

At the same time, the gradual maturity of technologies such as AI, large language models, SASE, and SD-WAN is reshaping global cybersecurity service delivery models. Traditional cybersecurity has long relied on localized hardware deployment and delivery-intensive models, whereas trends toward cloud-based, software-defined, and AI-driven architectures are significantly reducing the cost of global expansion while improving remote delivery and scalable replication capabilities.

Compared with traditional models reliant on hardware sales and project-based delivery, an increasing number of Chinese cybersecurity vendors are leveraging AI capabilities, cloud-native architectures, and software-driven delivery systems to upgrade their global operating models. This also indicates that the international competitive logic of China’s cybersecurity industry is evolving from “hardware export” toward “continuous operational capability delivery.”

Share

Ⅱ. Overseas Revenue Landscape in 2025

Industry Stratification Accelerates as Leading Players Further Consolidate Their Advantage

In 2025, overseas business revenue among China’s publicly listed cybersecurity companies continued to expand overall. From the perspectives of overseas revenue scale, growth momentum, and contribution to total revenue, the industry has begun to exhibit an increasingly distinct tiered structure.

2.1 High-Growth Tier: Technology-Driven Global Expansion Accelerates

In 2025, incremental overseas revenue continued to concentrate among companies with strong technological barriers, platform-based capabilities, and deep regional operational expertise. More broadly, China’s cybersecurity industry has entered a new phase of global competition — shifting from the question of “whether to expand overseas” to “who possesses stronger globalization capabilities.”

Sinovatio recorded the industry’s highest overseas revenue growth rate at 68.88%, emerging as one of the most notable global expansion stories of the year.

In its annual report, the company emphasized its continued commitment to internationalization, positioning its Singapore subsidiary, T-INNOWARE, as a global service hub for government and enterprise markets to strengthen global resource coordination and ecosystem development capabilities. The company also highlighted that, through AI-enabled mobile signal collection and analytics products, alongside continuous optimization for complex overseas network environments, it has secured strategic customer breakthroughs across multiple markets in Asia-Pacific and Africa.

The company noted that “the Asia-Pacific region has steadily evolved into a strategic growth engine for the company’s overseas business.” Leveraging T-INNOWARE as its global government and enterprise market service center, Sinovatio has strengthened global resource integration and ecosystem collaboration, providing strong support for the deeper expansion of its overseas operations. In Africa, core regional business maintained stable growth while the company achieved market entry breakthroughs in several previously untapped markets. In Asia-Pacific, deeper localization of channel networks and iterative improvements in its marketing system significantly increased penetration in key national markets.

Subscribe now

Want to explore the full analysis?
Download THECOI JOURNAL to read the complete article and discover more insights.

Get the full issue of THECOI JOURNAL here: https://www.the-coi.org/journal

Contact THE COI

info@the-coi.org

www.the-coi.org

www.linkedin.com/company/thecoi/

Share

According to the latest data from International Data Corporation (IDC), China’s intelligent industrial control security audit market declined 5.2% year over year in 2025 to RMB 800 million, driven by slower investment growth among industrial enterprises and intensifying competition in the existing market. The market is shifting from scale expansion toward optimization of the installed base and capability upgrades, while intelligent capabilities are emerging as an important area of product differentiation. The competitive landscape of the industrial control security audit market remained largely unchanged, with TDHX, Sinoelec, Winicssec, QAX, and Wangtengtech continuing to dominate the market.

Analyst Views

According to Chen Jia, Research Analyst at IDC China, China’s industrial control security audit market is gradually moving from a compliance-driven phase of rapid deployment into a more mature stage centred on capability upgrades and structural optimization. Market growth is becoming more stable, but against the backdrop of deeper integration between the Industrial Internet and OT/IT environments, security requirements are evolving from “compliance audit tools” toward “continuous risk governance capabilities.” At the same time, AI technologies are being embedded into audit processes as an enhancement to improve the efficiency of anomaly detection, behavioural analysis, and risk assessment, gradually shifting product capabilities from rule-driven to data- and intelligence-driven approaches. Going forward, competition will no longer be limited to individual functions, but will increasingly center on the combined strengths of platform integration, depth in industry-specific scenarios, and intelligence capabilities. Vendors with “platform + data + intelligent analytics” capabilities will be better positioned to gain an advantage in the next round of market restructuring.

Share

According to the latest data from IDC, the China intelligent industrial control firewall market reached RMB 1.56 billion in 2025, representing a year-over-year decline of 6.7%. The market experienced a temporary adjustment due to tightened IT and industrial digitalization investment budgets. However, from the perspective of demand structure, the market is not entering a decline phase but is gradually shifting from “scale expansion” toward “value-driven growth.” With increasing demand for domestic replacement in specific industrial scenarios, alongside the continued advancement of industrial internet, smart manufacturing, and industrial AI applications, users are placing greater emphasis on actual protection effectiveness and long-term operational value. In terms of the competitive landscape, Winicssec, Venustech, 6cloudtech, SUPCON Technology, Fortinet, and TDHX remain the leading players in the market.

Analyst Views

Chen Jia, Research Analyst at IDC China, stated that as industrial digital transformation continues to deepen, the industrial control firewall market is showing three major trends: first, security initiatives are evolving from compliance-driven approaches toward risk-driven protection; second, IT/OT convergence is reshaping industrial security architectures; and third, AI technologies are accelerating their integration into industrial security products and operational systems, driving the evolution of security capabilities toward intelligence. In the future, vendors and solutions that can adapt to these trends and integrate into industrial security operations systems will gain greater market development opportunities.

Share

According to the latest data from International Data Corporation (IDC), the China hybrid cloud market grew 22.7% year over year in the second half of 2025, reaching RMB 101.47 billion, while the full-year market size reached RMB 145.17 billion. In 2H 2025, competition in the hybrid cloud market shifted decisively from the development and operation of general-purpose computing infrastructure capabilities on cloud platforms toward upgrades to intelligent computing infrastructure. Support for AI applications such as AI agents, combined with intelligent operations and management, has become a core area of competition in the hybrid cloud market.

Analyst Views

Zhang Li, Senior Research Manager at IDC China, said that in 2025, as the localization of cloud platforms continued to deepen and AI applications such as AI agents were deployed at scale, the China hybrid cloud market followed an overall trend characterized by “localized cloud platform development and expansion as the foundation, and sustained high-growth demand for AI applications as the driving force.” In 2H 2025, the China hybrid cloud market exhibited five major characteristics: significant changes in the proportion of computing resources, growing demand for heterogeneous computing resource management, equal emphasis on localized computing resources and AI security, a surge in demand for AI applications such as AI agents, and continued development of edge inference.

Share

According to IDC’s latest report, “Market Share: China GenAI-Powered Managed Security Services Market Share, 2025,” China’s managed security services market declined by 5.2% year over year in 2025, with a market size of RMB 4.13 billion. Security vendors including DAS-Security, Sangfor, Venustech, NSFOCUS, and QAX continued to maintain leading market positions, supported by their strong overall capabilities, long-term experience accumulation in the security services market, and broad customer recognition.

Analyst Views

Zhao Weijing, Senior Research Manager at IDC China, stated that China’s managed security services market is currently at a critical stage of transition from traditional service models toward intelligent, cloud-based, and outcome-driven operations. Factors including tightened enterprise security budgets and the relatively high costs of traditional on-site services have put pressure on overall market growth. However, demand for security operations has not weakened. Remote managed services and cloud-managed services, with advantages including lower costs, higher efficiency, and standardized delivery, have become important drivers of market growth. AI foundation models and security agents will become core technologies driving MSS transformation. By reshaping alert analysis, threat assessment, automated response, and operational workflows, they will enable the evolution from human-driven operations toward AI-native security operations.

Share

China’s commercial cryptography company FiSEC (渔翁信息) has been fined RMB 17.9 million for fraudulent disclosures during its attempted IPO on the Shanghai STAR Market, highlighting regulators’ continued scrutiny of cybersecurity companies even after IPO applications are withdrawn.

Founded in 1998 and headquartered in Weihai, Shandong Province, FiSEC provides commercial cryptography modules, encryption equipment, and cybersecurity solutions. The company submitted its STAR Market IPO prospectus in December 2022, seeking to raise RMB 334 million, with Western Securities serving as sponsor.

After multiple rounds of regulatory inquiries, FiSEC voluntarily withdrew its IPO application in June 2024. However, the withdrawal did not prevent regulators from investigating potential violations in its IPO disclosure documents.

According to the Jiangxi Office of the China Securities Regulatory Commission (CSRC), from 2020 to the first half of 2023, FiSEC fabricated transactions through fund circulation arrangements and recognized revenue before meeting required revenue recognition conditions, resulting in inflated financial figures disclosed in its IPO materials.

During the period, FiSEC inflated revenue by approximately RMB 37.59 million. The company also overstated profits during multiple reporting periods, including RMB 5.07 million in the first half of 2023, accounting for 19.38% of reported profit for that period.

Beyond financial misrepresentation, regulators found that FiSEC failed to disclose a shareholding arrangement involving actual controller and vice chairman Liu Guihua (刘桂华), who held 1.55 million shares on behalf of another individual. The undisclosed arrangement represented approximately 2.8% of the company’s disclosed total shares and affected the accuracy of its ownership information.

The CSRC fined FiSEC RMB 4 million. Actual controllers Guo Gang (郭刚) and Liu Guihua each received RMB 4 million penalties, while other executives, including the former CFO, board secretary, and senior management members, were also fined.

The case reinforces a key regulatory message under China’s registration-based IPO system: withdrawing an IPO application does not remove responsibility for inaccurate disclosures made during the listing process.

For cybersecurity companies seeking public listings, financial transparency, customer authenticity, and ownership disclosure remain critical compliance requirements. FiSEC’s case highlights the increasing regulatory risks faced by technology companies pursuing capital market expansion in China.

Share

China’s Cybersecurity Review Office announced on August 6, 2026, that it has initiated a cybersecurity review of products sold in China by Palo Alto Networks.

According to the official announcement, the review is being conducted under the National Security Law, the Cybersecurity Law, and the Measures for Cybersecurity Review. The authority said the review aims to safeguard the security and stable operation of critical information infrastructure, prevent cybersecurity risks, and protect national security.

Share

1. Background

The development of any industry does not belong to a single organisation or a single period of time.

The development of Hong Kong’s cybersecurity industry follows the same principle. It does not belong to any single organisation or any single period of time, but has been shaped by the practices, choices, and experiences of countless individuals and communities.

Every technological evolution, cybersecurity incident, industry exploration, and contribution from participants has become an important part of Hong Kong’s cybersecurity journey.

However, many key milestones, significant events, and valuable memories that shaped the industry remain scattered across personal experiences, organisational records, and industry materials, without systematic documentation and preservation.

THE COI (The Cybersecurity Observatory Institute) is continuously conducting research and documentation to identify and organise the key milestones, significant events, and valuable memories that have shaped Hong Kong’s cybersecurity journey.

This open research call is part of this ongoing research effort. It aims to invite participants from different stages and roles within the cybersecurity ecosystem to jointly identify and document the historical events that deserve to be preserved.

The following content represents our current stage of research progress and will continue to be updated, supplemented, and refined.

If you know of any important moments, significant events, or historical stories in Hong Kong’s cybersecurity history that deserve to be preserved, we welcome your contribution.

2. Research Scope: Key Historical Events

These research focuses specifically on key historical events that created significant impact or represented important turning points in Hong Kong’s cybersecurity evolution.

The objective is not to document individual companies or isolated technologies, but to identify events that changed industry direction, influenced security practices, or accelerated ecosystem development.

A key historical event may be analyzed from three perspectives:

01 Political Dimension

Focusing on how government policies, regulatory changes, public governance, and international environments influenced cybersecurity development.

Examples:

• January 1, 2026: Hong Kong’s Protection of Critical Infrastructure (Computer Systems) Ordinance officially came into effect.

• On 20 May 2013, Edward Snowden arrived in Hong Kong. In June 2013, he revealed the U.S. National Security Agency’s (NSA) surveillance programs, and subsequently left Hong Kong for Russia on 23 June. The event made Hong Kong a global focal point for discussions on cybersecurity, surveillance, and digital sovereignty, pushing cybersecurity beyond the technical domain and into the core agenda of international politics and global governance.

02 Economic Dimension

Focusing on how financial markets, industry development, enterprise demand, investments, and business events shaped the cybersecurity ecosystem.

Examples:

• January 9, 2026, ASL-affiliated company i-Sprint Holdings entered into a share purchase agreement with Secure Trust Technologies to sell the equity interests of three subsidiaries, including i-Sprint Innovations, for US$87.94225 million through a management buyout (MBO) structure; the transaction was completed on March 12, 2026, with i-Sprint Holdings simultaneously repurchasing the 35.42% stake held by ASL Security for US$24.980526 million. ASL has since ceased to hold any shares in i-Sprint Holdings, ending approximately 15 years of cooperation between the two parties. The transaction represents a notable case of a Hong Kong-listed company exiting cybersecurity-related assets.

• On 19 April 2017, Edvance International Holdings Limited was listed on the GEM Board of the Hong Kong Stock Exchange (HKEX) under stock code 8410.HK. The company transferred to the Main Board on 24 December 2019 under stock code 1410.HK. Founded in Hong Kong in 2002, Edvance operates across Hong Kong, Macau, Mainland China, and Singapore, focusing on cybersecurity product distribution and technology services. According to Frost & Sullivan, it was the largest IT security solutions value-added distributor in Hong Kong by revenue in 2018.

03 Cultural Dimension

Focusing on how professional culture, talent development, security awareness, community building, and social perception influenced cybersecurity evolution.

Examples:

• On 4 February 2008, the Edison Chen Photo Scandal triggered a major digital privacy crisis. A large number of private photographs were widely circulated online, making it one of the most influential digital privacy incidents in Chinese-speaking societies. The event brought widespread public attention to issues including personal data protection, online content dissemination, digital forensics, and privacy protection in the internet era.

3. Submission Method

If you believe certain events deserve to be preserved as part of Hong Kong’s cybersecurity history, we welcome your participation in this open research call. Please submit the following information via email:

• Key historical event(s) that you believe are important;

• The date or period of the event, a brief background, and its significance to Hong Kong’s cybersecurity development;

• Your name, organisation, and contact information.

Submission Email: info@the-coi.org

If necessary, the research team will follow up with contributors after receiving submissions for further discussion, information verification, or in-depth interviews.

4. Acknowledgement

Contributors will receive:

• All individuals and organizations contributing to this research will be acknowledged in the final publication upon approval.

• Recognition as contributors to the documentation of Hong Kong cybersecurity history.

• Updates on related research initiatives;

Selected events, insights, and references may be included in future research publications by THE COI.

5. Research Timeline & Publication Plan

The open research call will remain open until 31 December 2026. Following the collection, review, and validation of the submitted materials, THE COI will publish the research findings in a new issue of THE COI Journal in the first half of 2027.

For the latest research progress and currently documented key events, please refer to the online live version of this research. The online version will continue to be updated with interim findings and refined based on new submissions, feedback, and validation.

https://www.the-coi.org/post/building-the-collective-memory-of-hong-kong-cybersecurity-draft

Your experience, observation, and memory are part of Hong Kong cybersecurity history.

Share

I. Services as the “Trust Infrastructure” of the Digital Age

As digitalization, cloud computing, and AI continue to evolve, the role of cybersecurity services is undergoing a structural transformation.

Cybersecurity services are no longer merely auxiliary functions within technical systems. Increasingly, they are becoming part of the “trust infrastructure” of digital society itself — not simply providing defense capabilities, but establishing sustainable and verifiable order across increasingly complex systems.

If industrial-era standards were designed to solve the problem of scalable production, digital-era standards are fundamentally concerned with the problem of trustworthiness.

Compared with the security product sector, which has gradually developed mature certification and standardization frameworks, cybersecurity services remain deeply dependent on experience, organizational reputation, and individual expertise. Their capability boundaries are difficult to define, their delivery processes difficult to verify, and their service quality lacks a universally recognized framework for cross-market validation.

As a result, although markets are becoming increasingly dependent on cybersecurity services, they still lack a truly institutionalized mechanism of trust.

This absence is not merely an issue of industry efficiency. More fundamentally, it reflects a vacuum of order emerging within the evolution of digital civilization itself.

For customers, the central challenge is determining who is genuinely trustworthy. For service providers, the challenge lies in transforming operational capability into a form of public credibility that can be continuously validated over time.

As global digital systems become more deeply interconnected and interdependent, the production of trustworthiness itself is emerging as one of the defining questions of the cybersecurity industry.

II. Why Cybersecurity Services Need Standards

2.1 High-Stakes, Highly Specialized — Yet Difficult to Verify

Cybersecurity services inherently combine two characteristics: extreme specialization and systemic risk.

They operate directly within an organization’s data, systems, and operational continuity. Yet unlike traditional industrial products, their capabilities are often not immediately observable. Clients may see outcomes, but remain unable to determine whether the underlying processes were rigorous, whether the expertise was genuine, or whether risks were properly managed.

As a result, cybersecurity services have long existed in a condition of “invisible capability.”

And any form of professional capability that cannot be meaningfully verified ultimately struggles to generate durable social trust.

2.2 When an Industry Lacks Shared Standards

In the absence of common standards, markets tend to drift toward competition driven by marketing, pricing, and relationship networks, rather than by authentic capability and long-term credibility.

The consequences are structural: blurred capability boundaries, inconsistent service quality, continuously repeated trust-building costs, and rising friction across both transactions and collaboration.

At a deeper level, this is not merely an efficiency problem. It reflects the absence of a commonly recognized language of trustworthiness within the industry itself.

2.3 The True Meaning of Standards

The purpose of standards is not to constrain innovation, but to establish a minimum framework of trusted order within complex systems.

What standards define is not technical answers themselves, but the conditions under which capability can be verified, processes audited, and responsibility made accountable.

Once capabilities that previously depended on experience and individual judgment become institutionally expressible, competition can begin to return to professionalism itself.

Share

III. Divergent Philosophies of Cybersecurity Services: China and the West

3.1 A Global Convergence in Direction

The global cybersecurity services industry is undergoing a structural transition — from project-based delivery to continuous operations, and from tool dependency to capability dependency.

Security capabilities are no longer treated as temporary technical outputs. Increasingly, they are becoming embedded governance functions within the long-term operation of organizations themselves.

It is precisely within this transition that international standards, certification systems, and service frameworks have continued to emerge. Their purpose extends beyond defining technical requirements; more fundamentally, they attempt to answer a deeper question: how should trust be established within complex, interconnected, and cross-border digital systems?

3.2 International Markets: Trust Through Process

International markets have historically placed greater emphasis on the trustworthiness of process itself.

Methodologies, procedural controls, personnel certification, audit mechanisms, and clearly defined accountability structures are typically embedded within relatively rigorous institutional frameworks. Within this logic, outcomes alone are insufficient; results must also be explainable, traceable, and verifiable through process.

At its core, this reflects a philosophy of institutionalized trust.

Organizations place confidence not merely in individual expertise, but in the ability of systems and processes to produce repeatable and auditable outcomes over time.

3.3 The Chinese Market: Trust Through Effectiveness

By contrast, the Chinese market has generally evolved around a more outcome-oriented logic.

Clients tend to focus more directly on whether risks were identified, problems resolved, and systems restored to operational continuity, while placing comparatively less emphasis on procedural formalism, documentation structures, or standardized process frameworks.

This approach has strengthened real-world operational capability, rapid response capacity, and adaptability within highly complex environments. It has also cultivated an industry culture that values experiential judgment and execution efficiency.

At the same time, however, capability assessment becomes more dependent on practical outcomes and accumulated organizational experience, rather than on institutional forms of verification.

3.4 Two Distinct Logics of Trust

At a deeper level, this distinction is not merely about market preference, but about two fundamentally different mechanisms for producing trust.

The Chinese model tends toward trust through validated outcomes — trust established through demonstrated effectiveness.

The international model tends toward trust through institutional process — trust produced through systems, procedures, and formal accountability.

The former prioritizes the ability to solve real-world problems; the latter prioritizes verifiable order within complex collaboration environments.

And this distinction directly shapes the underlying logic of how standards themselves are designed.

3.5 Toward an Emerging Synthesis

Yet as global collaboration, cross-border operations, and interconnected digital infrastructure continue to deepen, these two approaches are gradually converging.

Outcome-oriented systems increasingly require process frameworks capable of supporting scalable collaboration, while process-oriented systems must remain grounded in real operational threats and evolving attack realities.

The most effective cybersecurity service standards of the future may therefore be neither purely process-management frameworks nor merely systems of outcome validation, but new trust architectures capable of connecting operational effectiveness with institutional trustworthiness simultaneously.

IV. What Does a Good Standard Mean for Users?

4.1 Reducing Uncertainty

One of the greatest costs in cybersecurity services is not procurement itself, but uncertainty regarding the authenticity of capability.

The primary function of an effective standard is therefore to establish a commonly intelligible framework for evaluating competence — enabling users to identify professional capability more clearly, define service boundaries more accurately, and reduce the trust costs created by information asymmetry.

At its core, a standard provides the foundational language through which trustworthy judgment becomes possible within a complex market.

4.2 Strengthening Credibility

Once service processes, methodological frameworks, and accountability structures become verifiable, security capability ceases to exist merely as an internal organizational asset based on experience.

Instead, it begins to evolve into a form of public credibility that can be externally understood, assessed, and recognized.

This shifts the object of trust itself. Users no longer rely solely on outcomes, but increasingly on the underlying capability structures capable of producing sustainable and repeatable results over time.

Transparency, therefore, becomes a precondition for trustworthiness.

4.3 Enabling Long-Term Collaboration

The deeper significance of standards lies in their ability to reshape the relationship between cybersecurity providers and their clients.

Standards encourage the industry to evolve from one-time project delivery toward continuous, accumulative, and long-term capability collaboration — from reactive responses to isolated incidents toward persistent security governance embedded within organizational operations themselves.

And once security becomes understood as a long-term institutional capability rather than a temporary technical procurement, service relationships themselves begin to evolve from transactional arrangements into enduring trust relationships.

V. What Does a Good Standard Mean for Service Providers?

5.1 Making Capability Truly Recognizable

In markets without shared standards, genuine professional capability is often overshadowed by marketing power, price competition, and short-term visibility.

The value of standards lies in creating a more equitable mechanism for recognizing organizations that invest consistently in technology, talent, and institutional capability over the long term.

In doing so, professionalism ceases to exist merely as internal experience, and instead becomes something externally intelligible, verifiable, and accumulative within the market itself.

5.2 Enabling the Institutionalization of Capability

One of the longstanding structural challenges within the cybersecurity industry is that too much capability resides in individuals rather than in organizations.

A mature standards framework encourages service providers to gradually transform operational experience into methodologies, procedural systems, and talent development mechanisms — allowing capability to become reproducible, transferable, and continuously evolvable.

At its core, this represents a transition from competition based on individual expertise toward competition based on institutional capability.

5.3 Establishing Trust Across Global Collaboration

As cybersecurity services increasingly operate within cross-border and globally interconnected environments, what matters is no longer technology alone, but whether different markets can share a common language of trust.

Standards make service capabilities understandable across jurisdictions, verifiable to international clients, and interoperable within broader global collaboration networks.

In this sense, standards are not merely industry rules.

They increasingly function as a form of “circulating credibility” within the digital age itself.

Subscribe now

VI. What Does a Good Standard Mean for the Industry?

6.1 From Price Competition to Capability Competition

In the absence of shared standards, industries tend to compete through pricing pressure, scale expansion, and short-term market visibility, while genuine long-term capability becomes increasingly difficult to identify and reward.

The establishment of standards is therefore, at its core, an attempt to reconstruct the industry’s system of value recognition.

It redirects competition toward technical competence, service quality, organizational governance, and long-term delivery capability — rather than toward low-cost expansion and resource-driven competition alone.

6.2 Strengthening Collective Industry Credibility

No industry can mature sustainably without a stable foundation of public credibility.

As service quality, accountability structures, and professional capability become more transparently verifiable, low-quality services and disorderly competition can gradually be constrained, allowing the overall trustworthiness of the industry to improve.

Importantly, credibility does not accumulate solely at the level of individual firms. Over time, it evolves into an external perception attached to the industry as a whole.

An industry incapable of generating shared public trust ultimately struggles to achieve long-term institutional stability.

6.3 Building the “Trust Infrastructure” of the Digital Era

At a deeper level, the significance of cybersecurity service standards extends far beyond industry governance alone.

They are increasingly participating in the construction of the foundational order of the digital economy itself.

As global digital systems become more interconnected — and as organizational collaboration grows more dependent on cloud infrastructure, remote operations, and intelligent systems — security capability itself begins to function as part of the underlying infrastructure supporting modern society.

Standards, in this context, become the “trust protocols” that allow such infrastructure to operate in a stable and sustainable manner.

What they ultimately support is not merely the cybersecurity services market, but the long-term possibility of durable, scalable, and trusted collaboration within digital society itself.

VII. Why Hong Kong Could Become the Right Place

Hong Kong’s uniqueness lies not merely in geography, but in its ability to operate simultaneously across different institutional systems, markets, and international regulatory frameworks.

It possesses both a globally oriented legal and commercial environment and a longstanding position at the intersection between China and the broader international system. This gives Hong Kong a natural quality as an “institutional interface” — capable of enabling coordination and mutual recognition across different trust regimes.

And cybersecurity services are, by their very nature, an industry fundamentally dependent on mechanisms of trust.

As global digital collaboration continues to deepen, demand is rising for cross-regional recognition of professional capability, service standards, and assurance frameworks. In the future, competitive advantage may depend less on isolated technical capability than on the ability to establish a shared language of trust across markets.

Within this context, Hong Kong has the potential to become a critical platform for cybersecurity capability coordination in Asia.

Whether for Chinese companies expanding globally or international firms entering the Chinese market, the most durable form of connection is rarely commercial access alone. More often, it is the existence of standards that can be jointly recognized across different systems and markets.

Because standards, at their core, are never merely technical specifications.

They are coordination mechanisms designed to reduce institutional friction, cultural asymmetry, and the cost of trust itself.

Subscribe now

VIII. Conclusion

The future of cybersecurity may no longer be defined merely by competition in technical capability.

As digital society continues to evolve, the more decisive question will be who can consistently produce trustworthiness — not only demonstrating security capability itself, but enabling that capability to be understood, validated, and recognized across organizations, markets, and jurisdictions.

From this perspective, the value of standards extends far beyond technical specification.

Standards function as a shared language for complex digital societies, enabling stable cooperation across different systems of governance, markets, and institutions. And the deeper significance of standards alliances lies in their ability to construct long-term, adaptive, and continuously renewable mechanisms of trust.

Because in the digital age, the scarcest resource may not ultimately be technology itself.

But credibility.

THECOI

Want to explore the full analysis?
Download THECOI JOURNAL to read the complete article and discover more insights.

Get the full issue of THECOI JOURNAL here: https://www.the-coi.org/journal

Contact THE COI

info@the-coi.org

www.the-coi.org

www.linkedin.com/company/thecoi/

Share

🧭 Monthly Snapshot

China’s cybersecurity sector continued to evolve in Q2 2026, marked by growing overseas expansion, strategic investments, and capital market activity. Companies such as Chaitin Tech, Vinchin, and Zixun Technology advanced through investment and IPO initiatives, while industry reports highlighted AI-driven security growth and shifting market dynamics. Meanwhile, regulatory actions and listing challenges underscored the increasing importance of compliance and sustainable growth.

Read more

Beijing TDHX Technology Co., Ltd. (TDHX), a provider of industrial cybersecurity and energy digitalization solutions in China, saw its Hong Kong IPO prospectus expire on July 30, 2026, six months after its submission on January 30, 2026.

The company appointed CICC International and Orient Securities International as joint sponsors for its proposed listing.

Founded in August 2007, TDHX focuses on industrial cybersecurity solutions and energy digitalization services. According to Frost & Sullivan, TDHX ranked first in China’s industrial cybersecurity market by market share in 2024, with an overall market share of approximately 6.7%. In the energy sector, the company held a market share of approximately 8.4%.

TDHX provides customized cybersecurity solutions to protect industrial IT and operational technology (OT) assets, including networks, systems, data, applications, and devices, against cyberattacks, disruption, and unauthorized access.

The company also leverages AI-driven technologies to enhance security capabilities across industrial scenarios, while providing digital solutions for energy enterprises with capabilities including real-time monitoring, early risk detection, and operational optimization.

The expiration of the IPO prospectus does not necessarily mean the listing process has ended, as TDHX may submit an updated filing if it continues to pursue a Hong Kong listing.

Share

International Data Corporation (IDC) latest data shows that in 2025, the overall scale of China's public cloud anti-DDoS market reached 2.45 billion yuan, a year-on-year increase of 9.1%, with the industry showing an overall expansion trend. Market concentration is relatively high, with the combined share of two leading vendors, China Telecom and Alibaba Cloud, approaching 50%, leading the entire track. Customers are concentrated in high-value segments such as the internet, gaming, overseas expansion, and finance, with growth driven by cross-selling, overseas protection, and new AI security scenarios.

Analyst Views

IDC China Senior Research Manager Zhao Yi stated that in 2025, the domestic anti-DDoS market will generally take the initiative to clear out low-margin orders, accelerate product integration, phase out older versions, focus on 2.0 architecture and cloud-based high-defense solutions, streamline product categories, and prioritize edge security and enterprise standardized versions.

Share

Chengdu-based Vinchin has completed a new round of financing, with a strategic investment from an industrial fund managed by GALAXY CAPITAL, backed by a listed company.

The funding will support Vinchin’s continued investment in disaster recovery technology, product innovation, and global market expansion, strengthening its position in the rapidly growing data protection and cyber resilience market.

Founded in 2015, Vinchin focuses on data backup and disaster recovery solutions, providing data protection capabilities across cloud, virtual, physical, application, and SaaS environments. Its solutions cover data backup, business continuity, ransomware recovery, data verification, migration, replica management, data archiving, and compliance protection.

The company currently serves customers in more than 170 countries and regions, including China, the United States, Russia, Singapore, Germany, France, Italy, Spain, Poland, Mexico, and Türkiye. Its solutions have been deployed across government, healthcare, manufacturing, biotechnology, education, transportation, and financial sectors.

In China and overseas markets, Vinchin has accumulated a number of industry reference cases, including deployments for government cloud platforms, semiconductor companies, financial institutions, transportation organizations, and international enterprises.

According to Vinchin, the company has maintained steady business growth in recent years while continuously expanding its market presence. Its disaster recovery platform, Vinchin Disaster Recovery, supports major virtualization and cloud environments, including VMware vSphere, Microsoft Hyper-V, OpenStack, Proxmox VE, ZStack, Huawei FusionCompute, Sangfor HCI, SmartX, Oracle OLVM, XCP-ng, and other mainstream platforms.

Commenting on the investment, Mr. Chen Xin, Deputy General Manager of Investment at GALAXY CAPITAL, said:

“Amid the global digital transformation wave, China’s data backup and disaster recovery sector is entering a golden period of growth. We value Vinchin Technology primarily for two reasons. First, Vinchin has built strong technological capabilities to support China’s information technology innovation ecosystem amid a complex international environment. At this critical stage, the company has demonstrated independent and controllable R&D capabilities from underlying code to upper-layer applications, which is particularly important in today’s rapidly changing global market. For two consecutive years, Vinchin has been one of only two disaster recovery vendors from mainland China selected for Gartner Peer Insights’ disaster recovery category, demonstrating its strong technical capabilities and alignment with international standards. Second, Vinchin has achieved rapid growth in Southeast Asian markets and has become one of the leading Chinese companies expanding overseas in the data disaster recovery sector. Galaxy Securities’ business network covers more than 10 Southeast Asian countries and holds leading positions in multiple markets. Leveraging this network advantage, we will support Vinchin in accelerating its Southeast Asian market expansion and contributing to national strategic initiatives.”

With increasing demand for cyber resilience, ransomware recovery, and regulatory-driven data protection, the global disaster recovery market is entering a new growth phase. Through this strategic investment, Vinchin aims to further strengthen its technology capabilities, expand international partnerships, and accelerate the global adoption of Chinese-developed disaster recovery solutions.

Share