Summary

• Eye Security will pair HarfangLab's European EDR software with managed detection and response.
• The partners plan EU-based hosting and security operations and coexistence with compatible existing agents.
• The combined service is not yet generally available; beta and additional agent functions remain future steps.

Dutch cybersecurity provider Eye Security has agreed to combine French company HarfangLab’s endpoint detection technology with its managed security operations service, proposing a European-developed offering for organisations concerned about security performance and data control.

The companies announced the partnership on 27 October. A limited beta is planned for the fourth quarter of 2026, with wider availability expected in early 2027. Neither the full combined service nor the advertised agent-based extensions should be described as generally deployed.

Eye Security will provide monitored detection and response, while HarfangLab supplies endpoint software. The companies say they intend EU-based data hosting and European security teams, adding a possible choice for customers seeking to align technical and contractual arrangements with internal sovereignty requirements.

Integrating endpoint technology with response

Endpoint Detection and Response software monitors processes and activity on workstations and servers, helping analysts investigate suspicious changes and respond to possible intrusions. The effectiveness of such tools depends on telemetry coverage, detection engineering and the surrounding response procedures.

Managed Detection and Response adds analysts who review alerts and coordinate investigations. Businesses without a fully staffed internal security operations centre may use these services to obtain specialist monitoring across nights, weekends and holidays.

Combining the two functions can simplify coordination when the monitoring provider also understands the endpoint agent’s configuration and response controls. However, contractual responsibilities, escalation thresholds and customer approval requirements still need to be explicit.

Eye Security says HarfangLab’s EDR can coexist with compatible endpoint products already in an organisation. That may reduce the risks of immediate replacement, but running two agents on the same device can create resource conflicts, overlapping alerts or unexpected behaviour.

Performance testing must therefore cover actual customer software environments, including legacy applications and equipment on which uninterrupted service matters. Compatibility claimed during a demonstration does not guarantee every operating system or configuration is supported.

What European sovereignty does and does not guarantee

The partnership emphasises European software development, hosting and analyst teams. Those arrangements may help organisations that require geographic controls over security telemetry or have concerns about access by suppliers in other jurisdictions.

Security logs can contain account identifiers, employee activity and other personal information. Hosting in Europe is a relevant factor, but customers must still establish who processes the data, whether subcontractors have access and how any cross-border transfers are governed.

Ownership and location do not automatically prove that one platform is more secure than another. Independent product evaluation, response quality, software maintenance and the supplier’s ability to detect emerging threats remain important criteria.

HarfangLab cites national security assessments, including a German BSI BSZ certification and French ANSSI qualification for specified software. These credentials apply to defined assessment scopes and cannot simply be extended to every future function of the new combined service.

Eye Security says it protects more than 1,000 mid-market organisations through its wider services. That customer count should not be presented as successful deployments of the new joint product, which has not completed its planned broader release.

Agents introduce a different operating risk

Future integration with Eye Security’s agent-based security operations technology could support asset discovery, proactive hunting and more automated analysis. Those capabilities remain prospective and must be distinguished from the established monitoring functions.

Automation may reduce repetitive investigation work, but incorrect actions can disrupt legitimate services. Isolating a workstation, disabling a user account or changing a network rule can have consequences for an organisation if an alert is misclassified.

Good implementation requires permission boundaries, audit logs and escalation procedures that specify when a person must approve a consequential action. Software designed to defend systems should not receive unlimited authority simply because it operates within a security tool.

Customers also need evidence about pricing, service levels and performance under real incidents. The announcement does not provide independently tested results from a completed rollout or an established comparison with competing managed security products.

Previous Techopia coverage explored how operational permissions widen an enterprise AI attack surface. Similar governance considerations apply to AI-powered security automation.

The partnership announcement establishes the planned architecture and rollout sequence. Its commercial value will be clearer after beta testing, customer onboarding and disclosure of supported configurations and incident-response outcomes.

Prospective customers should document where responsibility passes between the software vendor, the managed service provider and their own IT team. A security incident may require rapid action against a business asset, and disagreement about authority can delay containment even when detection succeeds.

Technology sovereignty also concerns continuity if a supplier changes ownership, discontinues a product or alters support terms. Contractual access to data, export functions and replacement procedures can be as important as the headquarters address of the company selling the service.

Incident exercises conducted before deployment can reveal whether alert triage, customer notifications and emergency permissions work as expected. These operational tests are more informative than a list of available product modules.