The €575,000 MTU award combines a cyber-range platform with support for the university’s existing OpenStack environment. Its June2025-to-February2026 procurement history provides a useful comparison for suppliers selling into education and industry training.
Munster Technological University awarded a €575,000 cyber-range contract to ATC-NY, Inc. in February 2026. The requirement includes the platform itself and support for the existing OpenStack environment on which it must run.
That second responsibility changes the commercial proposition. MTU was not simply comparing access to a training interface. It wanted a platform that could operate within infrastructure it already had, with the provider supporting both layers.
The procurement is a useful adjacent-market example for defense-facing cyber companies. The buyer is an Irish university, and its stated uses include student education, industry resilience assessment and training for cybersecurity personnel. The award establishes a particular institutional purchase, rather than a military sale.
MTU’s eTenders workspace records publication on 30 June 2025, a clarification deadline on 22 July and a tender deadline of 5 August. The TED result notice, published on 23 February 2026, records the winner’s selection on 9 February and contract conclusion on 17 February.
Those dates reveal a process extending well beyond the initial response window. They do not explain what happened in every intervening month, but they provide a more realistic reference for sales planning than using the announcement date alone.
The procurement portal also displays 20 February as its awarding date. That posting-related field should remain separate from the contract-conclusion date explicitly given in the result notice. An account history benefits from retaining both rather than forcing different events into one date.
The record identifies an open procedure and two received tenders. It does not establish why the winning offer prevailed or quantify the number of suppliers capable of serving the broader cyber-range market.
The result notice gives €575,000 as both the total awarded contract value and the winning tender value. The stated duration is five years.
Dividing the total by five would produce an arithmetic average. It would not establish equal annual payments, a standard subscription price or the supplier’s recognised revenue in a particular year. The public record does not provide that payment profile.
The same caution applies to comparing the figure with another platform’s licence cost. MTU’s requirement includes support for the host environment, so a software-only price would not describe an equivalent offering.
The notice also identifies a single public contract rather than a framework or dynamic purchasing system. The result therefore records a completed supplier selection for this requirement; it does not describe a continuing catalogue through which additional vendors can obtain later orders.
The useful commercial comparison is the bundle of responsibilities and its duration. A supplier evaluating a similar opportunity needs to understand the effort required to maintain the application, support the infrastructure and serve the customer’s intended uses over time.
The tender description says the cyber range must run on an existing OpenStack platform and that the provider must support that deployment as well as the range. This is a concrete constraint on the delivery model.
A company that normally offers a fully hosted service would need to establish whether its product and support organisation can operate in that setting. A product demonstration running in the vendor’s own environment would not, by itself, answer the question.
An infrastructure specialist could see a related commercial role, but the actual procurement result should not be rewritten as an open subcontract opportunity. The TED notice records no subcontracting for the awarded tender. It does not describe a later partnership process for outside firms.
The broader lesson concerns accountability. When an application and its host environment interact, the customer needs a clear route for diagnosing problems and restoring service. The university made support for both layers part of the requirement rather than leaving the boundary implicit.
MTU’s description includes experiential learning for cybersecurity students, controlled simulation, resilience testing for business and industry clients and training for their personnel. These uses share infrastructure while placing different demands on the service.
A teaching session may need a repeatable environment that can be reset for the next group. An industry engagement may require a scenario relevant to a particular organisation and an explanation of what participants learned. These are examples of differing service needs, not unpublished contractual requirements attributed to MTU.
The platform supplier therefore sits within a wider delivery chain. Instructors, scenario designers and customer-facing staff may contribute to the final learning experience. Buying the range does not automatically mean the platform vendor supplies every course or exercise conducted on it.
For a commercial team, that distinction helps identify the actual product. The customer can buy infrastructure, software, content and instruction through different relationships. A useful proposal states which of those responsibilities are included.
The university’s September 2025 maritime challenge report describes an event held with Cyber Innovate, the Irish Naval Service and the National Maritime College of Ireland. It used MTU’s existing cyber-range infrastructure for a simulated maritime scenario designed by Airbus.
The event predates the February 2026 contract. It should not be presented as a delivery outcome under ATC-NY’s later award or as evidence that the winning supplier created that exercise.
Its relevance is the customer context. MTU was already using cyber-range infrastructure in activities involving students, researchers and professional participants. The procurement therefore sits within an established training and research environment.
That context makes the support requirement more understandable. An institutional buyer with existing infrastructure and programmes has a continuity problem as well as a product-selection problem. A new agreement must fit an environment that already has users, expectations and ongoing activities.
In June 2025, MTU reported completion of its first Cyber Innovate cohort, with 12 participants finishing a programme focused on identifying cybersecurity problems and developing potential businesses.
This is evidence of the university’s wider innovation activity. It does not establish that the €575,000 cyber-range purchase is funded through that programme. The procurement notice explicitly records the purchase as not financed with EU funds, while the Cyber Innovate account describes its own co-funding arrangements.
Keeping those funding records separate matters. A university can run several connected initiatives without every purchase sharing the same budget or contractual purpose.
For suppliers, the wider ecosystem can still inform relationship research. The university may act as a purchaser, research partner, training provider and place where new companies develop. The relevant role depends on the specific engagement.
The procurement workspace labels the evaluation mechanism as the most economically advantageous tender. The short result notice does not provide a usable account of the detailed scoring that selected ATC-NY.
That leaves the commercial outcome clear and the competitive explanation limited. The winner, value, duration and support boundary are public. A claim that price, a particular feature or a unique technical advantage decided the award would require further evidence.
Estonia’s CR14 ecosystem offers a different cyber-range setting, while our CWIX analysis examines multinational integration evidence. These are related markets with different buyers and purposes.
MTU’s case is strongest as a comparison of delivery responsibilities. The university purchased a platform that must work within its existing environment and remain supported over a stated period. For cyber suppliers, that is a concrete reminder that the customer often buys a maintained capability, with the surrounding infrastructure forming part of the commercial obligation.
Primary documents read on 6 September 2026. Analysis distinguishes the cited policy, notice or event from independently confirmed delivery.
Suggest a correction