Digital Sovereignty

A Sovereign Vendor Licences Back Its Own Code

CrowdStrike is buying XM Cyber's 45 patents and source code but no revenue and no customers. XM Cyber keeps trading on a licence back. Read what the March release already promised.

Digital SovereigntyBy Servola Tech Desk2026-07-174 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

A Sovereign Vendor Licences Back Its Own Code

Key takeaways

CrowdStrike will acquire more than 45 patents and the proprietary source code of XM Cyber while acquiring no revenue and no customers, and XM Cyber will keep operating as a standalone business on an intellectual property licence from CrowdStrike, so an XM Cyber customer's vendor will no longer own the code it ships.
Compare the two releases: in March 2026 CrowdStrike already promised Falcon on STACKIT with full attack path visibility, which is the capability XM Cyber's patents cover, and that March announcement never mentions XM Cyber at all.
The deal is presented as European sovereignty and is structured as an IP transfer out of a European group to a US vendor, with the European company continuing on a licence back.
If you buy exposure management from XM Cyber, add one question to your next renewal: who owns the code in this product, and on what terms does my vendor keep the right to ship it.

Two announcements, four months apart, describing the same capability

On 5 March 2026 CrowdStrike and Schwarz Digits announced a partnership. CrowdStrike would bring the Falcon platform to STACKIT, the sovereign cloud that Schwarz Digits operates inside the EU, with data residency and GDPR compliance as the selling point. The release described the collaboration as delivering the Falcon platform with full attack path visibility on infrastructure fully operated within the EU. Schwarz Group companies would consolidate their own security onto Falcon, and the two sides floated joint work on a secure enterprise browser and an AI-based SIEM.

That March release does not mention XM Cyber once.

On 16 July 2026 the two companies expanded the partnership. CrowdStrike signed a definitive agreement to acquire the intellectual property of XM Cyber, a Schwarz Digits company known for attack path visualisation and offensive simulation. The thing CrowdStrike promised to deliver in March is the thing whose patents it agreed to buy in July, and in March those patents sat inside its partner's own group.

What is actually being bought

The wording in the July release is unusually plain, and worth reading exactly as written. At closing, CrowdStrike will acquire XM Cyber's intellectual property, including more than 45 patents and proprietary source code, and will not acquire any revenue or customers. XM Cyber will continue operating as a standalone business with an intellectual property licence from CrowdStrike.

Strip the framing and the structure is clean. The buyer takes the patents and the source. The seller keeps the customers, the revenue and the going concern, and rents back the right to use what it just sold. No financial terms are disclosed. The transaction is expected to close in the second half of CrowdStrike's fiscal year 2027 and remains subject to regulatory approval.

This is how you buy a capability without buying a business. It is a legitimate and increasingly common shape. It is also a shape that leaves the acquired company's customers in a position most of them have never had to price.

The question an XM Cyber customer now owns

If you are running XM Cyber for exposure management and attack path analysis, nothing changes on your invoice, and that is precisely why this is easy to miss. The company you contracted with continues. Your renewal arrives from the same vendor. Support answers the same phone.

What changed is underneath. Your vendor no longer owns the source code of the product you run, and its right to keep shipping that product now derives from a licence granted by a company that sells a competing platform. Every question you would normally ask about roadmap, about which features get built, about how long a product line stays supported, now has an additional party in the answer, and that party is not on your contract.

The practical instruction is narrow and worth doing before the deal closes rather than after. At your next renewal, ask the vendor to state in writing who owns the intellectual property in the product, what the term and scope of any inbound licence is, what happens to your deployment if that licence lapses or is not renewed, and whether source code escrow is available. These are ordinary procurement questions. They are simply questions that did not previously have interesting answers for this product.

Sovereignty in the framing, transfer in the structure

The deal is wrapped in the language of European independence, and part of that wrapping is real. A phased roadmap will deliver Falcon on STACKIT, sovereign cloud infrastructure operated within the European Union. The release names the EU Cyber Resilience Act and NIS2 as the regulations raising the bar for operators of critical infrastructure in Europe. For a regulated European enterprise, running a leading security platform on EU-operated infrastructure is a genuine improvement on running it elsewhere, and data residency is not nothing.

But sovereignty claims should be tested against ownership, not against hosting. The residency of the servers is improving. The ownership of the intellectual property is moving in the other direction: more than 45 patents and the source code of a European group's security company transfer to a US vendor, and the European company continues on a licence from the acquirer. Both of those things are true at once, and only one of them is in the headline.

The useful lesson generalises past this deal. When a vendor offers you sovereignty, establish which layer it applies to. Sovereign hosting tells you where the data sits. It does not tell you who owns the code, who can withdraw the right to run it, or which jurisdiction's company holds the patents. Those are separate questions with separate answers, and a deal can improve the first while quietly reversing the third.

Frequently asked questions

Does XM Cyber stop selling its product?

No. CrowdStrike's release states XM Cyber will continue operating as a standalone business with an intellectual property licence from CrowdStrike, and that CrowdStrike will not acquire any revenue or customers.

How much is CrowdStrike paying?

No financial terms are disclosed in the announcement. The transaction is expected to close in the second half of CrowdStrike's fiscal year 2027, subject to regulatory approval.

Does this affect where my data is stored?

Separately from the IP purchase, the expanded partnership sets out a phased roadmap to deliver the Falcon platform on STACKIT, Schwarz Digits' sovereign cloud infrastructure operated within the European Union. Data residency and the ownership of the software are different questions, and this announcement moves them in different directions.

Hosting tells you where your data sleeps and ownership tells you who can change the locks, and a European company that has sold its patents and licensed them back has answered only the first question for its customers.

CrowdStrikeXM CyberSchwarz DigitsSTACKITsovereign cloudNIS2Cyber Resilience Act

Coca-Cola Stopped Production, Filed 'Other Events'

Coca-Cola halted all US fairlife production after a ransomware event and told the SEC that materiality was not yet determined. Under NIS2, awareness starts a 24-hour clock.

7 min read

Cybersecurity

Eleven Signed Bootloaders Can Bypass Secure Boot

ESET found eleven old Microsoft-signed bootloaders that slip past Secure Boot on almost any PC, with no admin rights needed. Patching them is the easy part. Here is the exposure most fleets never audit.

3 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.

2 min read

← All articles