Poland's Central Bank Buys an Automated Penetration Testing Tool for PLN 830,645 in a Fast Track Tender With One Bid

Standfirst

A central bank has to find the weak points in its own systems before anyone else does. Narodowy Bank Polski has contracted CumulusIT Sp. z o.o. to supply and deploy software that tests its defences automatically. The tender used a shortened deadline and drew a single bid of PLN 830,645.00 gross.

Introduction

Penetration testing means simulating attacks on a network to find weaknesses. Done by hand it takes skilled people and time. Automated tools run many tests repeatedly and report what they find. For an institution such as a central bank the aim is to find problems early and to repeat the check often.

Narodowy Bank Polski or NBP bought such a tool as software on a 12 month subscription with technical support. The package also includes a technical design and installation and configuration and documentation and training workshops. Support services follow. The notice classes the contract as services and not as supplies.

The notice describes the purchase in detail but says nothing about the product chosen or the systems to be tested. This article reports only what the notice states.

Why This Contract Matters

The contract shows how a financial institution buys security tooling. It is bought as a subscription with a bundle of services and not as a plain licence. The buyer also takes ownership of the design and the as built documentation through a transfer of copyright.

It also matters for its procedure. The tender was marked accelerated and the notice explains why. That is rare in software purchases and it shows the buyer planned the timing ahead.

Contract Timeline

• 21/01/2026: a prior information notice was published as 44488 2026.
• 26/10/2026: the winner was chosen.
• 02/11/2026: the contract was concluded.
• 10/11/2026: the notice was dispatched.
• 11/11/2026: the notice was published.

The contract was signed 7 days after the winner was chosen (editorial calculation). The notice was dispatched 8 days after signature and published 9 days after signature (editorial calculations). The required performance period is up to 15 months from signature. That points to an end around 02/02/2028 (editorial projection). The subscription and support run for 12 months. Bids stayed binding until 28/12/2026.

Contract Overview

The notice records one lot and one winner. The buyer ran an open procedure under the Polish public procurement act. The scope is delivery and deployment of software for automatic penetration testing with services around it.

The notice lists six parts of the delivery. They are a technical design and a 12 month licence subscription and 12 months of manufacturer technical support. Installation and configuration come next followed by as built documentation and post deployment workshops. A separate item covers maintenance support services.

Key Contract Details

Project Scope

The scope has two layers. The first is the tool itself delivered as a subscription for 12 months with manufacturer support. The second is the work to make it usable. That includes a technical design and installation and documentation and training for the bank's staff.

The notice gives no product name and no list of systems to be tested. It does not say how many users or targets are covered. The detailed terms sit in an annex to the tender specification that the notice does not reproduce. The contracting authority has not disclosed this information.

About the Contracting Authority

Narodowy Bank Polski is classed as a body governed by public law with economic affairs as its activity. It sits at ulica Świętokrzyska 11 21 in Warsaw. The notice names it as buyer and as the party that signs the contract. Tenders went through the bank's own purchasing platform which required an account on the MarketPlanet system.

About the Organisations Involved

The notice names five organisations.

CumulusIT Sp. z o.o.

The winner is based in Warsaw at ulica Nowy Świat. The notice classes it as a micro or small or medium company. Its tender ranked first and was not a variant. It declared no subcontracting. The notice does not describe its business.

Narodowy Bank Polski

The buyer and the signing party.

Krajowa Izba Odwoławcza

The National Appeals Chamber is the review organisation and the source of information on review procedures. It sits at ulica Postępu 17A in Warsaw.

Sąd Polubowny przy Prokuratorii Generalnej Rzeczypospolitej Polskiej

The Arbitration Court at the General Counsel to the Republic of Poland is named as the mediation organisation. It sits in Warsaw.

Publications Office of the European Union

This body acted as the TED eSender and has no role in the award.

Procurement Analysis

NBP used an open procedure and marked it as accelerated. The notice gives two reasons. The first is that bids were filed fully by electronic means which allows a deadline five days shorter than the standard period. The second is that the bank had already published a prior information notice in January 2026 at least 35 days and not more than 12 months before sending the call. That also allows a shorter deadline (as stated in the notice). The procedure was therefore planned.

Only one tender arrived. It came from a micro or small or medium firm in Poland. The lowest and highest admissible tenders are the same figure. The price rule gave 100% to gross price so with one bid the rule decided nothing. The notice also says the buyer plans to use a procedure that allows offers to be assessed before checking grounds for exclusion (editorial reading of article 139 as cited).

The values need care. The estimated value of PLN 789,535.01 is stated without VAT. The tender of PLN 830,645.00 is a gross price including VAT. The two cannot be compared directly. The tender is PLN 41,109.99 above the net estimate if compared as they stand (editorial calculation). If the standard Polish rate of 23% applies the net equivalent of the tender is about PLN 675,321 which is 14.5% below the net estimate (editorial calculation). The notice does not state the VAT rate so this is only a guide.

The notice sets several conditions on bidders. They had to hold no grounds for exclusion under national law and under the EU sanctions measures linked to Russian aggression. They had to hold a qualified electronic signature. A certificate under the new Polish contractor certification act could replace some documents. The buyer also barred goods and services from countries outside the Government Procurement Agreement and other trade agreements on pain of rejection and set the origin of a service by the origin of its provider.

The review route is detailed. Appeals go to the National Appeals Chamber on any unlawful act or omission including a draft contract clause. The deadlines follow the rules for contracts above EU thresholds. A complaint against a chamber ruling goes to the Warsaw regional court within 14 days of delivery of the ruling.

Additional Procurement Facts

• The estimate is net while the award criterion and tender are gross.
• A bid bond of PLN 15,000 was required.
• Bids stayed binding until 28/12/2026.
• The place of performance block appears twice with identical content.
• No strategic procurement aim is stated.
• The bank lists a whistleblower procedure in its public information bulletin.
• The notice records no complaint statistics.

Market and Industry Perspective

Automated penetration testing is a niche inside the wider cyber security market (editorial analysis). Buyers use it to test more often and at lower cost than with manual teams. A single bid for a PLN 0.8 million subscription fits a field where products and local partners are limited. The notice does not say whether the winner is a reseller or a developer.

The winner is a Warsaw firm. Local integrators often hold the contract role while a foreign vendor supplies the software (editorial analysis). The notice records the manufacturer support requirement but does not name any manufacturer.

Economic Significance

At about PLN 0.83 million the contract is small for a central bank. Its importance lies in the risk it addresses. A gap in security testing can lead to far larger costs. The notice gives no figures on that exposure.

The money flows to a Polish company. Whether any share flows to a foreign vendor is unknown because the notice records no subcontracting.

Future Procurement Opportunities

Subscriptions expire. The licence and support run for 12 months and the contract allows up to 15 months in total. A renewal or a new tender will be needed after that (editorial analysis). The notice gives no renewal terms. Related services such as manual testing and training and wider security monitoring may be bought separately.

Opportunities for Suppliers

Cyber security vendors and integrators can watch NBP tenders on its purchasing platform. The prior information notice route shows that the bank signals needs months ahead. Suppliers should read such notices early and prepare qualified signatures and platform accounts before a tender opens.

What Businesses Should Watch

Watch for the next prior information notice from NBP. Watch for the renewal of this subscription. Watch also for related purchases of testing and monitoring services.

Poland Procurement Intelligence

This award reflects a trend toward buying security capability as a subscription with services attached. The buyer gets a tool and the skills to run it. It also takes ownership of the design and documentation which reduces dependence on the supplier.

The lesson for suppliers is that early notices matter. A prior information notice lets bidders prepare and lets the buyer shorten the deadline. A firm that waits for the call has less time than one that watched the earlier signal.

Future tenders may use the same pattern of a prior notice followed by an accelerated call (editorial analysis).

Supplier Takeaways

• A prior information notice allowed a shorter bid deadline.
• Gross price alone decided the award.
• Qualified electronic signatures and a platform account were required.
• Copyright in the design and documentation passes to the bank.

Key Takeaways

• CumulusIT Sp. z o.o. won at PLN 830,645.00 gross.
• One tender was received.
• The procedure was accelerated and followed a prior information notice.
• The estimate is net and the tender is gross.

Conclusion

The National Bank of Poland has secured an automated penetration testing tool with services from a single Warsaw bidder. The notice explains its accelerated route and its conditions clearly but leaves the product and the scope of testing undisclosed. Suppliers should read it as a model of how a careful public buyer in finance packages cyber security tooling.

Source: Tenders Electronic Daily (TED), Contract Award Notice 784805 2026, Official Journal of the European Union, OJ S issue 219/2026, published on 11/11/2026.