China's Military Is Quietly Banning Its Own Cybersecurity Companies

Key points

• China's military is blocking several of the country's top cybersecurity companies from winning government defence contracts.
• The bans stem from non-technical concerns, not product failures or breaches.
• The move signals a deepening trust problem between China's state institutions and parts of its private tech sector.
• SecurityWeek first reported the pattern of procurement restrictions in 2025.

China's military is cutting off some of the nation's leading cybersecurity businesses from defence contracts, a development first reported by SecurityWeek that points to something unusual: the firms did nothing technically wrong. Products didn't fail. Systems weren't breached.

The Chinese People's Liberation Army runs a procurement system, meaning a formal process for buying goods and services, that can bar companies for reasons beyond pure performance. Those reasons here appear to be political or structural. The exact grounds for each ban haven't been made fully public, but multiple well-known Chinese cybersecurity companies now find themselves locked out of one of the most valuable customer relationships a domestic firm can hold.

Why should anyone outside China care about this?

The companies involved sell products and services globally. When a government signals it doesn't fully trust a firm it once backed, buyers everywhere have reason to ask questions. What do the military buyers know that the rest of us don't?

There's a broader pattern worth watching. Governments in the United States and the European Union have spent recent years scrutinising which technology companies they allow into sensitive infrastructure. China's internal procurement bans fit that same story from an unexpected angle. Our 14 July report found that most boards still can't quantify the financial damage a vendor failure would cause them, and this case adds a geopolitical dimension most vendor-risk frameworks weren't built to handle.

For buyers of cybersecurity products, whether a small business owner choosing antivirus software or a hospital IT manager picking a firewall, the country of origin and the political standing of a vendor now carry real weight alongside the technical specs. Organisations using any product from a Chinese vendor should check whether that vendor appears on updated government restricted or watch lists in their own country. That's basic supply-chain hygiene: a regular check on where your software comes from and whether the maker remains trustworthy.

Should you worry?

No CVE applies here, and no patch fixes this. The risk is reputational and geopolitical, and while those move slower than exploit code, they cut just as deep. The judgment call worth making now: if a vendor's own government won't buy what it sells, that fact belongs in your procurement checklist, not your footnotes.