China orders firms to stop using US and Israeli cyber tools in move critics call a China cybersecurity software ban
Beijing ordered domestic firms to stop using cybersecurity software from more than a dozen U.S., Israeli and other foreign vendors, citing national security risks including potential overseas data transmission — a move critics call a China cybersecurity software ban.
Key takeaways
- Chinese regulators reportedly instructed some domestic firms to discontinue certain foreign cybersecurity products due to national security concerns.
- Named vendors include major U.S. and Israeli firms such as VMware, Palo Alto Networks, Fortinet, CrowdStrike, Check Point and others.
- Official silence from Chinese authorities and limited company responses leave enforcement, timelines and the full list unclear.
- Broader impact may include revenue shifts, supply‑chain disruption and faster domestic substitution in critical tech areas.
Main content
New directive and scope
Recent reporting says Chinese regulators warned that some foreign cybersecurity tools could collect confidential information and transmit it overseas, posing national security risks. The instruction, issued in recent days, urged organizations to shift toward locally developed cybersecurity products and services.
Reports did not provide a full public list or disclose how many Chinese firms received the notice. Sources described the disclosure to reporters via anonymous channels, leaving many operational details unspecified.
Which companies were cited
Media reports named a range of well‑known security vendors. U.S. firms reported include VMware (owned by Broadcom), Palo Alto Networks, and Fortinet, as well as specialist firms such as CrowdStrike, SentinelOne, Recorded Future, McAfee, Claroty and Rapid7. Google‑owned Mandiant was listed. Israeli companies reported include Check Point Software Technologies, CyberArk, Orca Security and Cato Networks. Imperva, which has been linked to French defense company Thales, was also named.
Media reports emphasized the list was reported via anonymous sources and did not include an official, fully enumerated roster.
Official silence and company responses
Regulators such as the Cyberspace Administration of China and the Ministry of Industry and Information Technology had not publicly commented on the directive at the time of reporting. News outlets noted that the named companies had not issued public responses to inquiries, leaving timelines, enforcement measures and penalties unclear.
Context: China cybersecurity software ban and US‑China tech tensions
Analysts view the instruction as part of a broader pattern of decoupling and defensive tech measures by Beijing, aimed at boosting domestic suppliers across semiconductors, cloud services and cybersecurity amid ongoing US‑China tensions. The development arrives amid complex policy shifts, including adjustments to U.S. export controls on certain AI chips.
Security concerns and practical reasons cited
Officials are reportedly concerned that foreign cybersecurity products — which often have deep visibility into logs, credentials and configurations — could be exploited to leak or access sensitive data outside China. Supporters of the move argue that favoring domestic tools reduces external exposure and increases national control over critical infrastructure protection.
Diplomatic backdrop
Observers note the timing overlaps with broader diplomatic and commercial developments. Some reports connected the directive to rising strategic competition and diplomatic engagement, including discussions ahead of a planned visit by U.S. President Donald Trump to Beijing in April 2026.
Uncertainties and open questions
- Enforcement: How strictly will the order be applied and which sectors will be prioritized?
- Timelines and penalties: Reports did not specify grace periods or consequences for noncompliance.
- Operational impact: Replacing complex security tools can be costly and may create short‑term vulnerability gaps.
Implications for the world
Economic: Compliance could shift significant contracts away from affected vendors, affecting revenues and accelerating competition for alternative suppliers.
Political: The move deepens tech tensions and may prompt diplomatic responses or countermeasures from affected countries.
Social and operational: Firms in China could face temporary security gaps during migration to domestic tools; international vendors must reassess contracts and data flows.
Reporting and sources
This article draws on reporting from multiple outlets that cited anonymous Chinese sources and industry information about the directive and the companies named. Primary sources include Fox Business, The Jerusalem Post, The Japan Times, and Table.media. Reuters also reported on the development citing anonymous sources.
Note: Chinese regulators did not issue a public statement and the full official list, enforcement timelines and company confirmations were not publicly available at the time of reporting.
