Italy's CDP Group Awards Ethical Phishing Platform Contract to Accenture

Standfirst

Cassa Depositi e Prestiti, the Italian state development bank, has awarded a contract for an ethical phishing software platform to Accenture SpA. The contract is worth EUR 556,230 and runs for 90 months, making it a long-term commitment to simulated cyber attack testing across the CDP Group. Five bidders submitted offers through the official procurement portal, and the contract was awarded on the most economically advantageous tender. The platform will be used to test how employees respond to phishing attempts and to strengthen the group's human firewall.

Introduction

Most cyber attacks do not begin with a technical exploit. They begin with a person. An employee receives an email that looks like it comes from a colleague, a supplier or a bank. The email asks them to click a link, open an attachment or confirm a payment. If the employee complies, the attacker is inside the organisation. That technique is called phishing, and it remains one of the most effective ways into a corporate or public sector network.

Defending against phishing is not only a technical problem. Firewalls and email filters catch many attempts, but some always get through. The last line of defence is the employee, and employees can be trained. That is where ethical phishing comes in. An ethical phishing platform allows an organisation to send simulated phishing emails to its own staff, measure who clicks, and use that data to target training where it is needed most. The goal is not to punish employees but to build awareness and resilience.

Cassa Depositi e Prestiti, known as CDP, is Italy's national promotional institution. It is a state-controlled body governed by public law that finances infrastructure, supports Italian businesses and manages public savings. Its group includes subsidiaries operating across finance, infrastructure, venture capital and advisory services. For an institution of that kind, protecting systems and data is not optional. CDP has now awarded a contract for an ethical phishing platform to Accenture SpA.

This article explains what was procured, who was involved, how the procurement was structured and what the award signals for suppliers in the Italian public sector cybersecurity market.

Why This Contract Matters

This contract matters because it addresses one of the most persistent vulnerabilities in any large organisation: the human factor. Technical defences can be strong, but a single successful phishing email can give an attacker access to systems, data and funds. An ethical phishing platform allows CDP to test its own staff continuously and to measure whether its security awareness training is working.

It also matters because of its duration. The contract runs for 90 months, which is seven and a half years. That is an unusually long term for a software platform contract, and it signals that CDP views ethical phishing as a permanent capability rather than a one-off project. Over seven and a half years, the platform will be used repeatedly to test employees across the CDP Group, and the data it generates will inform the group's security training and policy.

The contract also matters because of its scope. The title refers to the "Gruppo CDP" — the CDP Group — not just the parent company. That means the platform will be used across CDP and its subsidiaries, covering a wider population of employees and a more complex organisational structure. Group-wide security testing is more demanding than single-entity testing, because different entities may have different systems, different policies and different risk profiles.

Finally, the contract matters because of the competition. Five bidders submitted offers, which is a healthy level of competition for a specialist security procurement. It shows that the Italian market for ethical phishing platforms is competitive, and that suppliers were willing to invest in bidding for a long-term contract with a major public financial institution.

Contract Timeline

• Contract concluded: 9 October 2026
• Notice dispatched: 9 October 2026
• Notice published: 13 October 2026
• Contract duration: 90 months

Contract Overview

The contract covers the supply of an ethical phishing software platform as a service for the CDP Group. It is a services contract, classified under CPV 72210000 (programming services of packaged software products).

It is a single-lot procurement, identified as LOT-0001. The place of performance is Roma, postcode 00198, in the Roma NUTS region (ITI43), Italy. The estimated value excluding VAT was EUR 628,464, and the awarded value was EUR 556,230.

The procurement was conducted as an open procedure under Article 71 of Italian Legislative Decree No. 36/2023, which is Italy's public contracts code. The legal basis is Directive 2014/24/EU. The contract is not a framework agreement and does not use a dynamic purchasing system. It is not financed with EU funds and is not covered by the Government Procurement Agreement.

The contract duration is 90 months. The notice does not disclose a start date, but the contract was concluded on 9 October 2026, so it is likely to run into 2033 or beyond. The award criterion was the most economically advantageous tender, which means quality and price were both evaluated, though the notice does not disclose the weighting between them.

Key Contract Details

Project Scope

The scope is an ethical phishing software platform for the CDP Group, delivered as a service. The notice describes the subject in Italian as "l'affidamento in servizio di una piattaforma software in ambito ethical phishing per il Gruppo CDP" — the award of a service for a software platform in the field of ethical phishing for the CDP Group.

Ethical phishing platforms typically provide several core capabilities. They allow the buyer to design and send simulated phishing emails that mimic real attack techniques. They track which recipients open the email, click the link, enter credentials or report the attempt. They generate reports and dashboards that show click rates by department, by location or by individual. They integrate with security awareness training so that employees who fall for a simulation can be enrolled in targeted learning. Some platforms also include vishing simulations, smishing simulations and other social engineering techniques.

The notice does not describe the specific functional requirements, the number of users, the volume of simulations, the integration requirements with CDP's existing systems, or the technical architecture. Those details would be in the procurement documents, which are not included in the TED notice. The contracting authority has not disclosed this information.

The notice also does not disclose whether the platform will be hosted by the supplier or on CDP's own infrastructure, or how the service will be delivered across the different entities in the CDP Group. The contracting authority has not disclosed this information.

About the Contracting Authority

The buyer is Cassa Depositi e Prestiti S.p.A., known as CDP. It is classified as a body governed by public law, with economic affairs as its main activity. Its registration number is 80199230584, and its address is in Roma, postcode 00185, in the Roma NUTS region (ITI43). Its email address is cdpspa@pec.cdp.it, and its telephone number is 0642211.

CDP is Italy's national promotional institution. It was established in 1850 and has evolved into a state-controlled financial institution that supports the Italian economy through a range of activities. It finances public infrastructure, supports small and medium-sized enterprises, invests in strategic sectors, and manages public savings through postal savings products. It also manages public sector financial resources and acts as a financial adviser to government bodies.

The CDP Group includes a number of subsidiaries and participations, covering areas such as infrastructure financing, equity investment, venture capital, real estate, advisory services and technology. The group is large, complex and systemically important to the Italian economy, which makes its cybersecurity a matter of public interest as well as corporate interest.

CDP is both the buyer and the organisation responsible for the procurement. It defined the requirements for the ethical phishing platform, ran the open procedure, evaluated the five bids and concluded the contract with Accenture SpA. It will use the platform across the group to test and improve staff resilience to phishing attacks.

About the Organisations Involved

Cassa Depositi e Prestiti S.p.A.

CDP is the contracting authority. It is Italy's national promotional institution, a body governed by public law with economic affairs as its main activity. Its role in this procurement is as buyer and manager of the contract.

It is registered in Roma, with registration number 80199230584. It operates across a wide range of financial and advisory activities, and it is the parent of the CDP Group, which is the beneficiary of the ethical phishing platform.

CDP's decision to procure an ethical phishing platform reflects the growing importance of human-factor security in financial institutions. Banks and development banks are attractive targets for cyber attackers, and phishing is one of the most common ways into their systems.

Accenture SpA

Accenture SpA is the winning bidder. It is classified as a large economic operator. Its registration number is 13454210157, and its address is in Milano, postcode 20154. Its email address is accenture@legalmail.it, and its telephone number is 02 77751111.

Accenture is a global professional services company with a large presence in Italy. It provides consulting, technology and operations services across many sectors, including financial services, public sector and defence. Its Italian subsidiary submitted the winning tender for LOT-0001, valued at EUR 556,230. It declared subcontracting as "not yet known," meaning it has not been determined whether any part of the work will be subcontracted.

Accenture's role is as tenderer and winner of LOT-0001. It will provide the ethical phishing platform as a service to the CDP Group over the 90-month contract term. The notice does not disclose which specific platform or technology Accenture will use, whether it will provide its own platform or resell a third party product, or how the service will be delivered. The contracting authority has not disclosed this information.

It is worth noting a data issue in the notice. Accenture SpA is recorded with a registered address in Milano, but the notice's organisation section records its country subdivision (NUTS) as Roma (ITI43) rather than Milano. That appears to be an error. The contracting authority has not explained this inconsistency.

TAR Lazio Roma

The Tribunale Amministrativo Regionale per il Lazio, Roma section, is listed as the review organisation and the organisation providing more information on review procedures. Its registration number is 80195990587, and its address is in Roma, postcode 00185. Its email address is rm_pat_deposito@pec.ga-cert.it, and its telephone number is 06 328721.

The TAR Lazio is the regional administrative court that hears challenges to public procurement decisions in Lazio, including those by central government bodies and public law entities based in Rome. Suppliers that believe the procurement was conducted improperly can bring a case before the TAR. No complaints were recorded in this procurement.

Other organisations

The notice does not identify the four non-winning bidders by name. It records that five tenders were received, all submitted electronically, but only the winner is named. No consortium members, framework participants or subcontractors are disclosed. No other organisation materially affects the understanding of this award.

Procurement Analysis

The procurement was conducted as an open procedure under Article 71 of Italian Legislative Decree No. 36/2023. The open procedure is the standard route for a contract of this size and allows any qualifying supplier to bid.

The award criterion was the most economically advantageous tender, known in Italian as "offerta economicamente più vantaggiosa." That means the evaluation considered both quality and price, though the notice does not disclose the weighting between them. In most Italian public procurement for technology services, quality carries a significant weight, often 60% to 70%, with price accounting for the remainder. But the notice does not confirm the weighting in this case. The contracting authority has not disclosed this information.

Five bids were received, all submitted electronically. That is a healthy level of competition for a specialist security procurement. It suggests that the requirements were clear enough for multiple suppliers to bid, and that the contract terms were attractive enough to justify the cost of bidding.

The winning bid of EUR 556,230 came in below the estimated value of EUR 628,464. The awarded value is approximately 88.5% of the estimate. That is a modest reduction, and it suggests that the estimate was realistic and that competition brought the price down slightly.

The contract duration of 90 months is notable. Seven and a half years is a long commitment for a software platform service, and it means the supplier will need to sustain the platform, update it against evolving phishing techniques, and support the CDP Group over a long period. For CDP, the long term provides continuity and avoids the administrative burden of frequent re-procurement. For the supplier, it provides a predictable revenue stream and an opportunity to build a deep relationship with a major public financial institution.

The contract is not covered by the Government Procurement Agreement. The notice does not explain why, but the contract is below the GPA threshold for services in most cases, which may explain the exclusion. The contract is also not financed with EU funds.

The winning bidder declared subcontracting as "not yet known." That means Accenture has not yet determined whether it will subcontract any part of the work. If it does subcontract, the value, percentage and identity of the subcontractors are not disclosed in the notice. Suppliers in the security and training ecosystem may wish to watch for further disclosure.

The notice does not disclose the estimated value of individual service components, the number of users covered by the platform, or how the service will be delivered across the different entities in the CDP Group. The contracting authority has not disclosed this information.

Additional Procurement Facts

• Legal basis: Directive 2014/24/EU and Italian Legislative Decree No. 36/2023, Article 71.
• Procedure: Open procedure, not accelerated.
• Award criterion: Most economically advantageous tender.
• Number of bids: 5, all submitted electronically.
• Estimated value: EUR 628,464 excluding VAT.
• Awarded value: EUR 556,230.
• Contract duration: 90 months.
• EU funding: The procurement project is not financed with EU funds.
• GPA: Not covered by the Government Procurement Agreement.
• Framework agreement: None.
• Dynamic purchasing system: None.
• Subcontracting: Recorded as "not yet known."
• Review body: TAR Lazio Roma.
• Data note: The notice records Accenture SpA with a registered address in Milano but a NUTS classification of Roma (ITI43), which appears to be an inconsistency.

Market and Industry Perspective

The market for ethical phishing and security awareness platforms has grown substantially over the past decade. As cyber attacks have become more sophisticated and more frequent, organisations have recognised that technical defences alone are not enough. Employees need to be trained, tested and retrained. That has created a market for platforms that simulate attacks and measure human behaviour.

The market includes specialist vendors, such as KnowBe4, Cofense, Proofpoint and GoPhish, as well as larger security companies and consultancies that offer ethical phishing as part of a broader service. In Italy, this market is served by a mix of international vendors, Italian security specialists and large integrators like Accenture.

This procurement reflects the growing importance of human-factor security in the financial sector. Banks, development banks and other financial institutions are attractive targets for cyber attackers because they hold funds, personal data and commercially sensitive information. Regulators across Europe have increased their expectations for operational resilience, including cyber resilience, and phishing simulation is one of the tools that institutions use to demonstrate that they are managing the human risk.

The 90-month duration is notable in this context. A seven-and-a-half-year commitment to an ethical phishing platform suggests that CDP views this as a permanent capability rather than a short-term project. That is consistent with the way mature security organisations operate: phishing simulation is continuous, not episodic, and the data it generates informs ongoing training and policy.

The group-wide scope is also notable. CDP is not just buying a platform for its own employees. It is buying a platform for the CDP Group, which includes subsidiaries across finance, infrastructure and advisory services. A group-wide deployment is more complex than a single-entity deployment, because it must accommodate different systems, different policies and different employee populations. Suppliers bidding for similar contracts should be able to demonstrate group-wide deployment capability.

The use of the most economically advantageous tender criterion is standard for Italian public procurement of technology services. It allows the buyer to weigh quality against price and to select the bid that offers the best overall value, not just the lowest cost. The notice does not disclose the weighting, but the fact that Accenture won against four other bidders suggests that its combination of quality and price was the most competitive.

Economic Significance

At EUR 556,230 over 90 months, this contract represents an annual value of roughly EUR 74,000. That is a modest contract in absolute terms, but its economic significance lies in what it protects: the systems, data and funds of Italy's national promotional institution.

A successful phishing attack on CDP could have consequences far beyond the value of this contract. It could compromise sensitive financial data, enable fraudulent payments, disrupt operations or damage the institution's reputation. The cost of such an incident, in financial terms and in trust, would be far greater than the cost of the platform. The contract is therefore a small investment in protecting a large and systemically important institution.

The contract also has a direct economic effect. The money flows to Accenture SpA, a large Italian company, and through it to any subcontractors or technology partners. Because the winner declared subcontracting as "not yet known," it is not clear how much of the economic benefit will be retained by Accenture and how much will flow to other companies.

The long duration of the contract gives the supplier a predictable revenue stream over seven and a half years. That is economically significant for Accenture's Italian business, and it provides a stable base for investment in the platform and the team that supports it.

The contract also has an indirect economic effect through improved security. A more cyber-resilient financial institution is better able to serve its clients and to support the Italian economy. CDP's role in financing infrastructure and supporting businesses means that its operational continuity has economic value beyond its own balance sheet.

Future Procurement Opportunities

The most obvious future opportunity is the renewal of this contract when the 90-month term ends. That will be in the early 2030s, depending on the exact start date. Suppliers should monitor CDP's procurement activity as that date approaches.

There may also be opportunities arising from the broader security awareness and training needs of the CDP Group. If the ethical phishing platform is successful, CDP may wish to expand its security awareness programme to include additional capabilities, such as vishing or smishing simulation, deeper analytics or more extensive training integration. Those could be procured separately or added to the existing contract.

More broadly, CDP and its subsidiaries have ongoing cybersecurity needs beyond phishing simulation. Suppliers with capability in security testing, incident response, threat intelligence or security training should monitor CDP's procurement activity for related opportunities.

Other Italian public financial institutions and state-controlled entities have similar needs. Suppliers with a successful reference at CDP will be well positioned to bid for their work. The Italian public procurement portal and TED are the best sources for those opportunities.

Opportunities for Suppliers

• Ethical phishing platform vendors: Suppliers with proven ethical phishing platforms and group-wide deployment experience are the most likely candidates for similar contracts.
• Security awareness training providers: The platform may integrate with training content, creating opportunities for specialist providers.
• Subcontractors: Accenture declared subcontracting as "not yet known." Suppliers with capability in phishing simulation, security training or related services may find opportunities through Accenture's supply chain.
• Group-wide deployment specialists: The contract covers the CDP Group, not just the parent company. Suppliers with experience deploying security platforms across complex groups are better positioned.
• Other Italian public financial institutions: Banks, development banks and state-controlled financial entities have similar needs. Suppliers should monitor their procurement activity.
• Monitoring the buyer: CDP publishes its procurement notices through the Italian public procurement portal and TED. Suppliers should monitor them for future opportunities.

What Businesses Should Watch

• Whether subcontractors are disclosed: Accenture declared subcontracting as "not yet known." Suppliers should watch for further disclosure.
• Whether the contract is extended or renewed: The contract runs for 90 months. Suppliers should watch for a renewal or re-procurement as the term ends.
• Whether the scope is expanded: If the ethical phishing programme is successful, CDP may wish to expand it to include additional capabilities.
• Whether the NUTS inconsistency is corrected: The notice records Accenture SpA with a Milano address but a Roma NUTS classification. Suppliers should watch for clarification.
• Whether other CDP Group entities procure similar platforms: Individual subsidiaries may have their own security awareness needs. Suppliers should monitor their procurement activity.
• Whether the Italian ethical phishing market grows: Regulatory pressure and increasing cyber threats may drive more Italian public bodies to procure similar platforms. Suppliers should watch for a growing pipeline of opportunities.

ItalyTenders.com Procurement Intelligence

This contract represents a broader trend in European financial sector security: institutions are investing in continuous phishing simulation and security awareness as a core part of their cyber defence. Rather than treating employee training as an annual exercise, mature organisations are embedding phishing simulation into their everyday operations, testing staff regularly and using the data to target training where it is most needed. That shift favours platforms that can deliver continuous testing, detailed analytics and integration with training, and it disadvantages one-off training providers that cannot demonstrate measurable behaviour change.

The award is strategically important because it protects a systemically important institution. CDP is Italy's national promotional institution, and it plays a central role in financing infrastructure and supporting the Italian economy. A successful cyber attack on CDP could have consequences far beyond its own operations. The contract is therefore not just a technology purchase. It is an investment in the resilience of a key part of Italy's financial architecture.

Suppliers can learn several things from this procurement. First, duration matters. A 90-month contract signals that the buyer views ethical phishing as a permanent capability, not a project. Suppliers that can sustain a platform and a service relationship over many years will be better positioned than those that offer short-term engagements. Second, scope matters. The contract covers the CDP Group, not just the parent company. Suppliers must be able to deploy and support the platform across a complex group of entities. Third, competition matters. Five bidders submitted offers, which means the field was competitive and the winner had to offer a strong combination of quality and price. Fourth, integration matters. Ethical phishing platforms are most valuable when they connect to training, reporting and security operations. Suppliers that can integrate with the buyer's existing systems and processes will have an advantage.

Suppliers should position themselves accordingly. Ethical phishing platform vendors should ensure they can demonstrate group-wide deployment, continuous testing and integration with training and analytics. Security awareness training providers should build partnerships with platform vendors, because that is where the work flows. Integrators like Accenture should continue to build their security portfolios, because large buyers increasingly want a single supplier for multiple security capabilities. And all suppliers should monitor CDP's procurement activity, because a successful contract is likely to generate follow-on opportunities.

Future contracts in this market are likely to evolve in two directions. First, more European public financial institutions will procure ethical phishing and security awareness platforms, driven by regulatory expectations and the growing sophistication of attacks. Second, the scope of those contracts will broaden, covering not just email phishing but also voice phishing, SMS phishing and other social engineering techniques. Suppliers that can offer a comprehensive simulation capability, backed by strong analytics and training integration, will be well positioned. Suppliers that offer only a narrow point solution will find themselves squeezed out of a market that increasingly expects breadth as well as depth.

Supplier Takeaways

• Cassa Depositi e Prestiti awarded a 90-month contract for an ethical phishing platform to Accenture SpA.
• The contract value is EUR 556,230, against an estimated value of EUR 628,464.
• Five bidders submitted offers, all electronically.
• The award criterion was the most economically advantageous tender.
• The contract covers the CDP Group, not just the parent company.
• The 90-month duration signals that CDP views ethical phishing as a permanent capability.
• The winning bidder declared subcontracting as "not yet known."
• The contract is not a framework agreement, not a dynamic purchasing system, not EU-funded and not GPA-covered.
• The review body is TAR Lazio Roma.
• The notice records Accenture SpA with a Milano address but a Roma NUTS classification, which appears to be an inconsistency.

Key Takeaways

• Cassa Depositi e Prestiti S.p.A., Italy's national promotional institution, awarded a contract for an ethical phishing software platform to Accenture SpA.
• The contract value is EUR 556,230, against an estimated value of EUR 628,464.
• The contract runs for 90 months and covers the CDP Group.
• Five bidders submitted offers through an open procedure under Italian Legislative Decree No. 36/2023.
• The award criterion was the most economically advantageous tender.
• The platform will be used to simulate phishing attacks and test employee resilience across the group.
• The contract is not a framework agreement, not a dynamic purchasing system, not EU-funded and not GPA-covered.
• The winning bidder declared subcontracting as "not yet known."
• The review body is TAR Lazio Roma.
• The notice contains a data inconsistency: Accenture SpA is recorded with a Milano address but a Roma NUTS classification.

Conclusion

Cassa Depositi e Prestiti has taken a long-term step to strengthen its defences against one of the most persistent cyber threats: phishing. The contract, worth EUR 556,230 over 90 months, gives the CDP Group access to an ethical phishing platform that will test employees continuously and generate data to improve security awareness. The award went to Accenture SpA after competition from five bidders.

The contract is significant not because of its value, which is modest, but because of what it protects. CDP is Italy's national promotional institution, and its systems, data and funds are systemically important. A successful phishing attack could have consequences far beyond the institution itself. The platform is therefore an investment in resilience, not just a technology purchase.

For suppliers, the contract reinforces the importance of duration, group-wide scope and integration in the ethical phishing market. For CDP, the challenge will be to use the platform effectively over seven and a half years, keeping pace with evolving attack techniques and ensuring that the data it generates translates into real improvements in employee behaviour. The notice leaves some questions unanswered, including the weighting of the award criteria and the future of subcontracting, but the core award is clear: Accenture will provide the platform, and CDP will use it to test and strengthen its human firewall.

Source: Tenders Electronic Daily (TED), Contract Award Notice 706371-2026, Official Journal of the European Union, OJ S 198/2026, published on 13 October 2026.