How SSH Spent Its EIC Accelerator Grant on Privileged Cloud Access

Every administrator who logs into a remote server with a terminal is probably using a protocol written in 1995 by a Finnish researcher, Tatu Ylönen. The company he founded that December to sell it, SSH Communications Security Oyj, has been listed in Helsinki since 2000, according to Wikipedia and the Finnish Trade Register, which records the company from 31 December 1995 and as a public limited company from May 2000. By 2019 its sales were shrinking: net sales fell from €18.3 million in 2018 to €14.4 million, according to its 2019 financial statement release.

Its bet on a new business was PrivX, software that gives administrators short-lived access to servers and cloud resources instead of standing passwords and keys. In June 2019 the European Commission selected SSH's project EPICA in the EIC SME Instrument Phase 2, the Horizon 2020 forerunner of today's EIC Accelerator, according to the Commission's list of the 5 June 2019 winners. The list names SSH as the only beneficiary of the project. CORDIS records an EU contribution of €2,049,645.50 towards a total cost of €2,928,065.

Where SSH Stands Now

SSH is active and still listed. Its interim report for January to June 2026, published in July, reports net sales of €11.1 million, up 2.6% on a year earlier, and calls PrivX "now our largest solution business area", with PrivX PAM sales up 25.1% in the second quarter. The same release was carried by Placera. Subscription annual recurring revenue reached €14.8 million. The half-year still ended with a net loss of €1.9 million.

The biggest change since the grant is the shareholder register. In July 2025 Leonardo, the Italian aerospace and defence group, agreed to pay €20 million for 24.55% of SSH, with worldwide exclusivity to build SSH products into its own zero trust offering outside the Scandinavian countries, according to Leonardo and the analyst firm Redeye. Leonardo paid for 13,333,333 new shares at €1.50 each on 21 October 2025, according to SSH's completion announcement. The 2026 half-year report lists a PrivX deal with Leonardo among its new orders.

The Technology: Access Without Standing Credentials

Privileged access management (PAM) controls the accounts that can change or read anything on a system: administrator logins, root passwords, SSH keys and service accounts. The established approach, sold by vendors such as CyberArk, stores those credentials in a vault and checks them out to users. SSH's final EPICA report argues that traditional PAM systems were built for fixed on-premises servers and "do not scale at sufficient speed or cost-effectively in a cloud environment", where servers are created and destroyed automatically.

PrivX takes a different route. It grants access by role and on demand, and authenticates each session with an ephemeral certificate that expires after use, so there is no permanent password or key on the target server to steal. SSH calls this "credentialess" access and, in its 2019 release, "Zero Standing Privileges". The approach was patented: the United States Patent and Trademark Office granted SSH patent US10523445 for "secure passwordless access to hosts in hybrid networks", according to the same release.

PrivX existed before the grant. In October 2018 SSH and Fujitsu announced a partnership to offer it as privileged access as a service, according to GlobeNewswire. EPICA was meant to complete the product family and take it to market, not to invent it.

What EPICA Promised, and What CORDIS Shows

The CORDIS objective promised to "complete the development of the PrivX product family, build necessary interfaces to create a vibrant ecosystem around the product, and take it to the markets". SSH said it would sell PrivX to its base of 3,000 customers, sell online to smaller companies, and recruit cloud service providers and identity-as-a-service providers as resellers. In a blog post of 9 August 2019 the company said it would add "a cool million more" of its own money and listed four development areas: cloud deployment and containerisation, access for container and serverless computing, automated machine-to-machine access, and integrations with security monitoring systems.

The grant agreement was signed on 26 September 2019. In its third-quarter 2019 report SSH said the money would fund PrivX "over the next 24 months". CORDIS gives a start date of 1 October 2019 and an end date of 31 March 2022, which is 30 months. Neither CORDIS nor SSH explains the six-month extension. The final report, covering October 2020 to March 2022, describes the work below.

1. Complete the PrivX product familyDeliveredSecrets vault, secrets API and credential rotation added, per the CORDIS report; PrivX OT and MSP editions launched in 2021, per the 2021 release.
2. Interfaces for an ecosystemDeliveredIntegration with a SIEM product and more identity sources, per CORDIS.
3. Cloud and SaaS deliveryPartlyA multi-tenant SaaS platform was built and trialled, per CORDIS; the current PrivX documentation describes only self-hosted installs, including on AWS, Azure and Google Cloud.
4. Take PrivX to marketDeliveredThree-digit PrivX growth every quarter of 2021 and a €0.9M a year government contract; PrivX is the largest business area in 2026.
5. Cloud and identity providers as resellersNot verifiedAn MSP edition exists, but no named cloud or identity-as-a-service reseller from the project period could be found.
6. Finish in 24 monthsLateEnded after 30 months, on 31 March 2022.

The report's main external evidence is a placement in the leader category of KuppingerCole's Privileged Access Management Leadership Compass. The record since then supports the claim that PrivX became a real product: SSH's awards page lists the 2026 edition of that report, an honourable mention in Gartner's 2025 Magic Quadrant for PAM and FIPS 140-3 certification for PrivX, which the 2025 annual report says supports sales to the US federal government.

What SSH Has Achieved Since the Award

The first year of the project was weak for the whole company. Net sales fell to €11.3 million in 2020 and the net loss widened to €3.1 million, according to the 2021 financial statement release. In March 2020 the board replaced chief executive Kaisa Olkkonen with Teemu Tunkelo, a former Voith, Siemens and ABB manager, according to GlobeNewswire.

Growth returned in 2021, partly bought. In April 2021 SSH acquired Deltagon, a Finnish secure e-mail company, for a cash outflow of €4.6 million, and net sales rose 41.6% to €15.9 million. The 2021 release credits Deltagon for most of the rise in staff and names PrivX, with "three-digit year-on-year growth every quarter", as "the key growth engine". Subscription ARR ended 2021 at €7.3 million.

Sales rose to €22.2 million in 2024 and slipped 2.4% to €21.6 million in 2025, which SSH blamed on lower licence sales and a weaker US dollar, according to its 2025 annual report. The revenue series matches the figures compiled by the analyst firm Inderes, which rounds 2021 to €16.0 million. In February 2024 Tunkelo left with immediate effect and Rami Raulas, head of the EMEA region, became interim chief executive, according to SSH and BankInfoSecurity. He was confirmed from 8 January 2025, according to the company's announcement.

SSH kept taking EU research money after EPICA, as a partner rather than coordinator. CORDIS lists a net EU contribution of €278,685 for SSH in CHARM, an ECSEL project on electronics for harsh industrial environments that ran from June 2020 to February 2024, and €260,526.40 in PROACTIF, a Horizon Europe project on unmanned vehicles for civil security running from May 2025 to April 2028. SSH's awards page says CHARM funded machine-to-machine and industrial IoT features of PrivX.

The Money

EPICA money reached SSH quickly. The 2019 release shows €0.9 million of EU funding for PrivX in that year's investment cash flow, and the 2021 release records government grants of €1.8 million received in 2021 and €0.6 million in 2020. Those grant figures are not broken down by project.

The EIC Fund's list of invested companies, checked across all 16 pages on 7 October 2026, does not include SSH. The 2019 award was a grant only, and no EIC equity was involved.

Why Europe Should Care

Privileged access is now a legal requirement, not just good practice. The EU's NIS2 Directive lists "access control policies" and "multi-factor authentication or continuous authentication solutions" among the minimum measures for essential and important entities in Article 21(2), and the Commission's Implementing Regulation 2024/2690 spells out duties for privileged accounts and system administration, as summarised by nisd2.eu.

The market for those tools is dominated by non-European vendors. The largest, CyberArk, was bought by the US firm Palo Alto Networks for $25 billion in a deal completed in February 2026, according to CRN Asia and WashingtonExec. The EPICA objective itself argued that Europe "has fallen behind the US, Israel, and China" in cybersecurity. Leonardo's purchase, which needed clearance under Finnish rules on foreign investment in defence companies, is the clearest sign that a European defence group sees SSH's PAM and network encryption as strategic.

The Verdict

SSH Communications Security has not been asked for comment for this article. It is based entirely on public records, stock exchange releases and EU project data, linked throughout.