Business Model Canvas and Competition to Understand Exploitation of Cybersecurity Project Results


  • Harri Ruoslahti Security and Risk Management, Laurea University of Applied Sciences, Finland
  • Eveliina Hytönen Security and Risk Management, Laurea University of Applied Sciences, Finland
  • Luis Angel Galindo Sanchez Cybersecurity, Telefonica S.A., Spain



Business Model Canvas, Competition, Cyber Range, Co-Creation


The European Commission (EC) has lately funded 22 different cybersecurity projects (European Commission, 2024), and the European Union (EU) expects a return for the investment and requires these projects to demonstrate efficient exploitation activities that emphasize their influence on the European economy. The Business Model Canvas (BMC) is a tool to actively guide discussion and processes that evolve and adapt based on their environments. Yet, the tool does not address the competition on the marketplace. For this reason, this study introduces the ‘Business Model Canvas and Competition’ (BMC&C) by including the element of competence to the traditional BMC and examines its usefulness to understand the relations between an organisation and its competitive environment. The data collection method for this study was action research through actively participating in the exploitation workshops activities and reading what materials were produced. The BMC by Osterwalder and Pigneur (2011) consists of the nine building blocks. This study modified the BMC as a framework of analysis by adding tenth building block ‘Competition’ (&C) that acknowledges that an organization is not alone but is part of a market where it encounters competition by active direct competitors and by indirect alternative ways to achieve similar results. This tenth building block ‘Competition’ (&C) was deemed important to better understand what possible competitive advantages and challenges the analysed assets of the ECHO project may encounter. The BMC&C was used in ECHO exploitation workshop that addressed the ECHO asset ECHO Early Warning System (E-EWS). The E-EWS asset BMC&C example show that users found the BMC&C easy to use. As the &C was added as a tenth element or building block the use of the tool was familiar to anyone who had used a conventional BMC. Those who had no prior experience of the BMC tool received guidance from the more experienced users. The workshops included active and co-creative discussions that shaped the outcomes of the BMC&C for each individual ECHO asset. The results of this study indicate that the BMC&C can be a valuable tool to assess how an organisation that is active in a marketplace may need to take their competition into account. The contribution of this study to practice is a deeper understanding of competition and market on a very practical case level, while its contribution to theory is the accumulation of data from multiple cases.