IT Import Substitution: What Can Really Be Replaced vs. What Only Looks Like Replacement
March 5, 2025 · 8 min read · System Networks
Since 2022, the market has been flooded with "domestic" information security products. Some are genuinely Russian developments. Others are foreign software with a new logo and a Russian legal entity. Here is how to tell them apart.
Three Signs of a Genuine Russian Security Tool
FSTEK Certificate with Real Testing
The FSTEK certificate can be verified in the regulator's registry on their official website. Pay attention to the issue date and protection class. Products that received a certificate before 2022 on a foreign codebase may no longer meet current requirements.
Russian Codebase Without Foreign Dependencies
Ask the vendor to confirm that the product does not use libraries or components supplied by foreign companies. After the departure of Western developers, many "alternatives" lost support for key components.
Working Russian-Language Support
Try creating a test request to support before purchasing. If the response arrives after a week or in English — this is a warning sign. Support is critically important during security incidents.
What Is Easy to Replace vs. What Is Difficult
Easy to replace: Antivirus protection (Kaspersky, Dr.Web have had fully functional enterprise products for a long time), encryption tools (CryptoPro is the de facto standard), basic-level firewalls.
More difficult to replace: SIEM systems, PAM solutions, enterprise-class DLP. Russian products are still catching up with foreign ones in functionality, although the gap has narrowed over the past two years.
How Not to Lose Protection During the Transition
The main mistake in import substitution is trying to replace everything at once. The correct approach: first inventory and classify by criticality, then phase-by-phase replacement with parallel operation of old and new systems in a testing period (at least 30 days), and only then complete decommissioning of the replaced product.