Autonomy, not sovereignty: navigating the new geopolitics of cyber security

Governments around the world are paying close attention to where critical data is stored, who operates key digital services and which technologies organisations depend on. Cloud providers, AI platforms, telecommunications networks and critical software components are all now viewed through a geopolitical lens.  

For organisations caught in the middle, the challenge is to respond to these sovereignty ambitions sensibly, without mistaking them for a strategy in themselves. 

How cyber security became geopolitical 

The numbers help explain why states are taking such an interest. The size of extreme losses from cyber attacks has more than quadrupled since 2017, reaching $2.5 billion. The financial sector alone has suffered more than 20,000 successful cyber attacks over the past two decades, resulting in $12 billion in direct losses. Meanwhile, industry studies put global scam losses at roughly $1 trillion in 2024. And the indirect costs – reputational damage, regulatory penalties, emergency security upgrades. – are often substantially higher than the direct ones. Equifax paid more than $1 billion in penalties following its 2017 data breach, and the NotPetya attacks of the same year caused billions of dollars in economic damage worldwide. 

But cost is only part of the story. Cyber attacks have become instruments of statecraft. State-sponsored groups such as Volt Typhoon have infiltrated critical civilian infrastructure and remained undetected since at least 2021, positioning themselves for geopolitical leverage rather than immediate gain. Researchers catalogued over 300 severe incidents of Chinese cyber-espionage between 1995 and 2024, much of it aimed at closing the technological gap with the United States.  

And while still unrealised, quantum computing casts a long shadow:  a task such as breaking a standard 2048-bit RSA key, which would take a classical supercomputer 300 trillion years, could theoretically take a future quantum computer under eight hours, which is why rivals are harvesting encrypted data today in anticipation of decrypting it tomorrow. Furthermore, many experts  agree that most defenders won’t know quantum computing is in play until long after it’s first deployed, because the attacks will be effective enough to avoid detection.  

Artificial intelligence, of course, is accelerating everything. In 2025, state-sponsored groups deployed an AI model to autonomously attack around 30 Western technology and government targets, while AI-supercharged disinformation campaigns have profiled sitting lawmakers and thousands of public figures to craft personalised deepfakes.  

High-profile, global cyber incidents, such as the CrowdStrike incident in 2024, have demonstrated both the financial and the social consequences of being overly dependent on specific providers, especially when those providers are overseas and therefore not beholden to the same jurisdictions as their customers.  Little wonder, then, that governments have made digital sovereignty a priority in an attempt to reduce the risks associated with reliance on third parties. 

The rise of digital sovereignty 

The policy response has been swift, particularly in Europe. The EU’s digital sovereignty ambitions encompass data residency requirements, sovereign cloud initiatives and a tightening web of regulation. Governments are already encouraging – and in some cases obliging – the use of local or sovereign cloud solutions for sensitive workloads, especially in the public sector and critical infrastructure industries. 

The regulatory landscape reflects the same logic. NIS2 has emerged as the cornerstone of European cyber security approaches, with a strong emphasis on operational resilience across critical sectors. DORA extends similar thinking to financial services and ICT, placing particular weight on supply chain security – a recognition that compromising one software provider can create downstream risks for every organisation using that software. 

Though Europe is often seen as a regulatory leader – or at least a harbinger – many regions globally have begun prioritising similar transitions. The Gulf Cooperation Council (GCC) has seen an increase in on-shoring of data and digital services, banding together for government-sponsored red-teaming and other preparedness measures. 

This shift towards sovereignty also marks a change in what constitutes effective cyber security. Regulators, customers, investors and business partners are increasingly asking a single question: can the organisation continue to operate and recover quickly when a major cyber incident occurs? Proving compliance is no longer enough; organisations are expected to test their incident response regularly, measure recovery times for critical services and demonstrate they can maintain essential operations during a crisis. 

In theory, digital sovereignty helps with resilience – at least, that’s what governments are banking on. But does that ring true in reality for global organisations? 

Sovereignty is merely a requirement – autonomy is the goal 

Here is where organisations need to be strategic. Sovereignty ambitions have been developed, in large part, to protect them, much like other compliance requirements. But sovereignty itself is not the solution. Taken to its logical extreme, it introduces immense amounts of friction for global organisations: fragmented supplier landscapes, duplicated infrastructure and constraints on choosing the best available technology. 

Another key concern relating to autonomy is  government control over operational continuity. Should one entity hold the power to activate a “kill switch”, impacting data processing or operations in one jurisdiction, this could have a significantimpact on other organisations who depend on those targeted. Governments could therefore, at least theoretically, use business operations as leverage in geopolitical matters, placing business continuity at risk. 

What organisations actually need is autonomy – the ability to understand, control and, if necessary, change their digital dependencies. That means: 

• Knowing where sensitive data is hosted. Not just contractually, but in practice, including where backups and support functions sit. 
• Understanding the geopolitical exposure of suppliers. Cyber risk is no longer limited to direct suppliers; it flows through a complex ecosystem of software vendors, cloud providers, managed service providers and AI services. Hidden dependencies deep in the supply chain can matter as much as headline contracts. 
• Choosing partners from friendly or aligned nations. The nationality of a cyber security provider is now a legitimate risk factor. The nation operating or presiding over a critical solution should be one your organisation – and your regulators – can trust. 
• Demonstrating resilience, not just compliance. Sovereignty requirements should be folded into a broader resilience programme, treated as one input among many rather than a strategy in their own right. 
• Framed this way, sovereignty becomes what it should be: one more requirement on the list. An important one, designed with organisations’ protection in mind, but a requirement nonetheless. The strategic objective sits above it. 

The economics still favour preparation 

If this all sounds like more cost, it’s worth remembering the arithmetic of prevention. Studies on disaster and infrastructure mitigation consistently show that every dollar invested in protection saves an average of six dollars in avoided losses. While figures specific to cyber security are harder to come by, the valueof preparedness is difficult to ignore. Given that reported losses from internet crime in the United States alone reached $16.6 billion in 2024, a potential 600% ROI is hard to ignore. 

There are grounds for optimism, too. The same AI that is amplifying today's risks – 45% of AI-generated code carries an OWASP Top 10 flaw, and AI commits leak secrets at roughly twice the human rate – could ultimately transform the economics of security, making it affordable to rewrite ageing, vulnerable code and build software that is more secure by design. 

The geopolitics of cyber security are only becoming more volatile, and the conversation around digital sovereignty is likely to become more prominent as a result.  

And that, ultimately, is what regulators, customers and investors are really asking for.

Contact us