Cybersecurity Sector Insights | Q4 2026

European sovereignty in Cybersecurity

Historically, European companies have chosen their security vendors primarily based on product quality and price. Today, geopolitical uncertainty and increasing regulatory requirements impact buying decisions to a larger degree than ever.

22. Oktober 2026,

Publikationen

Most of the cybersecurity solutions used in Europe come from US vendors, creating a considerable dependency. The continuous move towards cloud-based solutions accelerates this dependency further with roughly 80% of total professional cloud spend in the EU being captured by US counterparties, which leverage US identity and cloud security solutions. Across many cybersecurity subsegments, European vendors are present, but typically of smaller size and focused on their home markets.

The EU continues to reflect the impact of US dependency in their regulatory frameworks through the Cybersecurity Act, allowing the European Commission to designate high-risk suppliers and restrict their use across NIS2 impacted companies, or the Cloud and AI Development Act (CADA) introducing assurance levels for cloud services, significantly restricting the use of non-EU providers across critical IT and OT environments. While both are still proposals, they provide a clear direction of the regulatory framework governing European cybersecurity.

Consequently, demand from European organizations has begun to shift further towards home-grown solutions, especially across critical industries such as public sector, healthcare, financial services or defense. In response, large US vendors have launched sovereign solutions but are hampered by remaining impacts of their own legislation (e.g., the US CLOUD Act) and new requirements from CADA.

Deal activity has responded accordingly with strategics such as Airbus building a leading European cyber platform through acquisitions or US vendors increasingly showing appetite for European cybersecurity players.

We expect European sovereignty to remain a key cyber trend beyond the current political cycle, driving investment activity and strategic interest in European cyber companies that combine strong technology with credible independence.

From boardroom risk to operating model

Sovereignty has moved from a compliance footnote to a board-level resilience question. The decisive variable is no longer where data sits, but who can switch it off – and identity is where that control begins.

About the author

Kian Gould is a serial entrepreneur and technology executive in the Frankfurt Rhine-Main region. He founded AOE, a digital engineering firm built over 25 years, and Bare.ID, a German sovereign IAM platform. He writes in a personal capacity; references to his own ventures are disclosed in the text.

Picture the question every European executive should now be able to answer in a single board meeting: what happens if US services are switched off? Not degraded, not delayed – switched off. AWS and Azure instances deactivated, Microsoft 365 accounts locked, ERP and CRM access gone, US AI services discontinued by executive order. For most large European enterprises this is no longer a thought experiment. It is an unpriced operational dependency sitting at the centre of the technology stack.

Operational exposure to US Cloud dependency

The events of June 2026 removed the last of the hypotheticals. A US decree barring non-US persons from accessing two frontier AI models, followed by a worldwide shutdown of those models, demonstrated the mechanism in real time: access to a critical digital service can be revoked by a jurisdiction in which the customer has no vote. The sanctioning of an International Criminal Court prosecutor – cut off from banking and everyday cloud services – had already shown this reaches institutions and individuals alike. And under the CLOUD Act, even EU-hosted data carries no firm guarantee, as a Microsoft executive conceded before the French Senate when unable to rule out US access to French citizens’ data.

Sources: Antrophic press releases; Guest contribution; Synergy Research Group; “The Future of European Competitiveness” by the European Commission

Sovereignty is a continuum, not a switch

The instinctive response – “move everything to Europe” – misreads the problem. Sovereignty is not binary. It is a spectrum that runs from full dependency to full control, and every workload can be placed on it deliberately rather than by accident. A US SaaS tenant sits at one end; EU hosting under US jurisdiction is only marginally better; an EU vendor wrapped around a US core is better still but not sovereign; a genuine EU stack and, ultimately, self-operated open-source infrastructure complete the range. The strategic task is not to drag every system to the far end, but to match each system’s position to its criticality.

This reframing matters commercially. Treating sovereignty as an all-or-nothing migration produces paralysis and cost overruns; treating it as a tiered control problem turns it into a sequence of manageable, fundable decisions – the same discipline the sector already applies to cyber risk: prioritise by exposure, not by uniform spend.

Three levers decide the outcome

Across hundreds of enterprise architectures, the degree of achievable sovereignty is governed by three control points: identity, storage and AI. They are not equal in leverage. Identity comes first, because whoever controls the identity provider controls access to every connected system – internal applications, cloud services, partner APIs. The IdP is, in effect, the stack. A sovereign storage strategy and a sovereign AI strategy both depend on a sovereign access layer underneath them.

On identity, the dominant providers – Okta, Auth0, Azure AD, OneLogin – are US-based and CLOUD Act-exposed. Sovereign alternatives are enterprise-ready today: open-source platforms such as Keycloak and Zitadel that can be fully self-operated, established German enterprise IAM such as Bare.ID and Univention, and German SSO platforms operable on-premises or in an EU cloud. (Full disclosure: the author is a co-founder of Bare.ID.) The category point holds independently of any single vendor: the access layer is the highest-leverage place to begin, and viable European options exist.

On storage, the principle is that not every piece of information belongs in the same cloud. Board-level material, IP, contracts and M&A data are critical and belong in sovereign or on-premises environments; customer, financial and project data fit an EU or hybrid cloud; marketing, collaboration and public material can remain on US clouds. On AI, a European interface around a US core model is whitewashing, not sovereignty – EU frontier models such as Mistral, locally hosted open-weight models, and sovereign EU platforms keep critical inference under European control.

Authors perspective

Identity is becoming the organising layer of modern security architecture, not a procurement line item. The same shift the sector is already pricing – from reactive detection toward preventive, identity-led defence – maps directly onto the sovereignty agenda. Value accrues to vendors that control authentication, authorisation and policy enforcement under European jurisdiction. A sovereign access layer is increasingly the precondition for everything built on top of it.

From awareness to action

Most large enterprises sit at the first two stages of maturity – dependencies present, often unrecognised. The path forward is phased and starts with the highest-leverage control. Within 30 days, build a dependency inventory, commission a CLOUD Act risk assessment, and evaluate a sovereign SSO alternative. Within 90 days, pilot sovereign SSO for internal systems, classify data by criticality, and test an EU storage tier. Within twelve months, operationalise the multi-cloud strategy, adopt an AI governance policy, and introduce a European model for critical use cases.

The regulatory tailwind reinforces this timeline. NIS2, DORA, the Cyber Resilience Act and the AI Act are converting sovereignty from good practice into documented obligation, with accountability at board level. The commercial case is therefore straightforward: sovereignty is risk management, not an IT cost position. It removes a business-continuity exposure the ICC case proved is real, answers a compliance requirement now mandatory for critical infrastructure, and is increasingly rewarded by B2B customers and public buyers as a demonstrable competitive advantage.

For investors and corporate buyers tracking this sector, the implication is concrete. As budgets concentrate around platform-led, identity-centric security, the European sovereignty layer becomes a distinct and defensible category. Digital sovereignty is no longer a question of if, but of when and how.

Sources: Guest contribution

Download

The full report includes a public valuation update, M&A and Financing activity, and the DACH deal pipeline. It can be downloaded at the top of the page.