In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question first. He explains why organizations underestimate speed, the time it takes to detect and stop an attacker, and why the cost curve turns steep once workloads move on premises.
Halbheer says boards ask for independence but end up buying a location and an assurance statement. Instead, he urges risk decisions per workload. He also points out that governments can compel providers almost everywhere, including in Europe, and that a compromised environment is never sovereign.
Sovereignty costs money, people and speed. Which of the three do organizations consistently underestimate, and why?
Speed, and I mean security speed: how fast you detect an intrusion, decide and act. Money shows up in a procurement decision. Speed shows up only on the day an attacker is inside, and then it is the only number that matters.
That window keeps shrinking. The Microsoft Digital Defense Report 2026 shows that the time from a vulnerability’s discovery in the wild to active weaponization can be well below 24 hours, in a year heading for a record 72,000 published CVEs. And in 52.2 percent of intrusions using valid accounts, the attacker went on to steal further credentials. One foothold becomes many, fast.
What most organizations miss is that the cost of sovereignty is not a straight line. That is my model, but I see it in every engagement. Inside the cloud, a lot of sovereignty comes cheap: customer-managed keys, residency where your counsel says you need it, access transparency. It is a configuration change, not a re-platforming, and you keep the platform’s detection, threat intelligence and automated response. The same report names shared, correlated threat intelligence as one of the highest-leverage variables a defender controls. You lose very little speed and need very few additional people.
The cloud is also where the innovation is, and customers are asking for it: AI assistants, agents and analytics that need the service to work with their data. The same is true for defense. Agentic AI is changing what defenders can do. MDASH, our multi-model agentic code scanner, coordinates more than a hundred specialized AI agents to find and validate vulnerabilities before attackers do, and it is offered in EU and Swiss regions.
Project Perception puts red, blue and green agents to work probing, investigating and hardening at machine speed, with humans signing off every high-impact action. Both are in preview today, and both are delivered from the cloud. The curve turns steep the moment you move on premises and build it yourself, often on open source. Every detection is one you write, every patch one you roll out, every lesson one you learn on your own incident at three in the morning, and none of that innovation arrives on its own. Open source does not end the dependency question either: the license is free, the supply chain is not.
That is where people come in, because speed is made of people: platform, identity and security skills at once, twenty-four hour coverage, runbooks that hold under stress. In the ISC2 2025 Workforce Study, 33 percent said their organization lacks the budget to staff its security teams adequately. Germany shows the result at scale. In October 2025 the BSI found 92 percent of roughly 33,000 internet-reachable on-premises Exchange servers running versions at or past end of support. In August 2026 CERT-Bund could see extended security patches on nine. Sovereignty is not the server you own. It is the work you keep doing, fast enough, after you own it.
When a European board says it wants sovereignty, what is it usually asking for, and what does it usually end up buying?
It is asking for independence: nobody outside can reach its data or switch it off. It usually ends up buying a location and an assurance statement, applied to the whole company at once.
Both halves are the problem. Independence is not for sale, and a company-wide posture has no unit of decision, no price and no test. You cannot defend it to an auditor, so you cannot manage it.
What a board should ask for is a risk decision per workload. Which exposure are we reducing, what does it cost in money, people and speed, and how would we prove it works? If you cannot answer the third question, you have not bought anything. And that decision belongs in the risk register, not in a procurement negotiation or a news cycle.
If independence is not for sale, what is a European organization buying when it pays for sovereignty?
Precision. The European Commission says the Union relies on non-EU countries for over 80 percent of key digital products, services, infrastructure and intellectual property. Read that as hopeless and you get paralysis. Buy one sovereign layer and declare victory and you get a press release.
What you are actually paying for is control over the dependencies that matter for a specific workload: who holds the keys, a contract that says what the provider will contest and tell you, a second supplier where one exists, an exit plan you have actually run. And not only on your core platform. Payroll, CRM, backup and security monitoring each hold copies of the same data, in their own jurisdictions. A legal order and an attacker both take the cheapest route in.
Above all, you are buying security, because a compromised environment is not sovereign. Whatever assurance you hold about lawful access is void the moment someone is accessing your data unlawfully. In our Digital Defense Report, 63 percent of intrusions involved data theft, and cloud identity abuse accounted for 78 percent of the attack techniques observed against critical infrastructure. Those are identity failures, not jurisdiction failures, and no sovereignty control on anybody’s slide stops them.
Security is not a parallel program to sovereignty. It is the precondition.
How many European customers understand that “move it to Europe” does not mean “no government can compel the provider”?
Fewer than should. I do not have a number and would not trust anyone who claims one, but in my conversations it is rarely understood. Compelled access is not an American peculiarity. The UK can compel a provider to build a capability. France can require certain providers to hand over decryption keys within seventy-two hours. And since 18 August 2026, e-Evidence lets an authority in one member state order a provider in another to produce data within ten days, or eight hours in an emergency.
To be fair, e-Evidence operates inside a mutual-recognition area with common fundamental-rights standards. But the point stands. Can a government compel my provider? Yes, almost everywhere. What separates jurisdictions is under what conditions, with what oversight, and whether I can see it happening.
This is where we as a society have to strike a balance. We all want law enforcement to fight child sexual abuse, human trafficking, terrorism and fraud, and those crimes are global. Their evidence sits on somebody’s server, often in another country.
At the same time, we need privacy and managed risk. So the question is not whether these powers should exist, but whether they are properly bounded: a legal basis, independent authorization, a limit on scope, a route to challenge, and some way for the rest of us to see that the system works.
If a large share of government requests come with secrecy orders, how can anyone tell the difference between a risk that is rare and a risk that is well hidden?
I would start with the premise, because it assumes something I cannot confirm. Secrecy orders exist, in the US and in Europe. How often they attach to requests touching European enterprise data is not something the public record lets anyone state with confidence, in either direction.
What their existence does mean is that the absence of documented cases has two readings. Either the risk is genuinely rare, or the secrecy rules are working as designed. Assert only the first and you overstate. Assert only the second and you can never be proved wrong. And secrecy is not unchallengeable: Microsoft sued the US Department of Justice over indefinite secrecy orders in 2016, and the Department changed its policy in 2017.
Treat it as a risk you cannot quantify. Ask providers whether their transparency reporting is externally assured. Put the commitment to contest orders and notify you in the contract, not a blog post. For the narrow class of data that needs it, use a design where the provider cannot read the content, and accept the cost in functionality. Then look at the other risk in the same room, the one measured in minutes. One risk you cannot count. The other gives you a number every day. Only one of them tells you where to start.
Download: The IT and security field guide to AI adoption
