Being dependent on another country’s technology and support carries risk, however close the relationship appears. Yet when we discuss nation state cyber threats, we tend to focus on hostile actors breaking into our systems. We should also examine who controls the systems we already depend on.
For the UK, that means facing our reliance on US technology. Cloud infrastructure, business software and security services are deeply embedded in government and commerce. The CMA has identified significant market power held by Microsoft and Amazon in cloud services, alongside barriers that make switching difficult. This is a resilience issue as well as a competition issue.
An alliance is a political relationship, and political relationships change. Continued US support and alignment with UK interests should no longer be treated as an unquestioned planning assumption. We need to assess what happens when commercial decisions, government policy or geopolitical pressure affect access to essential technology.
Starlink in Ukraine makes that question painfully practical. In February, Ukraine introduced terminal authorisation to counter Russian use of the service. On 14 October, Ukrainian officials reported that restrictions affecting services used by military drones had disrupted missions without warning. Reuters reported that SpaceX had not immediately commented and the reason for the restrictions was unclear.
We should be careful about attributing motives. Nevertheless, the lesson we draw is that effective technology can become a critical dependency whose operating conditions are controlled elsewhere. For government, defence and critical national infrastructure, that should prompt some uncomfortable questions about sovereignty and continuity.
Where is our data? Who administers the service? Which jurisdictions govern the provider? Who can alter access, support or functionality? Crucially, could we continue operating if that service became unavailable? A second supplier offers limited protection if it depends on the same underlying infrastructure or jurisdiction.
Meanwhile, espionage remains a persistent threat. The NCSC’s warning about Integrity Technology Group describes activity combining AI tools, compromised devices and manual exploitation. Organisations need to understand why their information, research or supply chain position might interest a state actor, including the access they provide to others.
Boards should bring these risks together. Technical protection, supplier assurance and geopolitical exposure need shared ownership across security, procurement, legal and operations. Strong authentication, controlled access, protected logging and network separation remain essential. So do realistic exercises that test loss of a major provider and the ability to detect an intruder using legitimate tools.
AI adoption adds further dependencies. Organisations should know which providers process sensitive information, what access their systems receive and whether an alternative could actually be deployed. An exit plan that has never been tested offers little assurance.
Public-private cooperation matters: act on NCSC guidance, report incidents and exchange intelligence through trusted channels. Government also has a role in supporting domestic capability and reducing barriers to switching.
Businesses cannot remove every international dependency. They can identify concentrations of risk, challenge assumptions about continued support and invest in workable alternatives. Resilience requires understanding what we control, what we depend on, and what happens when circumstances change.
