Cybersecurity: for a real and civic digital sovereignty

We have heard a great deal about "digital sovereignty" in cybersecurity over the past few years. But let's be honest: it has become a catch-all phrase, worn to the bone. Everyone waves it around, few really act.

The reality? We missed the boat. Several times. For lack of vision, of courage, or of consistency. And in the meantime, France and Europe have shifted more than 75% of their IT spending toward non-European solutions, mainly American ones.

We organized our own dependency

The figures are stubborn. The French "sovereign" cloud remained a dead letter. Major public bodies and CAC 40 companies host their critical data on Azure, AWS or Google Cloud.

And the trend is not turning around, it is getting worse. In 2025, the three American giants, Amazon, Microsoft and Google, captured around 70% of the European cloud market, while all European providers together were stuck at 15%, down from 29% in 2017, according to Synergy Research Group. In other words: the bigger the market grows, the smaller our share becomes. Across the continent, the EuroStack initiative estimates that 264 billion euros leave Europe every year for cloud and software.

Yet the skills exist in France. So do the solutions. Serious, solid, innovative players. But they do not get the support they deserve. Not enough references, not enough orders, and therefore not enough weight.

It is a vicious circle, but above all a short-sighted strategy.

Has the French "sovereign" cloud really failed?

We have been promised a trusted cloud for years. Where do things actually stand? At the end of 2025, S3NS, a Thales joint venture built on Google technology, obtained the SecNumCloud qualification. Bleu, run by Orange and Capgemini on top of Azure, cleared an intermediate step in the autumn. Two offerings built on American technologies, operated from France, several years behind the schedule announced in 2022.

That is the whole paradox: our "sovereign cloud" still rests, in essence, on the building blocks of the very players we are trying to break away from. The Cour des comptes says nothing different. In its report of 31 October 2025, it describes a dependent state, fragmented governance and a strategy with no clear course, and notes that the "cloud at the center" doctrine has made sovereignty the exception rather than the rule.

Sovereignty: a posture or an infrastructure?

This word has been depoliticized to the point of becoming vague. But the truth is simple: no sovereignty without the ability to choose, to understand, to react.

Today, a good part of our data, our decisions, our essential services pass through platforms that we control neither legally, nor technically, nor economically.

The "neither legally" is not an abstraction. In June 2025, before a Senate commission of inquiry, the director of legal affairs at Microsoft France admitted he could not guarantee that French citizens' data would never be handed over to the American authorities: under the CLOUD Act, a company incorporated under US law can be compelled to do so, wherever the data is stored. No contractual clause, no data center "in France" erases that reality.

And this is not just a matter of "data protection". It is a question of power. Of skill. Of the balance of power.

Cybersecurity without mastery of the tools is an illusion

You can pile up charters, rules, audits. If you do not master the technical basics of your own systems, you are exposed. Full stop.

And if you keep depending massively on foreign ecosystems, whose priorities are neither ours nor those of our citizens, then our entire chain of trust rests on a gamble.

This is not pessimism. It is realism.

Can we still win back digital sovereignty?

It is too late to be first. But it is not too late to regain ground. The context has changed, too: in 2025, more than two hundred European players signed the EuroStack call to rebuild the continent's digital infrastructure, and the subject has left the conference circuit for official reports.

It starts by giving weight to local solutions. Not out of blind patriotism, but because it is strategic. Because it is healthy. Because it rebuilds skill, resilience, and responsibility.

It continues by training citizens, professionals, decision-makers to understand what they use. Not to know everything, but to know how to ask the right questions.

It also means putting trust back at the center: not in the tools, but in relationships, processes, and the ability to say no when necessary.

Where do you start, concretely?

Do you run a local authority? A company? A public service? Look at your dependencies. Ask your providers the question. Support human-scale players. Invest in skills, not just in compliance.

And if you are a citizen, a user, a professional: be curious. Demand transparency. Talk about these subjects, even simply. Because by making systematic outsourcing routine, we end up subcontracting our very ability to exist.

Digital sovereignty will never be perfect. But it must be a direction. A clear course.

Not a word in the press releases. An act in the choices.

Learn more about My resources and my book

---

Sources

• European cloud market shares (around 70% for Amazon, Microsoft and Google; 15% for European providers, down from 29% in 2017): Synergy Research Group, 24 July 2025.
• AWS, Google and Microsoft capture 72% of cloud spending in Europe: Le Monde Informatique.
• Hearing of Microsoft France before the Senate commission of inquiry, June 2025 (French data and the CLOUD Act): The Register, 25 July 2025.
• "Les enjeux de souveraineté des systèmes d'information civils de l'État", report of 31 October 2025: Cour des comptes.
• SecNumCloud qualification for S3NS (Thales and Google) and progress of Bleu (Orange, Capgemini and Microsoft): L'Usine Digitale.
• EuroStack initiative and the estimate of 264 billion euros leaving Europe every year for cloud and software: EuroStack, 2025.