Deserted checkouts, paralysed supply chains, and locked storefronts: when cyberattacks recently struck major supermarket chains in Europe, it became obvious how fragile the critical arteries of our daily economy are. Far from being an IT glitch, incidents like these are strong reminders of the new reality of hybrid threats. We need to protect ourselves against them in multiple dimensions.
Looking at cybersecurity expenditure, the IT budgets in companies are promising: the Cyber Security Report 2026 by Schwarz Digits reveals that the share of budgets rose for cybersecurity across German mid-market and enterprise businesses has more than doubled in just twelve months, surging from 8 to 17 percent. In a survey of 1,000 corporate leaders, nearly two-thirds (65 percent) expressed confidence in their cyber defences, rating their own readiness as good or very good.
Author: Stephano Bosman, Managing Director Netherlands, Belgium and Luxembourg at Schwarz Digits
Despite climbing security budgets, cyberattacks inflicted an unprecedented €202.4 billion in economic damage in Germany last year. The underlying issue runs far deeper than unpatched software or outdated firewalls: Many organizations still view cybersecurity as the only one dimension and don’t look at their digital resilience with more dimensions.
Digital resilience has many indispensable dimensions
True entrepreneurial resilience only comes into play when two different levels intertwine: the operational defense against acute cyberattacks and the protection against strategic, geopolitical and contractual loss of control of the data and cloud infrastructure. Cyber security includes reliable protection against compromised access data, seamless patch management, zero trust concepts and strict monitoring of third-party service providers, which are often the primary gateway for business failures. But operational defense is of little use if the technological foundation on which systems are operated is externally controlled. We need to keep control over the data sovereignty, interfaces and jurisdiction of basic infrastructure and should not risk al blockade of their own ability to act in a crisis.
Cyber Security Needs To Be Based On Digital Sovereignty
For the Benelux region’s highly integrated digital economy, where the Netherlands serves as the beating logistical and commercial heart, this disconnect between cyber security and digital sovereignty must serve as an urgent wake-up call. True resilience doesn’t only show by how swiftly a cashier's terminal reboots after a ransomware hit. What truly matters is who retains ultimate authority over critical data pipelines, core software, and infrastructure when a crisis strikes.
Today, that authority lies elsewhere. Approximately 80 percent of all European cloud and software expenditure still goes straight to US tech giants. This massive capital flight fuels a vicious cycle: European IT budgets directly finance the innovation moats of foreign hyperscalers, entrenching our continent in ever-deeper technological dependency.
The consequences are tangible and geopolitically sensitive. Extraterritorial laws like the US CLOUD Act or FISA make it legally impossible to guarantee that European data held by foreign providers remains shielded from overseas government access. If companies do not own and control their tech stack, operational independence exists only on paper.
A 13-Per-Cent Reality Gap
Most IT leaders recognise this hazard, yet very few act on it. According to the survey, 42 percent of enterprises explicitly say they would pay a premium for digitally sovereign solutions. Yet when it comes to capital allocation, actions fail to follow the intention: a mere 13 percent have dedicated budgets or roadmaps to dismantle their reliance on dominant foreign vendors.
Part of this paralysis stems from a long-standing dilemma: "digital sovereignty" has too often been brandished as a vague political slogan rather than a practical procurement framework. To turn rhetoric into measurable reality, our report adapted the European Commission’s Cloud Sovereignty Framework for business software, creating a framework to operationalize and measure digital sovereignty that evolved to the "European Sovereign Stack Standard".
When benchmarked against this standard, 27 commonplace enterprise tools revealed an uncomfortable truth: ten of them failed to meet even the absolute baseline requirements for digital sovereignty. They fell short due to foreign jurisdiction risks, opaque proprietary codebases, or globally outsourced development pipelines that cannot guarantee support on European soil. Closed SaaS ecosystems consistently lagged behind European open-source architectures and genuinely sovereign hosting alternatives.
A Pragmatic Roadmap to Digital Independence
Sovereignty should never be confused with technological isolation. No enterprise can or should replace global platforms overnight. Rather, the goal is to systematically reclaim leverage, control, and freedom of choice:
- Multi-Vendor Architectures: Dependencies must be managed proactively rather than endured. Prioritising open APIs, open-source building blocks, and standardised data formats ensures you can migrate workloads before vendor lock-in seals your fate.
- Sovereign Cloud Infrastructure: Resilient software demands a sovereign cloud foundation. Housing customer data locally is not enough; operational metadata, system telemetry, and administrative accounts must equally reside under European jurisdiction.
- Supply Chain Control: With NIS-2 raising the stakes, outsourcing security is no longer an option. Failing to audit Managed Service Providers and third-party software leaves an open backdoor into your most critical operations.
Alternatives in Practice
At Schwarz Digits, we embarked on this path out of business necessity. As the digital and IT division of Schwarz Group, which encompasses large retail companies Lidl and Kaufland, we faced a choice: either to accept that our core retail infrastructure hung on external platforms beyond our control, or to build our own secure, enterprise-grade digital backbone. Born out of the specific requirements of the Schwarz Group's enterprises, STACKIT was developed: the sovereign European Hyperscaler.
For decision-makers across Europe, 2026 might be the year we abandon reactive fire-fighting. Swelling your security budget will do little good if your core systems remain vulnerable to external leverage.
