Keepit has released a new report — Data Sovereignty: Take Control of Your Data — along with expert commentary from CISO Kim Larsen that breaks down why sovereignty has moved beyond compliance and is now a core security and resilience concern. The report notes that many organizations believe sovereignty is a legal or CIO priority, but the research shows it is increasingly a security architecture challenge.
Key Themes: The research highlights several issues now directly impacting SOC, IR, and cyber-resilience teams:
- Hyperscaler monoculture = single points of failure. 97% of cloud infrastructure sits with a handful of providers, creating systemic risk when outages or misconfigurations cascade across SaaS, identity, and backup platforms.
- CLOUD Act + Schrems II = conflicting access rules. Security teams must defend information that may be legally accessible to foreign jurisdictions — even when stored in-region.
- Hybrid warfare is targeting cloud identity and control planes.
The report details growing APT activity against cloud identity providers and the risk of dependent ecosystems failing simultaneously. - Most SaaS backups rely on the same hyperscalers as production.
Making “air-gapped” recovery impossible in many breach or outage scenarios. - Regulators are raising the bar on resilience.
Under DORA, NIS2, BaFin, and CNIL/ANSSI guidance, CISOs must demonstrate independence, portability, and provable control — not just encryption and regional storage.
Why this is timely for security practitioners
- Attackers are exploiting cross-cloud dependencies.
- Resilience mandates are forcing redesigns of backup + identity strategy.
- EU regulators are signaling that US-controlled clouds may not meet sovereignty requirements for healthcare, public sector, and critical infrastructure.
- Organizations are reassessing “cloud-by-default” models and returning to hybrid or sovereign-cloud setups for high-value assets.
Report Download:
https://www.keepit.com/data-sovereignty-in-the-cloud/
Expert Commentary:
https://www.keepit.com/blog/data-sovereignty-report
2026 Technology Predictions from Starburst
Posted in Commentary with tags Starburst on November 25, 2025 by itnerdHere’s some 2026 Industry Predictions by Justin Borgman, CEO and Cofounder, Starburst.
The Rise of Human-and-Machine-Centered Data Ecosystems – “We’re moving toward a world where data platforms won’t primarily serve people anymore; they’ll serve machines. The new consumers of data are AI agents, which will increasingly drive decisions, generate insights, and automate processes at speeds humans can’t match. These AI agents will require direct, governed, real-time access to all enterprise data to reason, generate, and act effectively. As AI agents become the primary consumers, enterprises must decide whether their data governance models empower or constrain them. This shift fundamentally changes everything about how we build and operate data infrastructure, from architecture and pipelines to governance and security, demanding a new approach that prioritizes machine-first accessibility without sacrificing trust or compliance.”
Hybrid AI Becomes the New Default – “The ‘cloud-everything’ era is coming to an end. Data gravity, sovereignty laws, and inference cost control are drivers for on-premises and model-to-data architectures. Enterprises are realizing that critical AI workloads need to remain close to their data, whether on-premises or in hybrid environments, to meet stringent requirements for performance, compliance, and data sovereignty. As a result, DevOps and data teams will increasingly build intelligent, governed ‘AI factories’ inside the enterprise, integrating AI pipelines directly with existing systems rather than relying solely on public cloud services. This approach ensures organizations can scale AI responsibly while maintaining control over sensitive information and operational efficiency.”
The Real Battle Moves Above the Data Format – “The last decade was about standardizing how we store data; the next is about standardizing how we trust it. With open table formats like Iceberg now widely adopted as the standard, the next competitive frontier isn’t the format itself. It’s the management of metadata, governance, and secure access. AI explainability depends on how well metadata is managed. Enterprise success will hinge on how effectively DevOps and data teams curate data catalogs, enforce policies, and provide federated access across diverse environments. Without unified metadata and policy, enterprises risk an AI compliance crisis. It’s no longer just about where the data lives; it’s about how intelligently it can be accessed, trusted, and leveraged to drive actionable outcomes.”
DevOps for Machines, Not Just Humans – “DevOps is evolving beyond its traditional focus on deploying applications. DevOps for machines means governing the real-time interaction between AI agents and enterprise data, with the same rigor once reserved for production apps. Modern teams will now treat data and AI pipelines as mission-critical workloads, ensuring that AI agents have real-time, governed access to enterprise data while maintaining reliability, security, and observability at scale. DevOps for machines is about managing the data-to-action lifecycle, not model training pipelines. Humans remain responsible for defining access, policy, and safety nets. For example, tomorrow’s DevOps teams will monitor not only application uptime, but also AI decision health to ensure agents operate within defined parameters. This evolution requires a new mindset: one where DevOps teams are responsible for orchestrating an ecosystem in which machines, not just humans, can operate safely, efficiently, and autonomously.”
Leave a comment »