Europe’s defence systems depend heavily on US cloud infrastructure, leaving key military functions exposed to potential service disruptions during geopolitical disputes, according to a new report.
Research published this month by the Future of Technology Institute (FOTI), a pan-European think tank focused on digital policy and infrastructure, finds that 23 out of 28 European countries rely on US cloud providers as part of their defence or security architecture.
Cori Crider, executive director at FOTI, said the findings point to a form of dependency that could be exploited in a crisis.
“Europe’s national defence systems are worryingly exposed to a US ‘kill switch’,” Crider wrote on LinkedIn.
This, Crider notes, is far from a “hypothetical threat.” In early 2025, US satellite imagery provider Maxar temporarily cut off Ukraine’s access to imagery used in its war effort. And in a separate case, sanctions imposed by the Trump administration on International Criminal Court (ICC) officials reportedly disrupted access to services provided by US tech firms, including email accounts linked to the court’s prosecutor.
“This should be a profound wake-up call for European governments,” Crider continued. “We need to diversify away from US tech and move towards sovereign solutions while we still can.”
Dependence runs deep
The report draws on open procurement data and public records to map cloud usage across European defence ministries. It concludes that more than three-quarters of countries studied have some level of dependency on US providers such as Microsoft, Google, and Oracle, either through direct contracts or via European contractors that build on US infrastructure.
In 16 countries, the exposure is classified as “high risk,” meaning defence systems depend directly on US firms or on technology that may not function independently if access were restricted. Germany, the UK, Poland, and Denmark are among those listed in this category.
Even where governments have sought to reduce reliance on foreign providers, the report finds that dependencies often persist beneath the surface. So-called “sovereign cloud” offerings — marketed as locally controlled systems — frequently still rely on US software or ongoing maintenance from American providers. Some of these systems are described as “air-gapped,” meaning they are intended to operate independently from a provider’s global cloud network. But they still require regular updates and support from US firms, raising questions about how long they would remain reliable if that access were cut off under political pressure.
The report concludes:
While European oversight over patches and updates is a welcome step towards sovereignty, even nominally air-gapped systems still require regular updates and depend on maintenance from their US service provider. If such maintenance is cut off by sanctions, the long-term reliability and safety of the technology is at risk.
Pressure to localise
The report arrives as European governments push more aggressively to reduce reliance on foreign technology across critical systems — a shift evident in both policy debates and real-world deployments.
More broadly, though, that shift is visible across the tech landscape, beyond government systems. European open source company Nextcloud recently published a “Digital Sovereignty Index,” a scorecard tracking adoption of self-hosted and locally controlled tools across organisations and sectors. Europe dominates the rankings, with all of the top 12 countries and 17 of the top 20 positions — a sign that alternatives to Big Tech are gaining traction, even if adoption remains uneven across the region.
Some governments are already translating that thinking into concrete projects. In Belgium, for example, authorities have rolled out a Matrix-based messaging platform for government communications, designed to reduce reliance on foreign-owned services and keep sensitive data within domestic or European-controlled systems.
These efforts remain uneven, and in many cases sit alongside continued reliance on US providers — a tension the report highlights throughout its findings. Crider also pointed to growing resistance from major cloud firms and their allies, who argue that moving away from US infrastructure is too complex or costly to be realistic.
“The goal is not immediate or total replacement,” Crider countered. “The goal is resilience, so our critical infrastructures can weather a storm. Inaction is by far the greater risk.”
And so the question is perhaps less whether Europe can replace US technology outright, and more how quickly it can reduce exposure in the systems that matter most.
A structural imbalance
The underlying issue, ultimately, is the concentration of the cloud market. US firms are estimated to control a large majority of Europe’s cloud infrastructure, giving them a central role in both commercial and public-sector systems.
That dominance has economic as well as strategic implications. Defence spending directed toward foreign providers represents a transfer of public funds abroad, while limiting the growth of domestic alternatives.
The report frames this as a long-term challenge rather than an immediate crisis. Migration away from entrenched systems won’t happen overnight, and in many cases, existing contracts and technical dependencies will be difficult to unwind.
“Migration will take time,” the report notes. “A transition to sovereign, cost-effective alternatives is possible. Beyond resilience, this would keep strategic investment within Europe and could catalyse a virtuous cycle: state investment in European cloud providers would stimulate more domestic business in Europe.”
As digital infrastructure becomes more tightly integrated with national security, governments are beginning to reassess where control ultimately sits — and what happens if that control is exercised from outside their borders.
For now, the report concludes, Europe’s defence cloud remains exposed to external pressure, with resilience dependent not just on technology, but on the political relationships that underpin it.
