Interview Sovereignty remains a hot topic in the tech industry, but interpretations of what it actually means – and how much it matters – vary widely between organizations and sectors. While public bodies are often driven by regulation and national policy, the private sector tends to take a more pragmatic, cost-focused view.

That tension has pushed cloud and virtualization platforms that position themselves as alternatives to US hyperscalers into sharper focus. One such company is OpenNebula, a cloud and virtualization management platform designed to run across a wide range of infrastructures, from on-premises environments to public clouds including Amazon Web Services and European providers like Scaleway.

Founded in 2008, OpenNebula will turn 18 in 2026, but recent geopolitical shifts and regulatory pressure have pulled it squarely into debates around cloud sovereignty – particularly in Europe, where questions of control, jurisdiction, and vendor dependence have become increasingly urgent.

The Register spoke with OpenNebula managing director Ignacio Llorente about how definitions of sovereignty differ between the private and public sectors, and why demand for “sovereign” cloud solutions is rising – even among organizations that have traditionally prioritized cost and convenience over control.

With regard to the pragmatic approach historically taken by the private sector, Llorente says: “They are more cost-driven, they don’t consider sovereignty as a key thing… it’s more about ‘this is my RFP, you have to fulfill these requirements.'” One of those requirements could increasingly be a sovereign solution.

“But if you go into the public [sector],” he says, “it is completely different. For example, they are giving priority for defense. They are giving priority to sovereignty.

“And they say, ‘OK, that’s good. We have to start comparing solutions. But my first step, I’m going to keep only those solutions that are sovereign.'”

Which brings us to what “sovereign” means. “I think one of the problems we have right now,” says Llorente, “is that there is not a common definition for sovereignty.”

Differing definitions don’t occur only company by company, but also at the geographical level. “It’s in the EU, it is open,” he says. “In other cases, it’s not.” He cites the example of the US. “We have customers in the US, and they discuss sovereignty. In the US, the sovereignty concept is more about on-prem and open source. It’s about a sovereignty that I [the customer] can control.

“You go to the EU… ‘OK, this is the thing, plus technology that is developed in the EU.'”

Calls for EU firms to move away from US hyperscalers and opt for an EU-native approach continue to increase in volume and are also the subject of regulations. While businesses will lean toward what makes the most sense from a bottom-line perspective, many are increasingly thinking local when it comes to cloud computing.

Having noted the pragmatic nature of business, Llorente echoes sentiments expressed by Nextcloud and the UK cloud provider CIVO. “We have been receiving an exponential number of requests,” he says, before cautioning: “This will take three, four, five years because of the multi-year term of the subscription licenses in different companies.”

Llorente reckons that, given the geopolitical environment, interest will accelerate further. “Probably, in 2027, we’ll have the peak.”

Of OpenNebula’s definition, he says: “Ours is not only about where the servers are located. Sovereignty is about who controls the platform, who owns the technology stack, who can make decisions about the infrastructure, and even who controls the energy.”

In a January blog post, Llorente said 2025 had been a year “shaped by major market shifts” and “rapid adoption.” Having an open, sovereign, enterprise-ready virtualization and cloud platform hasn’t hurt when it comes to scooping up customers looking for an alternative to VMware, as well as organizations looking for something a little more vendor-neutral.

Most recently, OpenNebula became available on OVHcloud as production-ready environments. Other companies, such as SUSE, are also banging the sovereignty drum with increasing volume, recently launching a tool to assess how an organization stands against the objectives defined by the EU Cloud Sovereignty Framework.

Llorente says he is frequently asked to recommend platforms. For entities eyeing EU regulations, SUSE (which operates out of Germany) may be attractive.

“If you go to the public cloud, the priority for the European Commission is to reduce the dependence on a small number of foreign platforms. If you go private, the big issue is the VMware acquisition by Broadcom.”

An open solution that addresses a potential sudden increase in licensing costs resulting from the acquisition could also be a sovereign one.

“In private cloud, it’s mostly driven by VMware’s acquisition by Broadcom,” says Llorente. “They have one year to manage the migration, and they are now starting to evaluate different alternatives, and they don’t want to make the same mistake… they want to adopt something that is open.”

The pragmatism of the private sector should not be overlooked in debates about sovereignty. It could be that Broadcom’s antics have as much effect on how an organization deals with its cloud needs as the reaction to other antics in certain political offices. ®

Following a series of high-profile cyberattacks, boards of directors are now requiring their organizations to take greater responsibility for the risks posed by enterprise resource planning (ERP) systems pose after a series of high-profile cyberattacks. The Jaguar Land Rover (JLR), incident in Sept. 2025 illustrates the severe consequences of such attacks. The cyberattack forced JLR to halt production for six weeks, making it the costliest cyberattack in Britain’s history. The company’s revenue declined 24 percent that quarter, accounting for potentially over a  $1.2 billion drop in earnings, and subsequently reported a 43.3% wholesale sales volume drop the following quarter.

For decades, organizations have treated ERP systems like SAP as back-office workhorses. However, the JLR incident—carried out by executed by the cybercrime group ShinyHunters —has thrust ERP systems into the spotlight. That shift in attention is critical: today, 90% of the Fortune 500 use SAP, making these systems “crown jewel” assets that require the highest level of protection.

The threat is escalating. A recent Google Cloud Security report forecasts that ransomware operations specifically designed to target critical enterprise applications such as ERP systems will emerge in 2026, forcing organizations to make quick ransom payments and sacrifice business resilience. 

In our roles as board members, advisers, and cybersecurity CEOs, we’re witnessing a fundamental shift in how organizations approach ERP security: the conversation has moved from compliance to survival. Organizations are grappling with critical question: Who owns the risk? What is our recovery time? Can we patch critical ERP vulnerabilities within 72 hours? Do we have visibility inside the application?

ERP risks are an existential threat

To understand the severity of ERP security risks, the C-suite must first recognize how critical these sytems are. ERP systems are the operating system of modern businesses: They process  invoices, manage supply chains, record revenue, pay employees, ship products, and more. The scale is staggering: SAP’s customers alone are responsible for 84% of the world’s commerce. – Given this ubiquity, if your organization’s leadership can’t confirm whether you’re using SAP, you almost certainly are.

In 2025, more than 500 companies fell victim to the SAP NetWeaver zero-day vulnerability. This attack underscores what many security practitioners have warned: ERP application security has evolved from a ‘nice to have’ to a business-critical necessity.

When Stoli Group’s US subsidiaries filed for bankruptcy in 2024 following a ransomware attack on its ERP system, it demonstrated a stark reality: losing these system can lead to a company shutting its doors. When an organization’s central nervous system goes offline, the entire business stops functioning.

Unfortunately, the adversaries understand this inherent leverage better than we do. According to Onapsis research, SAP vulnerabilities grew by 39 percent in 2025. The cybercriminal marketplace price for SAP exploits has grown 400% (to more than $250,000) since 2020, which reflects the immense ROI of holding a Fortune 500 company’s operational capacity hostage.

The timeline for defense has become critically compressed. In 2025, threat actors are exploiting SAP security vulnerabilities within 72 hours of patch releases. Unprotected ERP systems deployed in the cloud are discovered and compromised in less than 3 hours. Meanwhile, the average enterprise patch cycle takes weeks or even months due to the rigorous testing required for complex, customized ERP environments. This mismatch creates a dangerous window of vulnerability.

The regulatory compliance vise

Boards face mounting pressure from an increasingly stringent global regulatory environment focused on securing critical data and infrastructure. ERP systems house multiple types of highly regulated data simultaneously—including financial records, personal employee information, customer data, and supply chain details—making them a focal point for regulatory scrutiny.

For public companies in the United States, Sarbanes-Oxley (SOX) requires attestation of financial reporting. The security of ERP systems is a SOX control issue because a breach could cause the efficacy of these systems to be compromised.

In the European Union (EU), GDPR regulations penalize companies that fail to protect personally identifiable information (PII). ERP systems house the vast majority of employee and customer data.

SEC disclosure rules in the United States and two other EU regulations, NIS2 and DORA, have introduced personal liability for board members and executives who fail to oversee their cybersecurity risks. A director can no longer say, “I didn’t understand the technical details.” Ignorance is now a legal liability.

A boardroom playbook for ERP resilience

As board members and advisors to multiple companies and audit committees, we have three key expectations for how organizations should approach ERP security.

First, boards need risk presented in dollar terms. Instead of asking for money to “patch technical vulnerabilities,” CISOs should tell the board exactly how much revenue is at risk. When requesting budget to secure SAP, frame it as an investment to protect specific revenue streams. This helps boards understand what they stand to lose, not just what they need to spend.

Second, stop treating security and productivity as opposing forces. Yes, patching systems might cause a brief disruption. But that minor inconvenience is nothing compared to the catastrophic impact of a total system lockout like the one ShinyHunters executed against JLR. CISOs should partner with CIOs to deploy automated monitoring tools that can detect potential exploits and prioritize patches for the most critical ERP vulnerabilities.

Third, someone must own responsibility for protecting these “crown jewel” systems. Too often, there’s a gray area between the CISO (who sets security policy), the CIO (who manages the technology infrastructure), and the ERP vendor. Boards must demand a clear shared responsibility model that defines who is accountable for what. It’s important to note that ERP vendors are not responsible for securing the application and data once deployed—which makes clear internal ownership even more critical.

Board members should be demanding answers to these questions: Do we have visibility into our ERP risk? Would we have visibility into an active attack?

We must assume a breach will happen. The only way to validate resilience is to test it. Boards should mandate tabletop exercises specifically designed around an ERP ransomware scenario, asking further questions like, “How do we communicate with suppliers?,” “How do we build and ship our products?,” “How do we make payroll?,” and “How do we restore from immutable backups if the primary data is compromised?”  Organizations must test their resilience before a crisis strikes, not during one.

A license to operate

The Jaguar Land Rover compromise was a watershed moment because it stripped away the illusion that our core systems are safe behind firewalls. Attackers have shifted their focus to critical business systems. They’ve professionalized their operations and dramatically increased the speed of their attacks.

For the C-suite and boards, the era of plausible deniability is over. Security is no longer just an IT expense; it’s what keeps your doors open. If you cannot protect the integrity of your financial data and the continuity of your supply chain, you do not have a viable business.

Just as boards have visibility into risk, CISOs should have visibility into all ERP instances. Organizations require four critical capabilities: discovery (identifying all ERP systems), assessment (finding vulnerabilities such as missing patches, weak configurations, and insecure custom code), real-time monitoring (detecting suspicious activity that may indicate an attack), and incident response (being able to quickly investigate and contain an ERP incident).

The decisions made in the boardroom today will affect the outcomes tomorrow. The next JLR-like event is most likely already unfolding. The only variable is whether your organization will be the next cautionary tale or the defender that held the line.