For much of the past two decades, digital security was framed as a contest at the perimeter. The chief worry was unauthorised access: phishing campaigns, ransomware, software vulnerabilities, state-backed espionage and the steady monetisation of stolen data. Those threats remain serious. But by mid-2026 a subtler and in some respects more consequential problem has moved to the foreground. The question is not merely whether a system can repel an attacker. It is whether a society can continue to operate when the infrastructural layers beneath its digital life are concentrated, extra-territorial, contractually opaque or geopolitically exposed.
That shift matters because the digital economy has become more capable and more brittle at the same time. Governments depend on cloud platforms for routine administration, hospitals rely on software-mediated logistics, manufacturers depend on scarce chipmaking capacity, and financial and communications systems traverse a surprisingly small number of undersea routes and service providers. In each case, performance has improved through scale and specialisation. Yet resilience has often deteriorated through concentration. Security, in other words, is increasingly about chokepoints.
From cyber defence to continuity of function
The older model of cyber policy distinguished between safety, privacy and security. Today those categories overlap with continuity. A hospital hit by ransomware is not simply a victim of crime; it is an institution whose ability to deliver care may be impaired. A cloud-region outage is not only a technical failure; it can interrupt licensing systems, benefit payments, planning portals, supply chains and customer support across multiple sectors at once. The core issue is systemic dependence.
This is one reason why policy frameworks have broadened. In Europe, the NIS2 Directive and the Critical Entities Resilience framework both point beyond narrow information-security compliance towards operational robustness and cross-sector preparedness. NIST's Cybersecurity Framework 2.0 likewise places governance and resilience more centrally than earlier debates often did. The language of resilience has become ubiquitous not because policymakers have lost interest in cyber attacks, but because they increasingly recognise that digital disruption now propagates through economic and administrative systems rather than remaining contained within IT departments.
The central security problem of the digital economy is shifting from intrusion to interruption.
The hidden architecture of dependency
Most organisations can name their direct suppliers. Far fewer can map the deeper layers on which those suppliers depend. A municipal service may contract with a software company that relies on a hyperscale cloud provider, which itself depends on a specific identity service, networking architecture, set of chip vendors and handful of data-centre regions. A manufacturer may diversify among software integrators while still relying on a single advanced-node semiconductor ecosystem. What appears competitive at the surface may be concentrated beneath.
This opacity complicates governance. Boards often receive cyber dashboards full of patching metrics, phishing simulations and incident-response timings, yet little structured discussion of concentration risk in compute, storage, model provision, connectivity or machine-tool supply. Procurement regimes are commonly designed to obtain value and functionality, not to expose latent systemic fragility. In consequence, public and private institutions may inherit the resilience profile of infrastructure they do not control and barely see.
The strategic implications are obvious. If too many essential services share the same technical substrate, failures cease to be idiosyncratic. They become correlated. A legal dispute, sanctions event, export restriction, cable disruption or software bug can ripple across sectors that believed themselves unrelated.
Cloud concentration is becoming a public-policy problem
Cloud computing illustrates the dilemma. The efficiencies are real: vast capital expenditure, mature security tooling, global availability and a pace of innovation that few individual organisations could replicate in-house. For many workloads, hyperscale infrastructure is safer than poorly managed local servers. Yet this truth can obscure another. The more administrative and commercial life migrates to a narrow set of providers, the more those providers become quasi-public infrastructure, even if they remain private firms operating under commercial terms and foreign legal jurisdictions.
The central security problem of the digital economy is shifting from intrusion to interruption.
That does not mean states should seek to nationalise or duplicate entire cloud stacks. Such ambitions would be costly and often unrealistic. It does mean, however, that resilience requires a clearer distinction between efficient outsourcing and strategic dependency. Data residency, workload portability, escrow provisions, open standards, interoperability testing and exit planning are no longer niche procurement concerns. They are instruments of national and institutional resilience.
The difficult point is that concentration can deepen even when customers believe they have diversified. Using several software vendors does not amount to redundancy if they all run on the same cloud substrate. Nor does a multi-cloud strategy guarantee resilience if identity, observability or AI services remain centralised in practice. Technical architecture and contractual architecture often diverge.
Semiconductors turn resilience into industrial policy
No chokepoint better demonstrates the fusion of economics and security than semiconductors. Advanced chips are not merely components; they are enabling infrastructure for defence systems, industrial automation, medical equipment, consumer electronics and increasingly artificial intelligence. The supply chain that produces them is geographically distributed but highly uneven, with critical capabilities concentrated in a small number of jurisdictions and firms. Design tools, fabrication equipment, materials and cutting-edge manufacturing each create their own dependencies.
This helps explain why semiconductor policy now sits at the junction of security, trade and industrial strategy. The US CHIPS and Science Act, European initiatives to expand fabrication and broader allied efforts to secure supply all reflect an uncomfortable recognition: market efficiency alone does not guarantee strategic continuity. A disruption in fabrication capacity, export controls on tooling, or prolonged shortages in mature-node chips can have outsized effects far beyond consumer electronics.
Yet the policy challenge is not simply to build more fabs. Resilience in semiconductors includes packaging, testing, specialist chemicals, talent pipelines, power reliability and long-term demand signals. It also requires candour about what cannot be localised. For most countries, sovereign capability in chips will mean selective competence and trusted access, not comprehensive self-sufficiency.
A system can be well defended against hackers and still be dangerously fragile if its essential dependencies are too concentrated to fail.
Cables, landing stations and the geography of fragility
The digital world is often described as immaterial. In reality, it rests on very physical infrastructure. Undersea cables carry the overwhelming share of intercontinental data traffic. Their routes, landing stations and repair capacities are strategic assets, even if they attract less public attention than satellites or data centres. Recent years have made plain that cable disruption, whether accidental or deliberate, can become a matter of national security and alliance coordination.
The vulnerability is not just at sea. Terrestrial backhaul networks, power systems, coastal landing points and maintenance vessels all matter. So do ownership structures and the legal frameworks governing access, repair and surveillance. Many states discovered late that they had robust cyber strategies but underdeveloped plans for communications continuity if a small number of physical links failed or became contested.
Resilience here depends on redundancy, route diversity, repair readiness and realistic exercises. It also depends on governance. Private operators build and maintain much of this infrastructure, but states bear the political consequences when connectivity is disrupted. The relationship between the two has therefore become more strategic and, inevitably, more scrutinised.
Artificial intelligence adds a new layer of dependency
By 2026 AI has become a resilience issue in two distinct senses. The first is familiar: AI systems create new attack surfaces, amplify fraud, accelerate vulnerability discovery and complicate the authentication of text, audio and video. The second is less discussed: access to frontier models and the compute required to train or deploy them is becoming a dependency in its own right. Organisations integrating AI into customer service, analysis, coding or administrative workflows may lock themselves into providers whose pricing, policies, availability or legal exposure they do not meaningfully influence.
A system can be well defended against hackers and still be dangerously fragile if its essential dependencies are too concentrated to fail.
This matters because AI is increasingly being woven into routine operations rather than experimental sandboxes. Once embedded in document processing, decision support, software maintenance or detection pipelines, model outages and abrupt policy changes can become operational incidents. The EU AI Act has pushed governance questions to the fore, but compliance is only one part of the story. Institutions also need to ask whether essential workflows can continue if a model provider changes terms, restricts access, withdraws a feature or becomes embroiled in a cross-border legal dispute.
The risk is not only vendor lock-in. It is a wider concentration of capability in compute-rich firms and jurisdictions. For countries without domestic access to advanced chips, large-scale compute and specialised talent, AI dependency can reinforce existing asymmetries in economic and administrative power.
Resilience is now a matter for treasuries and cabinets
The emerging chokepoint agenda cannot be managed by chief information security officers alone. It touches procurement, competition policy, industrial incentives, trade relationships, public-sector architecture and emergency planning. In practical terms, this elevates digital resilience from a technical function to a cabinet-level concern. Ministries of finance and economy care because outages and supply disruptions now have macroeconomic effects. Competition authorities care because market structure may shape systemic risk. Defence establishments care because civilian infrastructure underpins military readiness. Central banks care because financial continuity relies on technology providers outside the traditional perimeter of financial regulation.
This broader lens changes what preparedness looks like. The relevant questions are not only whether logs are collected or endpoints monitored, but whether critical services can degrade gracefully; whether substitute suppliers exist; whether legal rights to data extraction and migration are tested; whether institutions know which cables, regions, fabs and open-source components they truly depend upon; and whether cross-border crisis coordination is plausible under stress.
The uncomfortable economics of redundancy
If dependence is the problem, redundancy appears to be the obvious answer. But redundancy is expensive, and digital markets have long rewarded consolidation, standardisation and just-in-time optimisation. Building spare capacity, maintaining failover arrangements, paying for secondary providers and validating portability all impose costs that are easy to defer in good times. The result is a familiar pattern: efficiency gains are privatised, while the costs of systemic failure are socialised when disruption occurs.
This is why resilience often lags behind risk awareness. Boards and ministries may acknowledge concentration without funding meaningful alternatives. Procurement officers may seek lower prices from the very scale providers whose dominance creates the fragility. The market signal remains inconsistent. Resilience is praised rhetorically but underpurchased operationally.
There is no simple remedy. Some redundancy should be mandated in critical sectors; some should be incentivised; some will only emerge through competition and open standards. The important point is conceptual. Resilience is not free, and pretending otherwise encourages dependency to deepen until it becomes politically salient in a crisis.
What a serious dependency audit looks like
Many institutions now conduct cyber assessments. Far fewer conduct dependency audits with equivalent rigour. A serious audit would begin by identifying functions that must continue under strain: payments, emergency communications, clinical operations, logistics, identity verification, records access, regulatory reporting. It would then map the technical and contractual layers supporting those functions, including cloud regions, core software libraries, telecoms links, chip inputs, authentication services and specialised external teams.
Such an exercise often reveals awkward truths. The organisation that thought it had diversified may discover common points of failure. The public agency that believed it controlled its data may find extraction slow, costly or operationally risky. The manufacturer that held safety stock may realise that a single packaging or tooling bottleneck could still halt production. Dependency audits also expose governance gaps: who can trigger migration, who understands the contracts, who owns supplier relationships during a crisis, and which assumptions have never been tested in rehearsal.
What matters is not perfection but visibility. One cannot reduce strategic dependence that remains hidden behind service abstractions and procurement paperwork.
Sovereignty in technology does not require autarky, but it does require a credible ability to endure coercion, outage and delay.
Open-source software: resilience asset and liability
No account of digital chokepoints is complete without open-source software. It underpins critical systems across government and industry, often with remarkable efficiency and adaptability. In many respects, open source strengthens resilience by reducing reliance on proprietary lock-in and enabling inspection, modification and community repair. Yet it also introduces a paradox. The most widely used components may be maintained by small teams with limited funding, uneven governance and fragile succession plans.
Incidents over recent years have shown that obscure libraries can become globally consequential overnight. The problem is not that open source is inherently insecure. It is that critical dependence has outgrown the stewardship models supporting some of the software on which entire sectors rely. Governments have begun to respond with software bill of materials requirements, secure development guidance and targeted support, but the underlying issue persists: common digital goods are often treated as free until their fragility becomes impossible to ignore.
A mature resilience strategy therefore distinguishes between openness and neglect. Open ecosystems can be strategic assets, but only if institutions invest in maintenance, code assurance and governance rather than merely consuming the output.
Alliances matter more than autonomy slogans
The language of digital sovereignty can mislead if it implies clean national independence. Modern technology systems are too interdependent, capital-intensive and globally integrated for most states to achieve meaningful autarky. The practical objective is not independence from all external infrastructure. It is the ability to withstand pressure, negotiate from a position of knowledge and preserve core functions during disruption.
That points towards selective capacity at home and trusted interdependence abroad. For Europe, Japan, South Korea, the United States and other partners, resilience will depend on standards cooperation, supply-chain transparency, export-control coordination, reciprocal market access and shared crisis planning. Smaller states in particular need alliances that reduce single-point dependence without forcing impossible duplication.
There is a strategic distinction here between sovereignty as symbolism and sovereignty as endurance. The former speaks in grand terms about control. The latter asks harder questions about backup routes, substitutable inputs, legal enforceability and repair times.
Sovereignty in technology does not require autarky, but it does require a credible ability to endure coercion, outage and delay.
The next doctrine of security
The most important consequence of the chokepoint era is doctrinal. Security can no longer be defined chiefly as the protection of networks against malicious intrusion. It must be understood as the capacity of a technologically mediated society to continue functioning amid attack, accident, scarcity and geopolitical friction. That is a broader and less comfortable definition because it implicates market structure, industrial capability and public administration as much as technical controls.
By mid-2026, the institutions taking this seriously are beginning to reorganise accordingly. They are mapping dependencies beneath the application layer, treating procurement as a security instrument, linking cyber planning with physical infrastructure continuity, and examining whether concentration risk has quietly become a form of strategic exposure. They are also recognising a final truth: complexity itself is now a security variable. The more invisible layers a society depends on, the more important it becomes to know which of them can fail without bringing everything else down.
That is the new resilience agenda. It is less dramatic than the cinematic language of cyber war, but more relevant to the daily functioning of states, firms and citizens. The future of digital security may hinge not on the next spectacular breach, but on whether the infrastructures everyone assumed would always be there can still be counted on when politics, physics or markets intervene.
