That's the answer that almost every European company gives when asked about cloud security. According to Clémence Caron, however, it's worth almost nothing. The real question is never where your data sits. It's who can be compelled to access it, regardless of the server's location. In this episode of Follow the White Rabbit, Link11 CISO Kofi Osae-Attah sits down with Clémence Caron, a cloud and AI security specialist at Google Cloud. Clémence started her career engineering security for naval vessels. In this episode, she and Kofi talk about what digital sovereignty requires and how checkbox compliance is quietly letting through.

The conversation is refreshingly candid, especially for someone who works for a hyperscaler. Clémence doesn't sell sovereignty as a product. She frames it as a risk-tiered decision that depends entirely on what you're protecting and from whom. Her thesis is clear: You can't fight AI-speed attacks with human-speed defenses. However, before companies can implement automated detection, they must first address issues that cost almost nothing, such as misconfigured service accounts. Misconfigured service accounts, Shared admin privileges. They lack a documented incident response process. These are the basics that, if done right, would stop most attacks before they start.

The sharpest moment comes when Kofi asks whether real digital sovereignty is achievable. Her answer differs from what cloud marketing would tell you: You'll never be fully independent, and that's probably fine, if you choose your risks wisely. Sovereignty isn't a checkbox or a setting. It's a series of deliberate decisions about what you need to protect, what you're willing to lose, and how quickly you can recover if something goes wrong.

1. Location does not equate to control. Data stored in a European data center can still be accessible under foreign law. The important questions are who can be compelled to access the data and whether encryption and key management can prevent that access.
2. You cannot fight AI-speed attacks with human-speed responses. A human analyst looking at 500 alerts per minute will always be too late. Automation is no longer optional. However, none of this matters if your service accounts have admin access to everything.
3. The basics are still the first line of defense: Least privilege. Patching. Key rotation. Documented incident response. These measures aren't exciting, but they stop most attacks before they can be detected. They're also inexpensive.
4. Compliance is a starting point, not a finish line. Certifications can force companies to start thinking about security. However, if the goal is merely to check a box rather than to understand risk, you've created paperwork, not protection.
5. Sovereignty is a spectrum, not an on/off switch. From public cloud with managed encryption to fully air-gapped on-prem, there is no single right answer. The right answer depends on what needs to be available and confidential and how quickly you can recover if something goes wrong.

Subscribe to Follow the Rabbit

If this episode changed the way you think about cloud security, digital sovereignty, or the difference between compliance and real protection, share it! Subscribe on your preferred platform and share it with your cloud and compliance teams, as well as with anyone who thought that keeping data in Europe was sufficient.

Clémence Caron – Cloud & AI Security Specialist, Google Cloud

CLOUD Act – US Law & Its Implications for European Data

BSI: Cloud Computing Security Recommendations

There are 1.6 million infected machines. Hundreds of millions in damage. The engine behind the world's worst ransomware disappeared overnight. The man who spent a year and a half making that happen says the secret weapon was chaos. His team was disorganized, unpredictable, and sometimes unreliable. Some nights, the man leading the charge was just out drinking beer. Brian Hein argues that this is exactly why the criminals couldn't beat them. In this episode of Follow the White Rabbit, Link11 CISO Kofi Osae-Attah sits down with Brian, a threat researcher, DNS intelligence analyst, and contributor to the World Economic Forum's Cybercrime Atlas, to talk about what it actually took to kill Emotet.

Brian likes to ask rooms full of security professionals a question: If your company shut down its threat intelligence program tomorrow, would the criminals even notice? His argument is uncomfortable yet precise. Most of what the security industry produces is performative theater: reports that no one reads, dashboards that no one acts on, and indicators that no one uses. He calls it negligent intelligence theater. Real impact, he says, looks different. It resembles an uncontrollable coalition of carriers, researchers, and law enforcement, each chipping away at the same problem from different angles. None of them coordinate perfectly, and that's the point.

The conversation also goes in an unexpected direction: the human infrastructure behind cybersecurity. Trust groups die out when no one brings in new blood. Conferences where a 45-year-old is one of the youngest people in the room. It discusses how geopolitics fractures longstanding alliances and why recipes for hummus and maple syrup candies are sometimes the fastest way to rebuild them. Brian's message to the next generation at their first hacker congress is that there is no wall. There is no door. Just walk in.

1. Disorganization was the weapon. The Emotet coalition worked precisely because it was unpredictable. When Brian was unavailable because he was at a bar, the attack patterns shifted. Criminals can't model chaos. That lesson scales.
2. Most threat intelligence is theater. Reports are skimmed. Dashboards are ignored. The important question is whether your work influenced a decision. If not, you're producing performance art.
3. Board communication is storytelling, not reporting. Brian reframed Emotet as taking out a hostile competitor with a $2 billion revenue pipeline, which got executive attention. That got the attention of executives. The technical details weren't necessary.
4. The community is one retirement wave away from a knowledge crisis. The pandemic eliminated travel budgets. Conferences are filled with the same senior professionals. Junior professionals aren't being brought in, and trust groups can't survive without new blood.
5. Attribution matters, but not to everyone. To a board member, whether it was Paul from South Dakota or a North Korean state actor makes no difference. However, it matters enormously to law enforcement and policy. Know your audience before opening your report.

Subscribe to Follow the Rabbit

If this episode made you think differently about the purpose of threat intelligence and who it serves, share it. Subscribe on your preferred platform, leave a review, and share it with the next junior analyst who hasn't attended a conference. They need to hear how this conversation ends.

Brian Hein – Threat Researcher, DNSFilter | World Economic Forum Cybercrime Atlas | Former Deutsche Telekom

DNSFilter – Secure DNS & Threat Intelligence

WEF_Cybercrime_Atlas_Impact_Report_2025.pdf

Europol: Operation LadyBird – Emotet Takedown