That's the answer that almost every European company gives when asked about cloud security. According to Clémence Caron, however, it's worth almost nothing. The real question is never where your data sits. It's who can be compelled to access it, regardless of the server's location. In this episode of Follow the White Rabbit, Link11 CISO Kofi Osae-Attah sits down with Clémence Caron, a cloud and AI security specialist at Google Cloud. Clémence started her career engineering security for naval vessels. In this episode, she and Kofi talk about what digital sovereignty requires and how checkbox compliance is quietly letting through.

The conversation is refreshingly candid, especially for someone who works for a hyperscaler. Clémence doesn't sell sovereignty as a product. She frames it as a risk-tiered decision that depends entirely on what you're protecting and from whom. Her thesis is clear: You can't fight AI-speed attacks with human-speed defenses. However, before companies can implement automated detection, they must first address issues that cost almost nothing, such as misconfigured service accounts. Misconfigured service accounts, Shared admin privileges. They lack a documented incident response process. These are the basics that, if done right, would stop most attacks before they start.

The sharpest moment comes when Kofi asks whether real digital sovereignty is achievable. Her answer differs from what cloud marketing would tell you: You'll never be fully independent, and that's probably fine, if you choose your risks wisely. Sovereignty isn't a checkbox or a setting. It's a series of deliberate decisions about what you need to protect, what you're willing to lose, and how quickly you can recover if something goes wrong.

1. Location does not equate to control. Data stored in a European data center can still be accessible under foreign law. The important questions are who can be compelled to access the data and whether encryption and key management can prevent that access.
2. You cannot fight AI-speed attacks with human-speed responses. A human analyst looking at 500 alerts per minute will always be too late. Automation is no longer optional. However, none of this matters if your service accounts have admin access to everything.
3. The basics are still the first line of defense: Least privilege. Patching. Key rotation. Documented incident response. These measures aren't exciting, but they stop most attacks before they can be detected. They're also inexpensive.
4. Compliance is a starting point, not a finish line. Certifications can force companies to start thinking about security. However, if the goal is merely to check a box rather than to understand risk, you've created paperwork, not protection.
5. Sovereignty is a spectrum, not an on/off switch. From public cloud with managed encryption to fully air-gapped on-prem, there is no single right answer. The right answer depends on what needs to be available and confidential and how quickly you can recover if something goes wrong.

Subscribe to Follow the Rabbit

If this episode changed the way you think about cloud security, digital sovereignty, or the difference between compliance and real protection, share it! Subscribe on your preferred platform and share it with your cloud and compliance teams, as well as with anyone who thought that keeping data in Europe was sufficient.

Clémence Caron – Cloud & AI Security Specialist, Google Cloud

CLOUD Act – US Law & Its Implications for European Data

BSI: Cloud Computing Security Recommendations

There are 1.6 million infected machines. Hundreds of millions in damage. The engine behind the world's worst ransomware disappeared overnight. The man who spent a year and a half making that happen says the secret weapon was chaos. His team was disorganized, unpredictable, and sometimes unreliable. Some nights, the man leading the charge was just out drinking beer. Brian Hein argues that this is exactly why the criminals couldn't beat them. In this episode of Follow the White Rabbit, Link11 CISO Kofi Osae-Attah sits down with Brian, a threat researcher, DNS intelligence analyst, and contributor to the World Economic Forum's Cybercrime Atlas, to talk about what it actually took to kill Emotet.

Brian likes to ask rooms full of security professionals a question: If your company shut down its threat intelligence program tomorrow, would the criminals even notice? His argument is uncomfortable yet precise. Most of what the security industry produces is performative theater: reports that no one reads, dashboards that no one acts on, and indicators that no one uses. He calls it negligent intelligence theater. Real impact, he says, looks different. It resembles an uncontrollable coalition of carriers, researchers, and law enforcement, each chipping away at the same problem from different angles. None of them coordinate perfectly, and that's the point.

The conversation also goes in an unexpected direction: the human infrastructure behind cybersecurity. Trust groups die out when no one brings in new blood. Conferences where a 45-year-old is one of the youngest people in the room. It discusses how geopolitics fractures longstanding alliances and why recipes for hummus and maple syrup candies are sometimes the fastest way to rebuild them. Brian's message to the next generation at their first hacker congress is that there is no wall. There is no door. Just walk in.

1. Disorganization was the weapon. The Emotet coalition worked precisely because it was unpredictable. When Brian was unavailable because he was at a bar, the attack patterns shifted. Criminals can't model chaos. That lesson scales.
2. Most threat intelligence is theater. Reports are skimmed. Dashboards are ignored. The important question is whether your work influenced a decision. If not, you're producing performance art.
3. Board communication is storytelling, not reporting. Brian reframed Emotet as taking out a hostile competitor with a $2 billion revenue pipeline, which got executive attention. That got the attention of executives. The technical details weren't necessary.
4. The community is one retirement wave away from a knowledge crisis. The pandemic eliminated travel budgets. Conferences are filled with the same senior professionals. Junior professionals aren't being brought in, and trust groups can't survive without new blood.
5. Attribution matters, but not to everyone. To a board member, whether it was Paul from South Dakota or a North Korean state actor makes no difference. However, it matters enormously to law enforcement and policy. Know your audience before opening your report.

Subscribe to Follow the Rabbit

If this episode made you think differently about the purpose of threat intelligence and who it serves, share it. Subscribe on your preferred platform, leave a review, and share it with the next junior analyst who hasn't attended a conference. They need to hear how this conversation ends.

Brian Hein – Threat Researcher, DNSFilter | World Economic Forum Cybercrime Atlas | Former Deutsche Telekom

DNSFilter – Secure DNS & Threat Intelligence

WEF_Cybercrime_Atlas_Impact_Report_2025.pdf

Europol: Operation LadyBird – Emotet Takedown

Right now, everyone's selling AI-powered security operations. The pitch sounds great: faster detection, smarter triage, and less noise. However, if your logging is disorganized, your playbooks don't exist, and no one is responsible for the process, AI won't improve your SOC. It'll just make it faster at doing the wrong thing. In this episode of Follow the White Rabbit, Link11 CISO Kofi Osae-Attah sits down with Erik Van Buggenhout, NVISO co-founder and SANS instructor, to cut through the hype and discuss what AI in the SOC looks like in practice.

Erik is an AI optimist but, more importantly, he's a realist. He has spent years building security operations at scale and knows exactly where automation succeeds and where it falls short. His take? Up to 70% of incoming alerts can be automated without AI. Static playbooks, when built and maintained properly, do most of the heavy lifting, cheaply and reliably. AI earns its place where context matters, such as in dynamic environments, nuanced triage, and situations where a rigid playbook runs out of answers. The sweet spot isn't AI everywhere. It's AI where judgment is needed and automation everywhere else.

However, the conversation goes deeper than tools. Who's accountable when an AI agent makes a wrong decision? What will happen to the career path of junior analysts when L1 work disappears? Why does the security industry keep rebranding the same problems with new buzzwords every three years? Erik doesn't sugarcoat any of it, which is exactly what makes this episode worth your time.

1. AI won't fix a broken SOC. Garbage in, garbage out—faster. Before buying any AI tooling, first sort out your log sources, processes, and ownership.
2. Seventy percent automation is already possible without AI. Static playbooks that are properly maintained can handle most of the alert volume. AI is the next layer, not the foundation.
3. AI genuinely adds value through context. Managed service providers can't know every customer environment in detail. AI coupled with retrieval-augmented generation can provide that context on a large scale without requiring humans to memorize everything.
4. Humans remain accountable. AI agents operate with identities and permissions, but responsibility ultimately rests with the person operating them. Having a human in the loop isn't optional; it's a structural necessity.
5. The industry's buzzword cycle is exhausting and confusing. SIEM became XDR, and now XDR is becoming AI SOC. Same problem, new name. Erik argues for a more pragmatic and less dramatic approach to what's actually changing.

Listen in and subscribe to Follow the White Rabbit.

If this episode made you think twice about that AI SOC pitch in your inbox, good! Subscribe on your preferred platform and leave a review. It only takes 30 seconds, and it helps us reach those who need to hear this the most. Share it with your security team, your CISO, or anyone who's been handed an AI tool without a plan.

You'll find Erik on Linkedin and here more about NVISO.

If you want to dive deeper:

SOC-CMM – SOC Capability Maturity Model

SANS Institute – Purple Teaming & SOC Courses

MITRE ATT&CK – Detection & Response Framework

Gartner on AI in Security Operations (2024)

North Korea is infiltrating Fortune 500 companies with fake employees. They create authentic LinkedIn profiles, excel in remote interviews, collect salaries, and secretly steal intellectual property, cryptocurrency, and system access. This isn't a future threat. It's happening right now across more than 40 countries. In this episode of Follow the White Rabbit, Link11 ISO Kofi Osae-Attah sits down with Kritika Roy, a senior threat intelligence researcher at DCSO in Berlin. Together, they map the threat landscape that most security teams only partially see.

Kritika's work sits at the intersection of geopolitics and cybersecurity — and that intersection is where the full picture emerges. China is running long-term intelligence operations aligned with its five-year economic plan. Russia is focused on disruption and sabotage, especially since invading Ukraine. Iran is tracking dissidents and targeting organizations with Israeli ties. And North Korea? It's doing it all — stealing money to fund weapons programs, embedding operatives inside companies, and learning by doing. The line between nation-state espionage and cybercrime has blurred to the point of being nearly indistinguishable. Threat actors are buying ransomware on the dark web as if it were Amazon. Attribution is becoming more difficult. Defenders are falling behind.

The most important insight from this conversation isn't technical; it's contextual. Geopolitics determines who targets you, when, and why. A NATO summit, a trade dispute, or an election can trigger a wave of tailored phishing campaigns and targeted intrusions. Kritika's advice to security teams isn't to become intelligence agencies. Rather, it's to read the news, understand the motivations behind attacks, and stop treating every threat with the same level of urgency. Prioritize based on context. If you're hiring remotely, ask your candidates what the local food is like. You'll be surprised at how much that one question can reveal.

1. North Korean IT workers are already inside companies. They are hired through legitimate job platforms, work as regular employees, and use their access to steal money, intellectual property, and system knowledge. The fix? At a minimum, conduct one in-person interview.
2. Geopolitics is a threat intelligence tool. Phishing lures are timed to coincide with summits, elections, and conflicts. Knowing what's happening in the world allows you to anticipate what's coming at your organization.
3. The four main threat actors have different goals. China wants intelligence. Russia wants to cause disruption. North Korea wants money and knowledge. Iran targets dissidents and organizations related to Israel. Knowing who you're up against changes everything about how you defend yourself.
4. The line between cybercrime and nation-state activity is disappearing. Nation-state actors are purchasing off-the-shelf malware on the dark web. Attribution is becoming more difficult. Security teams need to adapt their thinking.
5. Fundamentals still win. Patch management, identity security, endpoint visibility, and regular red team exercises are not boring basics; they're essential. They're the difference between being resilient and being exposed.

Subscribe to Follow the White Rabbit.

If this conversation changed the way you think about hiring, threat intelligence, or geopolitics, tell someone. Subscribe on your preferred platform, leave a review, and share this episode with your security and HR teams. Both need to hear it.

Take a look at Kritika Roy's Linkedin profile or the DCSO Website

MITRE ATT&CK – North Korea Threat Groups

FBI Advisory: North Korean IT Worker Threat (2024)

Mandiant / Google: APT Overview by Nation State

In this episode of Follow the Rabbit, host Kofi Osae-Attah sits down with Luigi Rebuffi, founder of the European Cybersecurity Organization (ECSO) and the Women4Cyber Foundation, for a deep dive. Drawing on his 40-year background in nuclear engineering, Luigi challenges the industry to move beyond digital resilience, which he views as a static buzzword, toward a more holistic, systemic approach to resilience.

He argues that most organizations are fighting the "old war," treating cybersecurity as a linear compliance checklist. In contrast, systemic resilience is inspired by complex systems theory. It focuses on nonlinear interdependencies (the "mesh"), where a failure in a minor component can lead to a crisis, but where optimized investment in these interactions can also create "double value," improving safety and operational efficiency.

The conversation also covers the "positive cascade" of the human factor, why government resilience must shift from "fortress" mentalities to flexible meshes, and how a Bayesian approach to risk management can help leaders navigate a non-binary world.

Takeaways

1. Resilience Beyond the Digital: Digital resilience is only one sub-element of a larger system. Systemic resilience considers the interaction of all parts - mechanical, environmental, and human - to prevent total collapse.
2. The "Ferrari" Analogy: You can have the perfect cybersecurity "engine" (tools), but if your "tires" (human training or third-party dependencies) are flat, the system won't be resilient. We must assess the interaction between parts, not just isolated components.
3. The Human Factor as a Resource: Although the human factor is often blamed as a vulnerability, it is fundamental to resilience. Luigi argues that organizational systems should be designed so that human error doesn't lead to catastrophic failure.
4. From Linear to Systemic Risk: Traditional risk management is Newtonian, or cause-and-effect. Modern resilience requires a Bayesian approach that maps the probability of "hidden crises" within a complex mesh of factors.
5. Sovereignty as a Dynamic Mesh: Government resilience shouldn't rely on building a static "fortress." True sovereignty comes from controlling the "mesh" - the links and interactions between existing partners - to maintain control.

Why Listen?

Are you tired of the same old "compliance-first" discussions? This episode offers a radical, engineer-led perspective on the future of European strategy. Luigi Rebuffi offers a blueprint for how organizations and governments can stop constructing static fortresses and begin to understand the dynamic interdependencies of the modern world.

Love the show? Make sure to like, follow, and subscribe to the Follow the Rabbit podcast!

You'll find Luigi on Linkedin.

Here you find more information about the ECSO.