Is your cloud provider a hidden national security risk in 2026?

Threat IntelligencePodcast
Written By Noel Bradford

You did not buy your cloud stack to join a geopolitical knife fight, did you?

Yet here we are.

Switzerland looked at Palantir, ran the risk checks, and said no. Not because the software is rubbish. They worried about data sovereignty and legal reach, including the risk of US access to sensitive data.

The UK did the opposite. We handed Palantir major public sector work. The NHS awarded a consortium led by Palantir the Federated Data Platform contract in November 2023, valued at £330 million over seven years.

Still think this has nothing to do with you?

You use the same vendors. You store contracts, finance, HR, customer data, and email in systems owned by companies that sit under foreign law. When politics gets ugly, governments reach for legal levers first. They do not need to kick your door in. They only need to compel a provider.

That is the uncomfortable bit about the US CLOUD Act.

It can require providers under US jurisdiction to disclose data within their possession, custody, or control, even when the data sits outside the United States.

So what does “UK hosted” even mean if you do not control the keys?

Then we get to lock in. The Ministry of Defence awarded Palantir major contracts without open competition, then expanded them. Reports describe high switching costs and a growing dependency problem.

Does your business have an exit plan?

Most do not. They have a login, a monthly bill, and blind faith.

This is not a call to delete Microsoft 365 tomorrow. This is a call to stop treating data location as the whole story. You need to know what data you hold, where it lives, who can access it, and what you would do if access rules changed overnight. You also need to know which suppliers you cannot replace quickly, and why.

What would you say if a customer asked you a simple question today: who can legally demand our data, and how would we know?

If that question makes you sweat, you need to read the full article.

Noel Bradford

Noel Bradford – Head of Technology at Equate Group, Professional Bullshit Detector, and Full-Time IT Cynic

As Head of Technology at Equate Group, my job description is technically “keeping the lights on,” but in reality, it’s more like “stopping people from setting their own house on fire.” With over 40 years in tech, I’ve seen every IT horror story imaginable—most of them self-inflicted by people who think cybersecurity is just installing antivirus and praying to Saint Norton.

I specialise in cybersecurity for UK businesses, which usually means explaining the difference between ‘MFA’ and ‘WTF’ to directors who still write their passwords on Post-it notes. On Tuesdays, I also help further education colleges navigate Cyber Essentials certification, a process so unnecessarily painful it makes root canal surgery look fun.

My natural habitat? Server rooms held together with zip ties and misplaced optimism, where every cable run is a “temporary fix” from 2012. My mortal enemies? Unmanaged switches, backups that only exist in someone’s imagination, and users who think clicking “Enable Macros” is just fine because it makes the spreadsheet work.

I’m blunt, sarcastic, and genuinely allergic to bullshit. If you want gentle hand-holding and reassuring corporate waffle, you’re in the wrong place. If you want someone who’ll fix your IT, tell you exactly why it broke, and throw in some unsolicited life advice, I’m your man.

Technology isn’t hard. People make it hard. And they make me drink.

https://noelbradford.com
Next

That Cheap Router on Your Desk? The US Just Called It a National Security Threat.