Next in Tech | Ep. 265: Digital Sovereignty

View Full Transcript

Eric Hanselman: Welcome to Next in Tech, an S&P Global podcast where the world of emerging tech lives. I'm your host, Eric Hanselman, Chief Analyst for Industry Research at S&P Global. And today, we're going to be talking about digital sovereignty. And I'm here at the SUSE Conference. And with me to discuss it is Andreas Prins, Global Head of Sovereignty Solutions at SUSE. Welcome to the podcast. 
 

Andreas Prins: Thank you so much for having me. 
 

Eric Hanselman: Great to have you here. And I guess to start off with, there's been a lot of discussion of sovereignty here at the conference. And of course, globally, nothing like a little geopolitical activity to really start forcing the conversation, maybe conversations we should have been having for a while. But maybe for listeners, if you can set the scene a little bit about -- what really defines sovereignty? And what are we talking about here? 
 

Andreas Prins: Yes, that's a really interesting question. And I must admit it's evolving rapidly over time, the understanding of the market of sovereignty. So if you would have asked me about 3, 4 months ago, right, I would say, well, it's about technology, operations, and data, all 3 being free from foreign influence, right? So you own it, you run it, you master it. If I take a look here at the conversations happening at the conference among a lot of executives, it's more and more going towards business resilience, right? Can my business bounce back when something is happening? And it could even be cyber, that could be a power outage. And it's definitely the elements of technology that I touched upon. So that makes it, I think, more interesting and elevates it up from a technology conversation into a business impact. And then one other element, interestingly, we launched a research navigating digital resilience. And depending on the geography across the globe, people will take a different aspect from sovereign AI, from data security, from digital sovereignty. And again, all 3 or all 4 of them bubble up towards business resilience, right? And in essence, that makes sense because we run businesses and we want to make money. So yes, that's the ultimate answer, I would argue. 
 

Eric Hanselman: Well, it's interesting you bring that up because if we look at a number of different aspects about approaching both the business continuity perspectives and even some research we've been doing around sovereignty. One of the things that comes back in some of the study -- our study work is that many organizations, a majority are focusing on sovereignty actually as a means to give them flexibility, not just to meet the regulatory requirements because I think upfront, when you talk about sovereignty, the first thing that often comes to mind is the regulatory compliance. Now that we've got global frameworks that are now starting to focus on that. But yet, if you look at some of the more impactful aspects that are actually looking at overall technology operations, I think about the DORA regulations in the U.K., they're focusing right back on resilience and all of the capabilities that are necessary to actually keep the business going. 
 

Andreas Prins: So one aspect to that, if I might, is portability, right? And we start to realize that for workloads, if they're not portable, so if you imagine you're a platform owner or a head of infrastructure or whatever and you're not able to move the workload to another destination, -- that means you're locked in, right? So that flexibility, I do think it is very important. And often, right, if you would go to proprietary software, you're anyhow, right, not free to move because you're not owning the core. But portability goes much further than just the hosting party, right? It goes about can I even switch from the technology underneath, right? So I do think the concept of portability becomes an interesting one in relation with an exit strategy. So if you really want to be sovereign, you should not think about your entry criteria, what is the software I need to fulfill my business, but take the exit of that software into account as well. What is my path towards another piece of technology when it needs to happen. Not necessarily you need to do it, but at least have it in mind in case an emergency happens. 
 

Eric Hanselman: That's one of the things that we don't often fully consider when making technology decisions, which is we do a lot of upfront evaluation to ensure that we understand what's really involved in getting into a particular technology. And yet -- and I think this is an area where there's a greater realization that's coming as we gain more sophistication and maturity around what's happening with AI because the ecosystem is changing so rapidly. We've also got to be able to understand how to be able to migrate away when it's no longer suitable, which, of course, we have a number of market events that have generated some impacts that many organizations are feeling today as well. 
 

Andreas Prins: Yes. And if you then -- one more, if you then think about the total cost of ownership, so a lot of people say, "Hey, but if I need to develop this tech myself, right, based out of open source solutions, there's quite a bit of an investment to do that, which is -- which might make sense if you compare that to a marketplace on one of the hyperscalers where it's click at the click and you have your final product up and running. But now imagine you would not calculate the cost only by selecting the products from the marketplace and counting until you have your business up and running, but would include the cost of transforming that into another next party and you would consider your total cost of ownership, including the exit of that technology, then all of a sudden, right, going to a more local data center using open source is way more affordable. The idea came from a policymaker in the Netherlands. I'm not saying this is going to happen, but I thought that's an interesting aspect to make a fair comparison, right, and also take that transition cost into account as total cost of ownership. 
 

Eric Hanselman: Well, and we've heard this story before. When we look at cloud, the whole challenge, the first major sticker shock with cloud was, of course, that we need to figure out how to turn things off. And when we own the infrastructure, long-term cost wasn't an issue, so that wasn't the deal. But yet the bigger sticker shock came when there was the realization that we wanted to migrate out of cloud and egress costs became a significant challenge. Again, that was an exit cost and that escape velocity, the escape energy that was necessary to do that became a bigger issue. Now with AI, that's an even bigger question. And I think one, fortunately enough, at least talking to a lot of our clients, they're starting to realize and they realize that with AI, they really need to start thinking differently because the data volumes are much larger, the model infrastructure and capabilities they're working with is going to be much larger. And now it's a much bigger piece of it. There's awareness, but I guess there's that next stage -- we need to actually turn that into action. Well -- and I guess maybe in thinking about some of the challenges of where that heads toward, -- what are some of the aspects that the organizations need to really start thinking about when they're looking towards understanding what are the necessary elements. Yes, certainly getting out, platforms are part of that. What do you see as sort of that bigger picture? 
 

Andreas Prins: So based on all the conversations I had in recent months, I would argue there are kind of 4 transitions that need to happen in parallel turning into a more sovereign destination. And the first one is probably the one that everyone would start with, that's data residency, right, thinking through where does the data need to reside, who owns it, the access to it, et cetera. Important, but I would say that's just the bare minimum. The next element that we see happening is that you need to rethink your entire architecture stack, right? So what are all the components? Take portability, we spoke about and the exit strategy almost into account at every level of your IT stack, right? Rearchitect where needed, come up with other solutions, open standards, whatever. Then the third element, imagine you would still have proprietary components in your stack, which is not unlikely. Think about your contracts, right? Can you renegotiate your contracts, put other clauses in, make them stricter, right, and give a little bit of an insurance, right, on how you would deal with that, if possible, right, support from the same geographical right, location, right, whatever matters to you as a company to reduce the risk there. So it's data architecture and contracts. And then I do think an unforgotten and underestimated aspect is the human side of the house. And I'm looking at really from -- I've been in lean and agile waves. I've done the cloud-native transformation, and I really start to see that this entire sovereignty awareness will most likely turn into a big transformation, right, like we've had the other transformations. And if that's true, the human is involved, right? And I do think we really need to start considering as an executive, are there any coaches, right? Any plans needed? What is the long-term horizon? Do I need to reskill my people, all these type of things to move forward? So if you would assess sovereignty from an organizational aspect, I do think these are 4 pillars, right, that we should assess. And then depending on the risk and depending on how your tech stack looks like, well, you start at 1 of the 4 pillars, I would argue. 
 

Eric Hanselman: Workforce transformation is a big part of that. Actually, talking about workforce. I'm curious -- so I'm thinking about the EU cloud sovereignty framework published back in October. We've now got some running time with it. It is that level of much more comprehensive. I mean you've got the 8 different aspects running from your basic operational capability all the way up to sustainability. Are you starting to see that impacting either marketplace decisions or some of the approaches to sovereignty? 
 

Andreas Prins: Yes. Yes, absolutely. So what we did at SUSE is we took the framework a couple of months ago and we turned it into a self-assessment. And we did that for the reason that in all the conversations we're having with executives, it's pretty hard to nail the definition, but more important, right, to have a conversation on, hey, what matters for your organization the most? And the self-assessment provides a gap on the 8 objectives that you just called out. And that structures a conversation to say, hey, but for these business applications or for these areas, I need to make an improvement. What is it that I need to do? So it give words to an understanding and a gap that is happening in the tech stack. Then the next element, which is I do think very interesting, is we've seen numerous RFPs’ request for proposal for information. coming into SUSE, where the cloud sovereignty framework was explicitly mentioned, right, as, hey, at this sovereignty objective, how would you rate, how would you score, right? So we see that coming back. And if it's not a cloud sovereignty framework as a formal instrument, right, it's definitely sovereignty wording to move that forward. So that's a very interesting move. And then the third element that we see happening is it also sparks, I would say, product development here in SUSE to rethink, hey, the software supply chain. That's one of the objectives of the framework. It's the heaviest objective. It accounts for 20% in the final calculation. What does that mean, the software supply chain? And what is it that SUSE is doing and can do -- and why does the software supply chain matter for our customers. So it also sparks a good debate, right? If this is how you articulate and define sovereignty, okay, then what are the shortcomings or the improvements or the benefits that we have or should have with our product portfolio for our customers. 
 

Eric Hanselman: Interesting that you're seeing specific requirements in requests for tenders and RFPs and that I guess we're maybe heading towards a world in which specific seal levels have to be achieved. We've got to get to a particular point. With that in mind, what do you think that enterprises should be considering around sovereignty in terms of looking a little further down the road in terms of what their action plans should be to really getting to a point at which they're raising their level of sovereignty. 
 

Andreas Prins: Yes. Well, I would argue it goes back to the 4 pillars I mentioned, but just call out a few examples. I do think they should really think about the exit strategy at every layer of the stack. And I spoke with a particular company here in Europe that had mainframe from IBM, that had database from IBM, that had message queues from IBM and that had their entire cloud native stack from IBM and Red Hat OpenShift. So if you think about then, right, a single vendor strategy versus say probably a sixfold type of vendor strategy, humongous risk. So rethink that. Second, probably more important is what are open standards, right, that you can move towards and what are pieces in your technology stack that are relatively easy to migrate away from. So if you're running on VMware, right, for a lot of the VMs, you can super easily migrate over to SUSE virtualization. So what are the steps that are relatively light from an impact perspective? And what are the steps that are harder? And a hard example, right, to be honest, if you would go to the public sector and say, "Hey, you need to leave G Suite or Office 365. It's possible, right? I'm not disagreeing that it's impossible, but it's impactful for all the office workers, right, that have to place. 
 

Eric Hanselman: It's a fundamental day-to-day activity. 
 

Andreas Prins: Exactly. Yes. And then probably the last element that I see coming back in many conversations is what are the applications that are truly, truly mission-critical, right? Don't say, hey, I need to be sovereign for everything, but start with the most mission-critical applications, citizen data, health records, defense, right, and find a way to move them to a more sovereign hosting or more sovereign technology stack or whatever. So very much a risk-based conversation. And therefore, I do think business resilience is the term that captures it much better. 
 

Eric Hanselman: And we get right back to resilience. So we've come full circle. Well, this has been great, Andreas. I appreciate it. We are at time for this episode, but thank you so much for being on. 
 

Andreas Prins: You're welcome. Thank you so much. 
 

Eric Hanselman: And that's it for this episode of Next in Tech. Thanks for staying with us. And thanks to our production team, including Sophie Carr, Feranmi Adeoshun, and Kyra Smith on the marketing and events teams. Please keep in mind that statements made by persons who are not S&P Global employees represent their own views and not necessarily the views of S&P Global. I hope you'll join us for our next episode because there is always something, Next in Tech!