Patrick De Schutter

De Schutter identifies identity governance in messaging platforms as an underappreciated security blind spot. He observes that WhatsApp, Telegram, and Signal are evolving from simple message transport into "identity layers" [1], yet these critical functions operate "inside private platforms with almost no governance, no lineage, and no real protection against impersonation" [1]. This shift concentrates power over user authentication in corporate hands with minimal oversight.

His analysis of European digital infrastructure emphasizes ownership over location. He rejects the framing that Europe's problem is merely attracting data centers, arguing instead that "if those data centers are owned by US companies, they are not European assets" [2]. He points to concrete evidence: more than 80% of Europe's digital stack originates outside the EU [2]. He sees regulatory intervention, particularly higher assurance requirements and permit acceleration, as necessary levers to shift European organizations toward infrastructure "that Europe actually owns and controls" [2].

De Schutter argues that cybersecurity models must adapt to accelerating attack timelines. The core vulnerability is not attacker sophistication but rather that "exploitation moves faster than patching" [3]. He emphasizes that complex systems become inherently insecure: "If your system is not simple enough to understand end-to-end, you cannot secure it" [3]. Critically, he observes that organizations remain exposed through "the software they don't control", vendors, integrations, and legacy components, because "the real risk is the chain, not the node" [3].

De Schutter flags psychological and institutional pressures that distort European technology choices. Companies operate under "fear of missing out," "competitive pressure," and "obsession with displaying an innovative image," which drives them toward Big Tech "without real critical examination" [4]. This urgency-driven adoption often precedes compliance work rather than preceding it [4].

He frames global AI deployment as a strategic vulnerability for Europe. When AI systems become "globally accessible," they become "globally usable, including by actors operating in jurisdictions where our guardrails do not apply" [5]. The gap between where AI is built and where it can be deployed "has become a strategic risk in itself" [5]. He concludes that European security posture must evolve rapidly because Europe is now "exposed to every weakness in their global supply chain" [5].