Loading story…
The cybersecurity landscape in 2025 has been marked by significant consolidation and strategic realignment, as major technology companies pursue acquisitions to strengthen their positions in cloud security and identity management. Notably, Google (Alphabet) announced its intent to acquire Wiz for approximately $32 billion, the largest cybersecurity acquisition to date, aiming to enhance its cloud-native security offerings and compete more effectively with AWS and Microsoft. Similarly, Palo Alto Networks moved to acquire CyberArk for around $25 billion, integrating privileged access management and identity security into its broader platform, while SolarWinds was also acquired in a multi-billion dollar deal. These moves reflect a broader industry trend where security is increasingly viewed as a core business driver and a critical differentiator in the cloud era.
Amid these acquisitions, European industry leaders and policymakers are also re-evaluating their approach to digital sovereignty and cloud infrastructure. Drawing inspiration from the collaborative model that created Airbus, there is a push to develop a European cloud ecosystem capable of reducing reliance on US-based tech giants. Concerns over data sovereignty, especially in light of US legislation like the CLOUD Act and shifting geopolitical trust, have prompted both European stakeholders and American cloud providers to prioritize sovereign cloud services and data protection for European customers. The intersection of these trends underscores the growing importance of security, trust, and control in shaping the future of digital infrastructure and market competition.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
By late 2025, European policymakers and industry leaders were still grappling with heavy reliance on AWS, Microsoft, and Google, which continued to win more than 70% of European cloud contracts. Ongoing concerns over geopolitical tensions and the extraterritorial reach of US data laws kept digital sovereignty high on the agenda.
Palo Alto Networks also acquired Chronosphere for $3.35 billion, adding observability-related capabilities to its broader security portfolio. The move was part of a wider 2025 consolidation trend linking cloud operations, AI, and security.
ServiceNow acquired Armis for $7.75 billion, expanding its capabilities around asset visibility and security operations. The deal underscored growing demand for platforms that secure unmanaged and connected assets.
Palo Alto Networks agreed to buy identity security company CyberArk in a $25 billion deal. The acquisition reflected the year's push toward broader, integrated security platforms spanning cloud and identity.
Google struck a $32 billion deal to acquire cloud security firm Wiz, the largest cybersecurity acquisition highlighted for 2025. The transaction was positioned as a major boost to Google Cloud's security capabilities against AWS and Microsoft.
GAIA-X created a framework intended to define different levels of sovereignty and support secure, interoperable data spaces for critical industries. This marked a concrete technical and governance step beyond the project's initial political vision.
European stakeholders established the GAIA-X project to promote digital sovereignty through a federated, interoperable cloud and data infrastructure for the region. The initiative became the flagship effort to reduce dependence on non-European hyperscalers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European governments and organizations are intensifying efforts to achieve digital sovereignty in cloud infrastructure, driven by geopolitical uncertainties and concerns over reliance on American hyperscalers such as Microsoft, Google, and Amazon Web Services. With U.S. policy shifts and potential transatlantic tensions, European leaders are prioritizing the development of domestic alternatives and strategies to ensure control over sensitive data and critical workloads. Despite these ambitions, local cloud providers currently hold only a small share of the market, and experts suggest that a new European hyperscaler is unlikely to emerge soon, with existing players like SAP and Deutsche Telekom each controlling only about 2% of the market. In response to these sovereignty concerns, cloud providers are expanding offerings tailored to regulatory and data residency requirements. Amazon Web Services, for example, has introduced Dedicated Local Zones to provide customers with greater control over data location, security, and compliance, supporting sensitive workloads for public sector and regulated industries. These initiatives reflect a broader trend of cloud service adaptation to meet the evolving needs of European customers seeking to balance operational flexibility with strict sovereignty and compliance mandates.
Jun 29, 2026
The cybersecurity landscape in 2025 is marked by a rapid acceleration in both the frequency and sophistication of cyberattacks, with cloud environments and supply chains emerging as primary targets. According to the Microsoft Digital Defense Report 2025, financially motivated cyberattacks and nation-state operations have intensified, leveraging artificial intelligence to increase the speed, scale, and profitability of attacks. AI-powered phishing campaigns now achieve up to 50 times greater profitability by automating personalized attacks, while the window for compromising cloud containers has shrunk to just 48 hours after deployment. North Korean threat actors have embedded tens of thousands of operatives globally, exploiting the remote workforce as a persistent attack vector. Microsoft telemetry reveals an 87% increase in disruptive campaigns targeting Azure environments, with credential theft and data exfiltration attempts rising by 23% and 58%, respectively. Azure Blob Storage, a critical component for storing unstructured data, is increasingly targeted by threat actors seeking to compromise data integrity and business continuity. Microsoft’s Secure Future Initiative has responded by strengthening default security measures and providing actionable recommendations for defending against these evolving threats, including leveraging Microsoft Defender for Cloud’s Defender for Storage plan. The broader industry is also witnessing a surge in supply chain breaches, with 2025 statistics showing a 68% increase in such incidents, now accounting for 15% of all data breaches. Nearly one-third of all breaches are linked to third-party vendors or partners, and Gartner predicts that 45% of organizations will experience a supply chain breach by the end of 2025. No industry is immune, as interconnected digital ecosystems expand the attack surface and expose organizations to cascading risks from less secure partners. Cloud security incidents are on the rise, with 80% of organizations reporting an increase and 45% of breaches being cloud-based, resulting in an average cost of $4.35 million per breach. Disaster Recovery-as-a-Service (DRaaS) and cyber recovery solutions are increasingly critical for ensuring business continuity and resilience, focusing on restoring clean, uncompromised systems after disruptions. The need for robust security baselines, continuous monitoring, and strategic recovery planning is underscored by the evolving tactics of threat actors and the growing complexity of cloud and supply chain environments. Organizations are urged to adopt a proactive, layered defense strategy, leveraging AI-driven detection, secure configuration, and rapid incident response to mitigate the impact of these accelerating threats. The convergence of cloud and supply chain vulnerabilities demands heightened vigilance, cross-functional collaboration, and investment in advanced security technologies to safeguard critical assets and maintain operational resilience in the face of relentless cyber adversaries.
Jun 29, 2026
Organizations are facing a rapidly evolving threat landscape driven by the convergence of agentic AI, quantum computing risks, and the fragmentation of cloud and data sovereignty. The adoption of agentic AI—autonomous systems capable of independent reasoning and action—is accelerating, with early deployments in IT operations, customer service, and business process automation. However, these advances introduce new security challenges, particularly around identity management and the protection of long-lived secrets used by AI agents. The looming threat of quantum computing undermines the security of current asymmetric encryption schemes (such as RSA and ECC), making AI identity tokens and machine-to-machine authentication vulnerable to future decryption attacks. Security experts emphasize the need for post-quantum cryptography and robust governance frameworks to mitigate these risks. Simultaneously, the rise of sovereign clouds and regional data localization mandates is creating operational blind spots in identity and telemetry, especially for multinational organizations. Policy fragmentation across jurisdictions is forcing enterprises to re-architect their security controls, standardize telemetry, and ensure regional compliance for identity providers, SIEM, and EDR systems. CTOs and CISOs are urged to operationalize AI governance, invest in quantum-resistant security measures, and adapt to the complexities of multi-cloud environments. The shift to short-lived TLS/SSL certificates further complicates operational resilience, requiring continuous automation and oversight to prevent outages and maintain digital trust. These trends collectively demand a proactive, adaptive approach to cybersecurity strategy in 2026 and beyond.
Jun 29, 2026