UK Wades Into Tech Sovereignty Amid AI Policy Changes
The UK is betting on domestic AI and cyber investment to reduce reliance on US tech — but security leaders question whether the funding is too fragmented and too late.
The UK is betting on domestic AI and cyber investment to reduce reliance on US tech — but security leaders question whether the funding is too fragmented and too late.
The UK has announced major investments in strengthening its cyber defenses, designed to stave off the rise of faster, more complex attacks enhanced by AI tools. In late October, the government unveiled a funding package of approximately $800 million to strengthen cyber defenses and AI security investments.
The move comes as Kanishka Narayan, the UK’s minister of artificial intelligence, said in a speech last month that “it seems likely, if not inevitable, that our own cyber-defenses will be breached.” He cited the recent trend of misaligned models escaping containment, citing the OpenAI incident in June during which an agent hacked an Australian government health agency.
But the UK government is also pushing toward another, related goal: digital sovereignty. In his speech, Narayan emphasized the need to “build in Britain to keep the public safe in Britain” and become less dependent on foreign providers, which has become a common goal for some countries following the US government’s export control order for Anthropic earlier this year.
“We want the world’s leading companies investing here, but we will not accept dependence as the price of that investment,” Narayan said.
But industry-watchers argue that government investment to strengthen cyber-defenses while also achieving greater sovereignty by encouraging homegrown tech might be difficult to do all at once.
UK “Tech-xit” Investments: Are They Enough?
Two turning points appear to have shifted government policy in the UK and Europe this year, both involving the same US company: Anthropic. The first came with the AI company’s unveiling of Project Glasswing in April for its Mythos frontier model, which sparked concerns about a coming “vulnpocalypse” for enterprise security teams.
“It created an almighty whirlpool of conversations,” says Tim Williams, CEO of London-based Quod Orbis, which specializes in continuous controls monitoring. “And then there were lots of concerns about what that meant, and everybody seemed to panic. I think that panic has settled down now.”
But another event — the Trump administration’s ban on foreign nationals using Anthropic’s Fable 5 and Mythos 5 models has had a far more lasting effect. The ban didn’t just impact overseas companies and government agencies; the export controls effectively forced Anthropic to pull all access for the two models for several weeks.
The implications of abruptly losing access to valuable — and perhaps critical — AI technology through a sudden change in US policy accelerated an already growing conversation about reducing dependency on American tech companies. A crucial part of the UK government’s funding package is designed to fuel British AI startups and invest in home-grown companies.
It’s a solid idea, but infosec professionals see two issues with that approach. First, the funding package is split up between a number of initiatives, with approximately £154 million of the £600 million total devoted to strengthening current cyber-defenses, for example.
“If you look at the amount that they’re putting into it, is that enough? Is that significant?” Williams asks.
Secondly, the UK is already well behind the curve with fueling homegrown AI and cloud companies. Amir Khan, managing director at Wire, tells Dark Reading that there’s been chronic under-investment in emerging technologies in the country, which has led to missed opportunities in the past.
“In the UK, we had DeepMind before it was sold to Google [in 2014],” Khan says. “Had they known the impact that DeepMind would have now, would they still have sold it, or doubled down on it? Who knows? But it’s another example of a large organization that grew in the UK, leaving to go to the US.”
In fact, due to that kind of ongoing tech emigration, Khan says you could argue that the last good thing to come out of UK’s technology industry was Cambridge Analytica — a company that become embroiled in a scandal involving Facebook.
Achieving Digital Sovereignty in the AI Era
Time and again, experts have argued that organizations can’t counter AI-driven threats effectively without AI-enabled defenses. But that complicates matters for the UK, which is looking to achieve tech sovereignty in the aftermath of the Anthropic ban.
For one, in some part because of the issues outlined above, many of the major AI companies — OpenAI, Meta, SpaceXAI (now SpaceX Super Intelligence), and Palantir Technologies — are also based in the US. And while there are plenty of AI startups these days, those companies may not have the scale needed for national defense systems.
Additionally, there’s also the cost component. Williams says many of Quod Orbis’ customers are looking to reduce their dependency on a single vendor or provider, whether it’s for cloud, software, AI, or other technologies. “There’s no question that, in speaking to our clients, that concentrated risk is a concern for them,” he says.
But moving from, for example, one cloud provider to four or five can be challenging, especially for mid-market organizations, he says. They may not have the budgets of large enterprises, and they probably rely more heavily on the commercial discounts that the cloud giants like AWS, Microsoft, and Google Cloud Platform provide. “If they’re spreading that investment out across multiple cloud providers, that can become more expensive for them,” Williams says.
Khan agrees and points to the recent example of France migrating off Windows for government workstations and moving to Linux. But leaving the Microsoft ecosystem will require France to add several more technologies from different vendors. “That, for me, defeats the purpose because you’ve essentially taken away one provider and pulled in six,” he says. “That doesn’t really give you the flexibility you want.”
Khan argues the UK sometimes sets the wrong target for tech sovereignty. “We talk as though we have to build every chip, every cloud, and every application ourselves,” he says. “As you can imagine, that’s an enormous undertaking, and it doesn’t really get to the heart of the issue. For me, the questions are, can we make our own decisions about the technology that we depend on? Can we operate it on our terms?”
The UK can retain such operational authority, he says, by choosing providers and vendors that build that kind of customer controls directly into their products and services; for example, Khan notes that Wire offers customer a private cloud option for the messaging platform that organizations can control and operate based within whatever country they’re located.
Whichever providers or vendors the UK government chooses, officials should be asking several key questions before investing: who holds the encryption keys, who can interrupt the service, and how realistic is it to move off that technology?
In the meantime, the UK government will continue to focus on strengthening the country’s cyber defenses through these investments and efforts like the Cyber Security and Resilience Bill currently. But Williams is unsure if they will be enough.
“It’s a step in the right direction, absolutely,” he says. “But is it the investment I would expect to see in terms of being really concerned about the threat to the UK?”
Read more about:
