Cyber Resilience Starts with Infrastructure

The cyber threat landscape is intensifying, while companies are becoming increasingly dependent on cloud services, networks and interconnected infrastructure. Ahead of the eco Internet Security Days @ it-sa on 28 October 2026, Dr Jennifer Pernau, Senior Manager Government Affairs at Microsoft Deutschland GmbH, discusses which security standards are essential today, how companies can strengthen their resilience and why Europe needs a more coherent approach to regulation, infrastructure and cybersecurity. Microsoft is currently investing heavily in additional data centre and AI infrastructure in Germany. In your view, what role do factors such as energy supply and the regional environment play in ensuring the long-term viability of data centre locations?

Factors such as energy supply and the regional environment are crucial to the long-term viability of data centre locations. Data centres form the backbone of cloud services and AI, making them essential infrastructure for Germany's competitiveness and digital sovereignty.

Growth and sustainability go hand in hand. In 2025, Microsoft achieved its goal of matching 100 per cent of its global annual electricity consumption with renewable energy. Since 2020, we have signed contracts for 40 GW of new renewable energy capacity to support this goal.

For Germany as an investment location, reliability and speed are now particularly important. A leading industrial location must be able to connect major new digital and industrial investments to the electricity grid within predictable timeframes. This requires forward-looking grid expansion, transparent and efficient grid connection procedures, and faster approval processes.

The regional environment is equally important. Data centres must be good neighbours and create tangible benefits for the communities in which they are built. This includes dialogue with local authorities and residents, investment in regional infrastructure and skills development, and the responsible use of energy, water and waste heat.

Germany therefore has an opportunity to become a leading location for sustainable AI and cloud infrastructure. To achieve this, we need a genuinely welcoming environment for digital infrastructure, alongside coherent European, technology-neutral and practical regulatory frameworks, particularly in areas such as energy efficiency and waste heat utilisation.

Are current European regulatory initiatives, such as the Digital Networks Act, creating the right conditions for technological innovation and infrastructure development to progress hand in hand?

The objective is right: Europe needs higher-performance, more resilient networks and a genuine single market for connectivity. The Digital Networks Act offers an opportunity to overcome fragmentation across 27 national markets and create better conditions for investment and innovation.

In my view, three things are essential.

First, simplification must genuinely simplify. If we merely add new procedures and reporting obligations to existing rules, we will achieve neither greater speed nor improved competitiveness.

Second, we must encourage investment rather than redistribute resources between different parts of the digital value chain. Network operators, cloud providers and data centres are not adversaries. Together, they invest in the infrastructure underpinning Europe's digital economy and, increasingly, AI applications. We should therefore preserve commercial agreements that work and avoid creating new mechanisms for mandatory network fees.

Third, resilience requires regulatory coherence. The Digital Networks Act must work in conjunction with NIS2, the Cyber Resilience Act and the Cybersecurity Act. Greater security does not come from multiple overlapping regulatory frameworks, but from clear, coherent and risk-based requirements.

In short, Europe will become technologically stronger if we recognise networks, cloud services, data centres and AI as interconnected parts of the same digital infrastructure, and align the regulatory framework to enable investment, innovation and resilience simultaneously.

What minimum standards for cybersecurity and resilience do you consider essential today, and which should every company implement, even if doing so involves compromises in speed, convenience or flexibility?

The threat landscape is clear. Vulnerabilities can now be actively exploited in less than 24 hours. At the same time, Germany has become the second most frequently targeted country in Europe for state-sponsored cyberattacks.

For me, this translates into three essential priorities for every company:

1. Phishing-resistant multi-factor authentication everywhere. It can prevent up to 99 per cent of identity-based attacks.
2. Consistent and rapid patching.
3. Resilience, not just recovery. The crucial question is no longer simply: "How quickly can I get my systems running again after an attack?" It is also: "Can my company continue operating during an attack?" This requires regularly practised emergency response plans, tested backups and a clear understanding of suppliers and partners. No company can achieve resilience on its own.

And speed without security is not a competitive advantage if a successful attack subsequently brings operations to a standstill.

At Microsoft, we have drawn a clear conclusion from this through our Secure Future Initiative: security comes first.

At the eco Internet Security Days @ it-sa, you will discuss the future of Europe's networks. What three key questions must decision-makers answer today to ensure that Europe's networks remain resilient, high-performing and future-proof in the long term?

In my view, three questions are crucial.

First: Are we creating the conditions in Europe for long-term infrastructure investment to actually take place?

Europe needs high-performance fibre-optic and mobile networks just as much as it needs data centres and cloud infrastructure. Above all, investors need planning certainty: fast approval procedures, reliable energy supplies, predictable grid connections and a competitive regulatory environment.

If companies in some cases have to wait more than a decade for a grid connection, this is incompatible with Europe's ambition to compete internationally in AI and digitalisation.

Second: How can we strengthen the resilience of our networks without creating a patchwork of regulations?

Cyber risks do not respect national borders. Europe needs high security standards, but not ever more layers of regulation. Existing rules must be implemented coherently, requirements harmonised and regulatory duplication avoided.

Resilience cannot be achieved through regulation alone. It is built through operational cooperation between governments, network operators, and cloud and technology providers.

Third: Are we taking a sufficiently integrated approach to digital and energy infrastructure?

There can be no AI or cloud services without data centres, and no data centres without electricity and grid connections. We therefore need a much more integrated approach to energy and grid planning, approval procedures, land availability and the use of waste heat.

Digital sovereignty also begins with physical infrastructure.

Europe's digital competitiveness will therefore be determined not only by algorithms and applications, but also by fibre-optic networks, data centres and electricity grids.

Get your ticket now!