Welcome (back) to the sovereign era

October 17, 2026 · 3 min read

While many aspects of using AI remain up for debate, one conclusion is clear: the security of internet applications and their operations was always something of an illusion, and in the real world nothing fully protects a cloud or SaaS platform from being hacked.

In October 2026, Avantio (a vacation rental channel manager) disclosed unauthorised third-party activity affecting reservation data, potentially including guest names, email addresses, phone numbers, accommodation addresses, reservation numbers, and dates of stay. Shortly after, we witnessed the consequences: high-quality phishing emails that looked completely professional and, worse, contained the victim’s real information before asking for a card to make a deposit for an existing booking. To the recipient of such a tailor-made phishing scam, everything appears absolutely routine and legitimate as they enter their credit card details for their real stay. It looks like the start of a new era, in which LLM-enhanced hacking, combined with phishing, is giving rise to a new scam model.

In this chain, the real victims (the travellers) are far away from the actual breach, which appears to have happened on the channel manager’s side. The vacation rental companies in between aren’t directly at fault either, since their data was breached through the third-party service they use. This brings us to the question: how should organizations handle data so that exposure is kept to a minimum when a breach happens?

If a system’s data flow allows users to access data at all, then at some point that gate will be abused, and an LLM is the ideal tool for finding the way in at scale. And the more data a single service gathers, the more attractive a target it becomes: one channel manager holds the data of many rental companies at once, so a single breach exposes all of them.

It took nearly two decades for companies to move most operations into the cloud, so it’s unrealistic to expect that returning to on-premises will happen overnight. But it seems like the right moment to start preparing organizations for the idea that we need to go back to the roots, when every organization held its own data, behind its own gates. Self-hosting isn’t automatically safer: it brings patching and monitoring back in-house. But it puts control back in your hands, and instead of being one piece of a huge pool of data, you become a small target that’s less attractive to hackers.

The initial plan could be the following:

1. Reduce the harm from a potential breach by minimizing the amount of data kept in the cloud. For example, if you have a CRM holding all your client data online, it makes sense to keep accessible only the part that is actually needed for current operations, and to archive the rest without broad internet access.
2. Identify which SaaS tools could be replaced by a self-hosted alternative and move them back inside the company perimeter.
3. Avoid introducing new SaaS dependencies wherever possible, since we now seem to have entered an era in which the breach of an online service is merely a matter of interest and time.

The idea of returning to operational sovereignty might sound quite challenging, but on the bright side, we’ve been there before, in the early days of the internet. This should be the way forward: a new, secure, monitored on-premises model, with our own applications behind our own gates.

't'