Europe Wants Digital Sovereignty. 2,165 Polish Organisations Show the Gap - CipherCue
report<br>Europe Wants Digital Sovereignty. 2,165 Polish Organisations Show the Gap
16 June 2026 · 9 min read<br>· By Chris McCabe
100%<br>of observed outsourced CDN and hosted mail provider choices in the Polish sample were US-headquartered.<br>CDN detections: n=128. Hosted mail provider detections: n=140. Excludes organisations with no detectable CDN or self-hosted mail.
CipherCue observes the public-facing infrastructure of organisations across multiple jurisdictions. We fingerprint web servers, content delivery networks, web application firewalls, hosted mail providers, DNS records, and shipped JavaScript on the apex domain of each tracked entity. Every observation links to a primary source: an HTTP response header, a DNS query, a BGP routing record.
As of 16 June 2026 we have observed at least one perimeter fact on 2,165 Polish organisations , drawn from public-sector, financial, healthcare, and private-sector verticals. This article reports two findings from that snapshot, both relevant to European cyber, infrastructure and trust vendors selling sovereign alternatives:
At the hosting layer, Polish organisations already use European providers heavily. The largest foreign hosting destination is France (OVHcloud), not the United States.
At the outsourced perimeter layer, US-headquartered vendors dominate the observable choices. In CDN and hosted mail specifically, every observed provider was US-headquartered.
What we are and are not claiming
This does not mean every Polish organisation uses a US CDN or US hosted mail provider. It means that among organisations where CipherCue detected a commercial CDN at the apex domain, every observed provider was US-headquartered. And among organisations where CipherCue detected a hosted mail provider in MX records, every observed provider was Microsoft or Google. Many Polish organisations have no detectable commercial CDN at the apex, or self-host their mail infrastructure rather than use a hosted provider. They are not counted in either denominator. The number "100%" in this article always refers to the population where a choice was made and that choice was observable.
Why this matters for European vendors
The Polish data describes a market where sovereignty preference is real but inconsistently applied. Polish organisations already use European infrastructure where credible European options exist. The hosting layer is the clearest evidence: roughly 82% of observed organisations host inside Poland, and the single largest foreign hosting destination is France (OVHcloud), with the United States third behind both. That is a measurable European preference, exercised at scale.
Many organisations that use European hosting still expose US-headquartered vendors at the observable perimeter. Of the 1,985 Polish organisations in this sample hosted in Poland or France, 329 (16.6%) also expose at least one US-headquartered component at the perimeter layer. Where the choice is a commercial CDN, it is Cloudflare, Amazon CloudFront, Akamai or Fastly. Where it is a hosted mail provider, it is Microsoft 365 or Google Workspace. Where it is consent management, it is OneTrust or Cookiebot (Denmark, the only European-headquartered vendor with double-digit Polish presence in this layer).
For European cyber, trust and public-perimeter infrastructure vendors, this is an account prioritisation map. The Polish organisations that already chose European hosting are the population most likely to engage with a sovereign perimeter conversation. The Polish organisations currently exposed to US CDN, mail and consent vendors are the addressable set. CipherCue's data identifies both groups at entity level.
CDN: four vendors observed, all US-headquartered
Of 2,165 Polish organisations observed, 128 have a detectable commercial CDN in front of their apex domain . That is 5.9% of the sample. Among those 128:
CDN vendorHQPolish organisationsShare of observed CDN
CloudflareUnited States11589.8%<br>Amazon CloudFrontUnited States97.0%<br>AkamaiUnited States32.3%<br>FastlyUnited States10.8%<br>Any European-HQ commercial CDNEU00%
Most of the concentration is Cloudflare. The 115 Polish organisations observed using Cloudflare account for nearly 90% of the observed commercial CDN footprint in this sample. Amazon CloudFront and Fastly appear in single digits. We searched specifically for European-headquartered CDN vendors (Bunny.net, Gcore's EU operating entity, regional players) and found none at the apex layer in this sample.
115
Cloudflare
CloudFront
Akamai
Fastly
EU-HQ CDN
Polish organisations observed using each commercial CDN at apex domain, n=128
Hosted mail provider: two vendors observed, both US-headquartered
Of 2,165 Polish organisations observed, 140 have a detectable hosted mail provider in their MX records. Among those 140:
Mail providerHQPolish organisationsShare of observed providers
Microsoft...