Taking It On Trust

The bundling together of different elements that is often seen in standard systems aggravates risk. Every element is in itself an attack surface, so the more elements you incorporate, the more attack surface you create. To this we can add that there is a certain arbitrariness in combining disparate elements — if for instance you choose a Linux server over Windows for security reasons, why then would you allow Windows workstations within the nexus?

Furthermore, incorporating different load-bearing elements in a system creates interfaces because composite parts need to be made to work together, and doing this creates interstices* which are more predisposed to vulnerability.

On top of this, disparate elements can involve disparate vendors, which also entails trusting more and more third parties with your data.

Overall, you have created a system that is variegated — complex and diverse — which by its nature is much harder to fully comprehend. In fact, wherever closed source software is employed, your system becomes by default unknowable. These kinds of setup engender complexity — harder to defend and to audit — and extraneity — impossible to defend and to audit.

* Interstices tend towards vulnerability. This is because they are essentially extemporaneous fixes rather than deliberate design — and extemporaneous fixes carry less stringency by their nature. They are frequently undocumented, have no native security posture, and are much harder to monitor. In a world of weakest links, interstices are flag waving exemplars.

Tectonic Shifts

We are actually still in the very early days of the Digital Age. The 1980s and 90s saw corporations devising in-house platforms, with huge technical overhead and so huge expense, and with varying degrees of success. The data however was generally ring-fenced.

Small wonder that as we moved into the 21st century, the cloud promised liberation. Vast swathes of technical overhead could be intermediated by a specialist third party, and companies could be liberated from running their own servers, and their own development teams. Software as a service was for many a very easy sign-off.

A Sea Change

In April of 2026, the French government issued a formal directive that sent shockwaves through the global technological community: they mandated the migration of all public services away from Microsoft and onto Linux.

This was in fact a drama that had been brewing for twenty-five years, signposted notably by the Snowden/Merkel/Élysée/BlackBerry scandal of 2013. However, the 2018 US CLOUD Act brought things to a head. It compelled any US-controlled provider to hand over data stored anywhere in the world, on demand, regardless of local law^†. In June 2025, Anton Carniaux, Director of Public and Legal Affairs at Microsoft France, when asked under oath before the French Senate whether he could guarantee that French data would not be seized by US authorities, could only answer no.

Whilst France is not the first nation to have made its technology base a matter of geo-strategic importance, the significance of their action indicates a sea change. Silicon Valley Big Tech is deeply embedded worldwide, and moving away from it involves no inconsiderable risk and challenge. But far outweighing the logistics are the geopolitical and commercial stakes; the apex battlefield is now technology — notably AI, chip manufacture, systems and data sovereignty. The French here appear to be the trailblazers, although similar moves are afoot elsewhere. Germany's northernmost state, Schleswig-Holstein, has been engaged since 2024 in migrating some 30,000 government computers off Windows and Microsoft Office onto Linux and open-source equivalents — explicitly in the name of digital sovereignty and freedom from foreign technology dependencies. The state expects to save €15 million in licensing costs in 2026 alone. The City of Lyon has made similar moves, as has the Danish government in parts of its public sector.

How Did We Get Here?

The question this all begs — and which might have puzzled an alien landing in Paris in say 2025 — is how sovereign nations and corporates came to hand over their critical data, infrastructure and strategic communications, lock, stock and barrel, to a handful of private American corporations, operating under US law, with US government access baked in by statute.

We would suggest that it is primarily a result of being in the early days of the digital revolution — these are effectively growing pains. In the early 2000s, emigrating from the in-house model to third party services seemed like the most obvious choice in the world. The overhead of local infrastructure was real, the convenience of third-party services was genuine, and the long-term implications at that point were not particularly visible. What we are witnessing now is really an epiphany — a growing recognition that the traditional goalposts of privacy and confidentiality across all sectors — government, corporate, R&D, defence, finance, healthcare, legal, professional services, infrastructure — have not moved, that vital and critical systems and data cannot be outsourced to peer group competitors, and that unlike thirty years ago, we have in our own hands the resources to much more readily manage these problems. Indeed at a structural level, it is an abdication of economic autonomy for any state not to prioritise their home-grown technology sector.

Our System

We provide a wholly in-house IT solution. (Hardware costs are no longer prohibitive.)

Your data is managed on our system, with no third party service intermediation, thus giving you optimised security. Our Shinbashira system itself is designed for security — we can provide both empirical evidence and NIS validation of that.

We cover the entire gamut of your IT infrastructure and responsibilities: from server to client workstation, including local LLMs. We can also integrate mobile phones into the system. Thus we are a complete IT suite. We also manage the system. Our service is an ongoing custodianship of your IT estate — a single accountable engineer who knows your setup completely, much as a retained solicitor knows your affairs.

Your entire system is built from the ground up. It is constructed to your remit — around your workflows, organisational practices and procedures, and security requirements — which means deliberate design choices can be made with specific outcomes in view.

You are not locked in to the system. The system and your data are not enmeshed. Your data is yours and can be extracted from the system in a matter of hours.

We are a peer partner. We are not a multinational floating above sovereign law. We are bound by the same professional ethics, the same jurisdiction, the same obligations as you.

*Above kernel level.

^† The CLOUD Act (Clarifying Lawful Overseas Use of Data Act), enacted by Congress in March 2018, compels any company under US jurisdiction to produce data held on servers anywhere in the world in response to a valid US government request — regardless of where the data is physically stored or what local law may say. A European data centre is no protection. The Act was passed with bipartisan support and signed into law by President Trump. It effectively extended the reach of US law enforcement and intelligence agencies to every server operated by Microsoft, Google, Amazon, Apple and any other US-headquartered provider, globally.

To put this in perspective: at its current scale, cybercrime would rank as the world's third largest economy — behind only the United States and China. Ahead of Germany. Ahead of Japan. Ahead of every other nation on earth. Perhaps the most unsettling detail is that no business is immune. Hacking is in large part automated, and it is a scatter gun. Any target is a good target.

This reality is evident in the national statistics. In the UK alone, 43% of businesses experienced a cyber breach or attack last year. Among medium and large businesses — the firms most likely to hold valuable client data — the figure runs to 74%. And for those who identified a breach, nearly half went on to become victims of actual cyber crime.

Source: UK Cyber Security Breaches Survey 2025, DSIT / Home Office

The picture across Europe is no different.

To this already daunting landscape, we must add the AI factor. Since 2024, AI has transformed the economics of cybercrime. AI-assisted attacks have increased by 72%, and phishing has surged 1,265% through the use of generative tools. Over 80% of phishing emails now deploy some form of AI — up 53.5% on the previous year. Deepfake incidents increased 680% year on year. What once required expert knowledge is now automated. What once took days now executes in minutes. What once targeted random victims is now personalised at scale. By late 2025, AI-generated phishing had become the top enterprise email threat — surpassing ransomware, insider risk, and traditional social engineering combined.

AI is completely redefining this landscape, by orders of magnitude.

To give you an idea of the extent of the peril, since you have been browsing on this site...

Sounding the alarm should not be confused with alarmism. The dangers are absolutely existential and pervasive, for all businesses. Here is a breakdown of the risks any business now runs.

The bill — click each item

Shinbashira 心柱

Most security is a posteriori, initiated by symptoms. When problems are diagnosed, solutions are sought. They can be remedial — of the type 'take more walks, eat less fried food' — so: patch your systems, update your firewall. Or palliative — of the type 'take these pills regularly' — so: buy another monitoring tool, generate a compliance report at year-end.

Just as the doctor rarely advises nor oversees fundamental change — moving location, changing profession, terminating a relationship, completely recalibrating your diet — the underlying security issues are not properly addressed. Instead of holistic repair, you tend to get a fix, a one-time patch.

Our platform, Shinbashira, is an entire infrastructure built from the ground up — prophylactic by design, addressing structural and operational weak points before they become vulnerabilities.

ポカヨケ  Poka-yoke — mistake-proofing.

Shigeo Shingo, Toyota Production System, 1960s. The principle that systems should make errors impossible, not merely discouraged. A car part that only fits one way. A server configuration that cannot compile if insecure. The wrong shape does not fit. The build fails. The breach never happens.