Trust, resilience, sovereignty: three concepts to be placed in their proper perspective

The digital world produces buzzwords at the same pace as threats. “Trust,” “resilience,” “sovereignty”: three terms that everyone uses, that no one defines consistently, and that are sometimes wielded as rhetorical shields where operational architectures are needed. Guillaume Poupard, Orange’s Chief Trust Officer, a former general engineer of defense, a doctor in cryptology, and former director-general of ANSSI, avoids this trap. His career, straddling the boundary between public authority and the corporate world, has shaped his conviction: concepts are only as valuable as the organizations that embody them. In this interview, he repositions each of these three pillars—operationally and strategically—and outlines the role a global operator like Orange has to play in a world where might often trumps international law.

Key Takeaways : 

1. Trust is not declared; it is earned and demonstrated. It is granted by customers, partners, employees, and authorities, never self-assigned by the company.

2. Resilience is a necessary condition for trust, not its synonym. It means absorbing shocks, limiting effects, and returning to a normal state—not the absence of incidents.

3. Governance takes precedence over technology. Two non-negotiable prerequisites: genuine expertise and a decision-making chain capable of elevating these issues to the executive committee and board of directors.

4. Sovereignty is mastery over dependencies, not self-isolation. Orange cannot be sovereign; it contributes to the national sovereignties of its 26 countries.

5. Combating information manipulation will be the next battleground for operators, beyond traditional cybersecurity.

Trust: An Attribute, Not a Declaration

A fundamental misconception that Guillaume Poupard corrects from the outset is that trust is a positive, encompassing term, and that’s precisely its trap. Without operationalization, it remains ethereal, decorative, and almost counterproductive.

---

“You cannot declare yourself trustworthy. You can do everything to earn it, but it’s not for us to declare it. It’s our employees, partners, especially our customers, and public authorities who grant us their trust.”

---

This seemingly simple distinction has profound implications for how an organization must structure its actions. Being trustworthy requires demonstrating several things simultaneously. First, security: the pressure in cybersecurity today is extremely high, and the level must meet expectations. Second, transparency and regulatory compliance: the telecom sector is probably the most regulated, alongside finance, with ongoing regulatory sedimentation in cybersecurity and data protection. Third, ethics: beyond regulation, a brand like Orange inspires trust because it is expected to behave ethically above average.

Resilience is part of this entire framework, not as a synonym for trust, but as one of its necessary conditions. For a telecom operator, this condition is particularly demanding: users simply do not imagine that the service might not work. Telecom quality, the so-called five-nines, is a standard with no equivalent in other digital sectors. The emergency number outage in France is the most striking illustration: five years later, it remains in memory, whereas a similar outage in a cloud provider would be forgotten the next day.

Resilience: A Definition to Revisit at Its Roots

The term “resilience” has suffered the same fate as “digital transformation”: overuse has diluted its precision. Guillaume Poupard restores it with an operational definition.

---

“Resilience doesn’t mean that problems never happen. It means that when problems occur, we can absorb the shock, limit the effects, and returning to a normal state.”

---

This is not just semantic; it’s organizational. It implies that incidents should not be denied but prepared for. This preparation rests on two pillars that Poupard emphasizes before any technological investment.

The first is expertise. Good security cannot be achieved without expertise: it’s a prerequisite that cannot be decreed. Cyber threat intelligence, understanding attackers’ tactics, mastery of evolving technologies, all require real skills built over time.

The second is governance. This is where Poupard’s analysis becomes most incisive. Security is not purely a technical issue. The era when a leader could hide behind technical ignorance to avoid responsibility is over.

---

“You don’t know anything, but that’s your problem.”

---

At Orange, cybersecurity and associated resilience issues are discussed at the executive committee (COMEX) every two months. This rhythm is not accidental: it fosters gradual cultural change, ensuring that when a real operational problem arises, decision-makers are not caught off guard. It’s also essential that a member of the executive committee takes ownership of the issue, feels personally responsible, and not just informed.

The board of directors forms the third level of this chain, and it’s also the most lagging. Its role is not crisis management but challenging the company with its preparedness. Yet, one cannot claim that cyber risk can sometimes be the highest risk for a company and have no skills or reflexes to challenge management at the board level. This evolution in the sociology of directors is underway but remains incomplete globally.

Training as Culture, Not as Regulatory Obligation

The military metaphor Guillaume Poupard uses regarding crisis exercises is not rhetorical. It reflects a deep conviction about how resilience is built.

---

“Difficult training, easy war.”

---

Business continuity and recovery plans are only effective if well integrated into the company’s actual operations, not just produced to meet regulatory requirements. When a crisis hits, it never unfolds exactly as planned. But those who train are vastly better at adapting. The goal: technical exercises complemented by governance drills that ascend the hierarchy to top management. European regulations increasingly align with this approach and are imposing it more.

Sovereignty: Moving Beyond Misunderstanding

The global geopolitical landscape has shifted. Guillaume Poupard states plainly: we have largely returned to the law of the strongest, which overrides international law and multilateralism, in various forms and degrees depending on the actors. For Europe and Africa, caught between major blocks, the question of controlling their own destiny has come back with renewed force.

However, the often-misunderstood concept of sovereignty is flawed. Retreating into self-sufficiency, doing everything oneself, erecting barriers: this approach not only doesn’t work but misses the point. Poupard prefers a more operational formulation.

---

“I prefer the term ‘mastery of dependencies’ over sovereignty, which is very strong but sometimes vague.”

---

Mastering dependencies does not mean eliminating them. It means mapping, managing, maintaining alternatives, having multiple suppliers, understanding what they do, and steering long-term to avoid being ultimately powerless. In some cases, open source can be a concrete lever for this kind of reconquest.

Orange: Contributor to National Sovereignties, Not a Sovereign Actor

The distinction Poupard makes regarding Orange’s role is perhaps one of the most striking insights of this interview. A company, even a multinational, cannot be sovereign. What it can do is contribute to the national sovereignties of the countries where it operates.

---

“We contribute to national sovereignties. And we do so in 26 countries, or more.”

---

The reasoning is straightforward: ensuring the operation and resilience of telecom services is an essential contribution to each country’s sovereignty. If an adversary seeks to exert pressure on a nation, threatening to cut its telecommunications is one of the most effective forms of pressure. An operator unable to resist becomes a vector of national vulnerability. Beyond telecoms, the same logic applies to cloud, AI, and cybersecurity: Orange can help these states regain control over large parts of their digital infrastructure.

At the European level, a concept of collective sovereignty is beginning to emerge. The European Commission recently published a package on technological sovereignty, an issue that would have been unthinkable a few years ago, seen as protectionism. The evolution is real, even if incomplete.

The Next Front: Information Manipulation

Guillaume Poupard opens a perspective that extends beyond traditional cybersecurity but is its logical continuation. Telecom flows not only carry out technical attacks but, in the future, also disinformation campaigns targeting companies, not just states. Operators have already accepted, through a change in mindset, a role in detecting attack flows. They will need to go further.

---

“I am absolutely convinced we have a real role to play. As experts in digital trust, we have a responsibility to help businesses and consumers protect themselves against manipulation and disinformation attempts.”

---

Generative AI adds a new dimension to this risk: polite, reassuring, and built to inspire trust, it can subtly and gradually influence opinions without the user realizing it. This is not an abstract threat; it’s the logical extension of what social networks have already demonstrated at the scale of elections and public discourse.

This challenge is complex because it touches on one of the oldest foundations of telecoms: net neutrality and the confidentiality of communications. It cannot be tackled alone. But for operators who position themselves responsibly and methodically, it will be one of the most valuable areas of innovation in the coming years.