In conversation with: Cirata’s Stephen Kelly

British businesses spend billions each year on cloud computing and data infrastructure from Amazon, Microsoft and Google. This isn't just a procurement preference—it's becoming a strategic vulnerability that could cost the UK economy dearly, according to one executive who's watched the problem worsen from both sides of the Whitehall fence. Recent cyberattacks on major British firms have exposed how concentration of infrastructure with a handful of American providers amplifies rather than diversifies risk.

Stephen Kelly, now chief executive of London-listed data management firm Cirata, increased UK government technology spending on domestic suppliers from 6% to 25% during his tenure as chief operating officer of the Civil Service—pumping an additional £9bn annually into British SMEs. He argues that progress has since unravelled, with the public sector retreating to the comfort of American tech giants whilst private companies suffer from what he calls 'tall poppy syndrome': an inability to back British challengers even when they offer comparable solutions. The diagnosis is sharp. Whether it's accurate is more complicated.

The sovereignty argument gains teeth

Kelly's timing is deliberate. Cyberattacks on Jaguar Land Rover, Marks & Spencer and the Co-op in recent months have demonstrated how quickly operational paralysis can spread when critical systems fail. What he doesn't specify—but strongly implies—is that concentration of infrastructure with a handful of American providers amplifies these risks rather than diversifying them.

The geopolitical dimension has shifted from theoretical to tangible. Technology is no longer a neutral service layer but an instrument of national leverage. Cloud platforms can be subject to extraterritorial jurisdiction. Data flows face regulatory intervention.

British enterprises have developed what Kelly characterises as a 'drug addiction' to US technology—a pattern that becomes self-reinforcing as American providers achieve scale, drive down costs, and make procurement directors' decisions easier to justify even as strategic risk accumulates with each renewal.

According to research from Tech Nation, UK businesses directed approximately 68% of their technology procurement budgets to non-UK suppliers in 2023, with American firms capturing the lion's share. The pattern becomes self-reinforcing: US providers achieve scale, which drives down costs, which makes procurement directors' decisions easier to justify—even if strategic risk accumulates with each renewal.

Cultural diagnosis or convenient excuse

The 'tall poppy syndrome' accusation deserves scrutiny. Kelly claims Cirata—which provides data migration and orchestration tools—finds it easier to win contracts with major American consumer companies than with British enterprises. This suggests something deeper than rational procurement calculations.

Yet procurement directors might offer a different story. American tech giants don't dominate by accident. They invest staggering sums in research, development and customer acquisition. AWS alone spent $85bn on capital expenditure in 2023.

That level of investment creates genuine capability advantages: better uptime, broader service catalogues, deeper integration ecosystems. British firms choosing Microsoft Azure or Google Cloud aren't necessarily succumbing to cultural cringe. They're often making defensible decisions based on cost, capability and—ironically—risk management.

What's interesting here is that Kelly's own career illustrates the challenge. Cirata, formerly known as WANdisco, underwent significant restructuring and a name change—hardly the profile of an unassailable market leader. The company is London-listed but hasn't broken into the FTSE 250, suggesting it remains a specialist player rather than a household procurement name. Kelly is effectively pitching his own solution whilst diagnosing a cultural problem, which doesn't invalidate his argument but does complicate it.

The procurement lever

Kelly identifies three mechanisms for reducing dependence: directed procurement by large enterprises and government, enforced interoperability standards, and long-term capital backing from British institutional investors. The first is the most actionable.

During his time in government, increasing domestic tech procurement to 25% created a visible multiplier effect. British suppliers won contracts, scaled operations, attracted investment and hired staff. The economic case for buying British—when quality and price are comparable—is straightforward.

Public sector procurement has reverted since Kelly's departure, though precise current figures are elusive. Cabinet Office data suggests technology spending with SMEs dropped to approximately 14% by 2022, though definitions vary. What's undeniable is that recent major contracts—from cloud hosting to digital identity systems—have predominantly gone to the usual American suspects.

Private sector procurement is harder to shift. Companies optimise for their own balance sheets, not national strategic priorities. Without regulatory incentives or genuine competitive advantages, telling procurement directors to favour British suppliers for sovereignty reasons is wishful thinking dressed as strategy.

Risk versus reality

Kelly's framework focuses heavily on vulnerability: cyberattacks, geopolitical disruption, infrastructure control. These risks are real. What gets less attention are the potential costs of fragmenting away from American platforms.

Innovation velocity matters. AI tooling, machine learning frameworks and cutting-edge cloud services typically launch on AWS, Azure and Google Cloud first—sometimes exclusively. British firms that can't access or integrate with these tools face a different kind of strategic risk: falling behind competitors who can.

Interoperability, Kelly's second lever, is the elegant solution. If data and workloads can move freely between providers, businesses gain optionality without sacrificing capability. The European Union's Digital Markets Act pushes in this direction, mandating data portability for designated gatekeepers. Whether UK regulators follow suit will partly determine whether British providers can genuinely compete or remain niche players serving compliance-driven buyers.

The capital question is thornier still. British pension funds and institutional investors have historically favoured lower-risk, shorter-term positions. Deeptech infrastructure plays require patient capital willing to absorb years of losses before scale economics kick in. Asking fund managers to prioritise national resilience over returns requires either regulatory change or a very different investment committee culture.

Kelly's vision of Britain as a leader in data infrastructure and AI is appealing. Achieving it requires more than exhortation. It demands that British technology firms consistently deliver products procurement directors choose for reasons beyond patriotism—and that the gap between aspiration and current capability gets acknowledged as clearly as the sovereignty risks Kelly rightly identifies.