Updated: June 20, 2024

Cost savings are still the #1 reason organizations are adopting cloud services. In theory, reducing capital expenditures for data centers, hardware, software, and staff frees up capital. The adoption of less costly cloud services becomes the new operating model. The cost savings can then be redirected to meet budgetary shortfalls, fund new initiatives, or even provide a short-term bump in operating margins.

While cost savings remain a popular metric for measuring business success, it's crucial to be aware of the emerging complexities associated with hybrid IT, Cloud, and multi-cloud environments. These complexities are still impacting organizations’ adoption rates. The challenges of cost control, increasing cybersecurity threats, multiplying compliance requirements, emerging third-party vendor risks, and unanticipated cost growth from SaaS adoption are all factors that need to be prepared for.

Understanding the factors that can potentially impact your expected cloud cost savings is crucial. Let’s take a brief look at each of these factors and how they can negatively affect your cloud cost savings.

1. Strategy, Total Operating Costs, and Cost Control

According to a 2023 Flexera State of the Cloud Report, nearly 80% of IT Professionals reported that managing cloud costs was their greatest challenge. However, with the right strategies in place, organizations can regain control. Executives expecting cloud-based cost savings are discovering unchecked cloud growth, and project cost overruns are depleting the forecast savings. However, with an established cloud strategy and an active IT governance process, organizations can establish processes for total operating cost estimates, requirements for cloud monitoring, Shadow IT policies, and an established cost control framework, all of which are key elements in a successful cost control strategy.

2. Cybersecurity Challenges Continue to Increase

Securing sensitive and mission-critical data isn’t getting any easier. Cybersecurity Ventures reports that the cost of cybercrime is expected to reach $10.5 trillion annually by 2025, up from $3 trillion in 2015. The ever-evolving threat landscape requires constant vigilance by cybersecurity staff and service providers. With thousands of security products on the market, assembling a DIY combination of staffing, cloud management, and security tools is time-consuming and expensive. As highlighted in our Public Cloud Shared Responsibility Model webinar on June 1st, moving to the cloud doesn’t alleviate your organization's security responsibilities – whether IaaS, PaaS, or SaaS. Security concerns continue to drive organizations towards delaying cloud deployments while continuing to make expensive investments in data centers, postponing potential cost savings.

3. Compliance and Perpetual Change

Compliance requirements come in many forms depending on your industry vertical. With regulations constantly changing, maintaining compliance with Sarbanes-Oxley, HIPAA, PCI, GDPR, and others is a complex, ongoing effort. As Hybrid IT and multi-cloud environments are added to your organization’s portfolio, they must be integrated into your Compliance strategy. In addition to the internal cost of compliance, the cost of a non-compliance event can rival the cost of a data breach. According to a 2023 study by IBM, the average cost of a data breach is $4.45 million.

4. Third-Party Vendor Risk

The recent Capital One data breach, which exposed the personal information of over 100 million customers, demonstrates the risk associated with outsourcing cloud management to a third-party vendor. With a single incorrect configuration setting, the Managed Service Provider (MSP) exposed millions of records. With the average cost of a data breach reaching $4.45 million, organizations must carefully weigh the expected cost savings gained against the expense associated with a third-party-caused data breach.

5. Customizing SaaS Applications

With SaaS adoption leading all other cloud platforms, there’s an emerging trend that can erase expected cost savings: SaaS customization. Increasingly, companies offer SaaS solutions that are built to run on their OEM cloud platform. Instead of telling customers to change business processes, these vendors willingly help modify the product to fit existing customer processes. Having witnessed this firsthand, there’s a lock-in with both the OEM cloud platform and an expensive third-party support/maintenance agreement. Choosing a platform with features that approximate your business model and have minimal changes to the SaaS functionality may help avoid cost growth when selecting a SaaS vendor.

6. Hybrid Cloud Complexities and Application Repatriation

Many organizations are now adopting hybrid cloud environments to balance the benefits of both public and private clouds. However, managing a hybrid environment adds layers of complexity and cost. Issues such as data latency, integration challenges, and inconsistent security policies can negate the anticipated savings.

Moreover, some organizations are repatriating applications back to on-premises data centers. This can be due to several reasons, including cost control, data sovereignty, performance issues, and security concerns. Application repatriation, while potentially cost-saving in the long run, involves significant upfront investments and meticulous planning.

Case Study: Retail Chain Repatriation

A national retail chain decided to repatriate several of its critical applications from the public cloud to its on-premises data centers due to escalating costs and performance concerns. The structured approach included:

Comprehensive Cost-Benefit Analysis: Evaluating the long-term financial impact of repatriation versus continued cloud usage.
Detailed Migration Plan: Outlining the steps for a seamless transition with minimal disruption to business operations.
Enhanced Security Protocols: Ensuring robust security measures to protect sensitive customer data.
Performance Optimization: Fine-tuning applications for optimal performance in the on-premises environment.

The result was a 25% reduction in annual IT costs and improved application performance, demonstrating that repatriation can be a viable strategy under certain circumstances.

High-Level Description of Methodology for Application Repatriation

Assessment and Planning: Conduct a thorough assessment of the applications and workloads to determine the feasibility and benefits of repatriation.
Cost-Benefit Analysis: Perform a detailed cost-benefit analysis to justify the repatriation decision.
Migration Strategy: Develop a comprehensive migration strategy, including timelines, resource allocation, and risk management plans.
Security and Compliance: Ensure that all security and compliance requirements are met during and after the migration process.
Testing and Optimization: Rigorously test the applications in the new environment and optimize for performance and reliability.
Monitoring and Support: Implement robust monitoring and support mechanisms to manage the repatriated applications effectively.

Conclusion

We’ve covered several factors that can negatively impact expected cloud cost savings. Executive Leaders have high expectations for cloud computing projects that, in many cases, aren’t being met. Struggles with cost control, an increasing security threat landscape, continually evolving compliance requirements, and strategic sourcing decisions for third-party product and service providers represent continuous tactical and strategic challenges for organizations.

Recommendations

Brookey & Company recommends these tips for Executive Leaders:

Form a Cloud Strategy Team: If you don't have a cloud strategy in place, form a team of technical and business stakeholders immediately. Give the team a realistic deadline for completing your cloud strategy. If you don’t have the in-house resources or skills, invest in external resources to establish a plan.
Update Existing Cloud Strategies: Already have a cloud strategy? When was the last update? Are you using Key Performance Indicators to measure progress? Are you getting the maximum benefit from your cloud investments?
Establish IT Governance: Does your organization have an IT governance process in place? Are meetings held on a scheduled basis or ad hoc? If not, establish the governance membership. Ensure representation across your organization to include Finance, Risk & Compliance, IT Operations and Cybersecurity, Strategic Sourcing/Procurement, Legal, and Engineering/Product Development. Set the agenda and meet on a pre-scheduled basis with allowance for ad hoc “emergency” meetings.
Develop an IT Roadmap: Establish a time-phased IT Roadmap to chart your cloud journey. Identify cloud-ready applications and workloads early in the Roadmap. Use cost savings to expedite projects to retire and replace data center-based legacy applications to further decrease IT operating costs.
Align Executive and Board Understanding: Ensure the Executive team and Board of Directors understand the complexity of cloud computing when providing directives like cloud quotas. The data center and cloud teams must be in sync to execute the Cloud Strategy effectively.
Set Budget and Resource Priorities: Using the cloud strategy as the framework to set budget and resource priorities to meet the organization’s business agility and innovation needs.

Establishing your Cloud Strategy, IT Roadmap, and Governance process is an investment in future cost savings. You’ll save time and money by avoiding ad hoc reevaluation and analysis of every new project/product someone in the organization wants to consider.

Brookey & Company uses a multi-step, phased cloud adoption framework to plan and execute cloud strategies that capture cost savings, manage risk, and keep Business and IT aligned. Partner with us to navigate your cloud journey with confidence and precision.

For additional information on cloud computing, view our Insights “Cloud Computing - Looking Beyond the Cost Savings” and “5 Reasons Why Your Organization Needs a Cloud Strategy Now”.

© Brookey & Company, Inc. Unauthorized reuse—including by automated systems—is prohibited under applicable copyright law. Monitoring and enforcement in place.