This article is based on an interview originally published by Digital Journal with George Burns III, Senior Consultant of Cloud Operations at SPR, a technology services firm.
Cloud Adoption Is Accelerating — But So Are the Risks
The public cloud market has been on a sustained growth trajectory, driven by major platforms from Amazon (AWS), Microsoft (Azure), and Google (GCP). Yet beneath the headline growth figures lies a more complicated story: the organizations migrating to the cloud are frequently introducing the very security vulnerabilities they hoped to avoid.
According to figures cited in the original interview, nearly half of organizations surveyed had experienced a cloud security incident, and a significant share had considered moving data back on premises as a result. With half of companies storing personally identifiable information (PII) in the cloud, and roughly a quarter storing payment data there, the stakes are high.
George Burns III, a Senior Consultant of Cloud Operations at SPR, offers a practitioner’s perspective on what those risks actually look like and how engineering and IT leadership teams should respond.
How Fast Is the Cloud Market Growing?
Burns describes cloud growth as broad and sustained across most market segments, with new workloads increasingly being born in the cloud rather than migrated to it. As that shift matures, overall growth rates are expected to stabilize into a more predictable maintenance curve for established services.
The most significant growth potential, Burns argues, lies in emerging technologies:
- Edge computing: Extending compute and data resources closer to end users and devices for lower latency and better experiences.
- IoT infrastructure: The growing fleet of Internet-connected devices and the cloud platforms that support them represent a major new deployment surface.
- AI and ML workloads: The explosion of artificial intelligence and machine learning has directly influenced hardware design — particularly GPUs — and how cloud data centers are architected.
Who Are the Major Players?
Burns identifies the three dominant public cloud providers as AWS, Microsoft Azure, and Google Cloud Platform (GCP). Beyond the hyperscalers, he notes that industry-specific players carry significant weight in their own domains — for example, Epic Systems in the electronic medical records space.
Oracle’s influence extends into cloud through its widely deployed Oracle and MySQL database products. Hardware manufacturers also play a shaping role: as data centers expand and AI workloads grow, chip design itself is being influenced by cloud infrastructure trends.
Storage is another area of active evolution. As data volumes grow and data ages, tiered storage strategies have emerged — with low-cost, high-latency solutions for cold archival data, and high-speed technologies like NVMe over network fabrics addressing the demand for sub-millisecond latency at the hot end.
The Real Source of Cloud Security Risk
Burns makes a distinction that is worth internalizing: the cloud platform itself is rarely the source of risk. The risk lives in the connective tissue — the integrations, configurations, and human decisions that tie platforms and products together.
This is a pattern that DevOps and platform engineering teams encounter repeatedly. Misconfigurations, overly permissive IAM policies, unreviewed third-party dependencies, and undocumented change processes create far more incidents than vulnerabilities in the underlying cloud infrastructure.
Burns identifies several concrete areas of focus:
- Documentation and change management: Maintaining accurate, up-to-date records of infrastructure state is foundational to security. Configuration drift is a common vector for incidents.
- Certificate authorities and trust chains: The integrity of trusted CAs matters more as cloud-connected systems multiply. Any erosion of that trust chain creates systemic exposure.
- Data flow mapping: You cannot secure what you cannot see. A complete understanding of how data moves through your infrastructure — including across third-party integrations — is a prerequisite for effective security posture.
- Vendor and partner vetting: Working with certified, knowledgeable partners is not optional. An insecure partner with access to your environment is a direct security risk to your platform.
How Many Businesses Have Been Affected?
Burns is candid: “More businesses have been impacted by cloud security issues than we’ll ever be able to accurately count.” He argues that the concept of “cloud security” now encompasses almost any data leak or breach scenario, because the cloud touches nearly every layer of modern business infrastructure.
Not every organization will detect every incident. Some breaches stem from under-resourced security teams that lack the tooling or expertise to identify threats. Others originate in failed business relationships — a compromised vendor, a poorly scoped contractor, a misconfigured SaaS integration.
Burns’s position is direct: every business will eventually experience a cloud security gap. Many already have, whether they know it or not.
Practical Steps to Reduce Cloud Security Exposure
Burns outlines a practical framework for reducing risk, applicable to both cloud providers and their customers:
- Work with certified practitioners. Cloud platforms evolve rapidly, and the skill sets required to operate them securely are specific and often platform-dependent. Ensure the people managing your infrastructure hold current certifications and have hands-on platform experience.
- Conduct regular security reviews and audits. One-time assessments are insufficient. Scheduled, recurring audits help surface configuration drift, access control issues, and newly introduced vulnerabilities before they become incidents.
- Build security into your deployment processes. Integrating security review into CI/CD pipelines and infrastructure-as-code workflows reduces the window between introducing a vulnerability and detecting it.
- Maintain visibility into your full data footprint. Know where your sensitive data lives, who has access to it, and how it flows between services and partners.
What the Future Looks Like for IT Leaders
Burns frames the challenge for IT leadership as a balancing act: “The stability of the proven versus the promise of the new.” Emerging technologies attract attention and often drive genuine competitive advantage, but they also carry unknown risk profiles and are more likely to have unpatched vulnerabilities or immature security tooling.
His prescription for successful IT leadership: embrace change, but do so within a framework of deliberate security and stability governance. Public cloud will remain the default deployment target for most organizations. The leaders who navigate this well will be those who can evaluate and adopt new capabilities without sacrificing the operational discipline that keeps their platforms secure.
Key Takeaways for DevOps and Platform Teams
- Cloud platforms are generally well-hardened. Your configuration, access controls, and integrations are the attack surface.
- Misconfiguration and human error — not infrastructure vulnerabilities — drive the majority of cloud security incidents.
- Regular audits, certified practitioners, and complete data flow documentation are non-negotiable baseline practices.
- Every organization operating in the cloud should assume they have already experienced a security gap, and invest accordingly in detection and response capabilities.
- IT leaders must balance innovation adoption with operational security discipline — neither pure conservatism nor unchecked experimentation serves the organization well.
Original interview conducted by Digital Journal. Statements attributed to George Burns III, Senior Consultant of Cloud Operations, SPR.