This article is based on analysis originally published at venturebeat.com in October 2017. Some market figures and ecosystem details reflect that period; the underlying architectural concepts remain relevant.
What Is Serverless Computing?
Serverless computing is a cloud execution model in which the hosting provider dynamically allocates compute resources on demand. Customers are not required to provision, manage, or pay for dedicated servers or reserved capacity in advance. Despite the name, servers still exist — the key difference is that infrastructure management is entirely abstracted away from the developer.
Serverless is widely considered the next phase in the evolution of Infrastructure-as-a-Service (IaaS). By virtualizing both the runtime environment and operational management, it allows teams to focus entirely on application logic. The model is frequently called Function-as-a-Service (FaaS), because the basic unit of deployment is an individual function or task rather than a long-running process or container.
Core Advantages of Serverless Architecture
Agility
Because developers are not deploying, patching, or scaling servers, organisations can eliminate a significant portion of their infrastructure administration overhead. Serverless pairs naturally with a microservices architecture: small, independently deployable functions map well to discrete business capabilities, which accelerates release cycles and reduces the blast radius of any single change.
Automatic Scalability
Serverless platforms scale function instances up and down in response to real-time demand without any manual intervention from a DevOps team. An application that receives unpredictable or spiky traffic — a flash sale, a viral event, an IoT sensor burst — can absorb that load automatically and then scale back to zero when demand subsides, without any pre-warming or capacity planning.
Pay-Per-Use Billing
Traditional cloud models charge for allocated capacity whether or not it is being used. Serverless introduces a true consumption-based billing model: you pay only when a function executes, typically measured in invocation count and execution duration. This makes it particularly cost-effective for workloads with low average utilisation but occasional high peaks, or for microservices that are invoked infrequently.
Improved Security Posture
Removing server management from the customer’s responsibility also removes an entire category of attack surface. Operating system vulnerabilities, misconfigured SSH access, and server-level malware installation become the cloud provider’s concern. Additionally, the ephemeral and stateless nature of serverless functions limits the window of opportunity for certain attack patterns, and the platform’s automatic scaling can help absorb volumetric DDoS traffic that would overwhelm a fixed-capacity deployment.
Why Serverless Matters Beyond Early Adopters
Serverless is not just a productivity tool for small teams or startups. It has significant implications for large-scale distributed systems. The Internet of Things (IoT) is one compelling example: billions of devices generating intermittent, event-driven data are a near-perfect match for a FaaS execution model, where compute is triggered by incoming events and scales seamlessly with device population growth.
The major cloud platforms — Amazon Web Services, Google Cloud, Microsoft Azure, and IBM Cloud — all offer first-party serverless products. AWS Lambda, launched in 2014, was the first widely adopted commercial FaaS offering and remains a reference implementation for the category. At the time of the original article (2017), AWS reported growing enterprise adoption of Lambda, and competing providers were making similar investments.
The Serverless Ecosystem
The serverless ecosystem extends well beyond the major cloud platforms. It is broadly organised into two layers:
Platforms and Frameworks
Alongside the hyperscalers, a range of platforms and open-source frameworks have emerged to give developers more choice in how they host and run serverless workloads:
- Iron.io — A serverless application platform that supports deployment across public cloud, private cloud, and on-premises environments, giving teams more control over data residency and compliance.
- Auth0 Webtask — Developed by the Identity-as-a-Service company Auth0, Webtask allows developers to run server-side logic without managing infrastructure, with built-in support for a variety of integrations.
- Serverless Framework — A popular open-source, provider-agnostic framework that gives developers a unified interface for building, deploying, and operating serverless applications across multiple cloud providers.
Technology Enablers
A second category of tooling focuses on making serverless platforms easier to operate and observe in production:
- Stackery — An operations management platform that provides infrastructure provisioning and lifecycle visibility for serverless applications.
- IOpipe — A monitoring and debugging tool designed specifically for serverless functions, addressing the observability gap that standard APM tools often leave in FaaS environments.
- Twistlock — A cloud-native security company that, at the time of the original article, offered machine-learning-based security solutions for serverless and container workloads. (Note: Twistlock was later acquired by Palo Alto Networks and integrated into the Prisma Cloud platform.)
Early Enterprise Adopters
Large organisations have validated serverless at significant scale. Netflix, which completed a full migration to the cloud in 2016 and operates at over 100 million subscribers globally, has been a prominent advocate for AWS Lambda. The company uses serverless functions for tasks including media file delivery, instance deployments, backups, and monitoring pipelines — use cases where the event-driven, auto-scaling nature of FaaS provides clear operational advantages.
Other major organisations that had publicly adopted serverless at the time of the original article include Expedia, Coca-Cola, and Adobe, demonstrating that the model is viable across a wide range of industries and workload types.
Remaining Challenges and Opportunities
Serverless is not operations-free. Monitoring, packaging, securing, deploying, and debugging distributed functions all require engineering effort — the work simply shifts in nature rather than disappearing. Several challenges remain that represent genuine opportunities for tooling vendors and platform engineers:
Immature Tooling
Traditional APM, logging, and debugging tools were designed for long-running processes, not ephemeral functions with millisecond lifetimes. Distributed tracing across chains of function invocations, cold-start profiling, and structured log aggregation for high-volume FaaS workloads all require purpose-built solutions that were still maturing when the serverless model emerged.
Vendor Lock-In
Each cloud provider implements FaaS with its own runtime model, trigger types, configuration format, and integration points. Migrating a serverless application from one provider to another typically requires changes to application code, deployment tooling, and potentially the broader software architecture. Provider-agnostic frameworks such as the Serverless Framework partially address this, but the problem has not been fully solved.
Cold Start Latency
Serverless platforms spin up new function instances on demand, but the first invocation after a period of inactivity — a cold start — incurs an initialisation penalty that can range from tens of milliseconds to several seconds depending on the runtime, function package size, and VPC configuration. For latency-sensitive applications, this can be a significant design constraint that requires workarounds such as scheduled keep-warm invocations or provisioned concurrency features offered by some platforms.
Security in a Shared Responsibility Model
While serverless reduces the server-level attack surface, it introduces new security considerations. Insecure function permissions, overly permissive IAM roles, injection attacks via event data, and third-party dependency vulnerabilities all require attention. The shared responsibility model still places significant security obligations on the application developer, even though server management has been delegated to the provider.
Summary
Serverless computing represents a genuine shift in how applications are built, deployed, and operated. For DevOps teams, it changes the work rather than eliminating it: server patching and capacity planning give way to function observability, IAM policy management, cold-start optimisation, and event-driven architecture design. The trade-offs are well-suited to event-driven, microservices-based, and IoT workloads, and the ecosystem of supporting tools continues to mature. Understanding both the advantages and the current limitations is essential for making informed architectural decisions about where serverless fits in your infrastructure strategy.