Hybrid cloud and multi-cloud have become two of the most discussed infrastructure patterns in DevOps. Despite frequent confusion between the two terms, they describe fundamentally different architectural approaches — and understanding that difference matters when you are deciding how to run production workloads. What both approaches share, however, is a dependency on containers and container orchestration. This post explains why.

Defining the Terms: Hybrid Cloud vs. Multi-Cloud

Before discussing tradeoffs, it helps to pin down what each term actually means:

• Hybrid cloud combines public and private cloud infrastructure. Resources in a corporate data center or private cloud are connected to one or more public cloud providers. The word “hybrid” reflects two different deployment models working together.
• Multi-cloud is 100% public cloud, but workloads are spread across two or more cloud providers — or across multiple regions of the same provider. There is no private infrastructure involved.

The distinction is more than semantic. Hybrid cloud introduces significant security and compliance considerations because traffic and data must cross the boundary between private and public environments. Multi-cloud simplifies the security boundary but introduces more dynamic operational complexity as workloads move between providers.

Why Run More Than One Cloud at All?

Neither hybrid nor multi-cloud architecture exists for its own sake. There are practical reasons organizations adopt each model:

1. Regulated workloads alongside modern apps. Hybrid cloud lets organizations keep sensitive or tightly governed workloads on private infrastructure while still adopting modern application development practices on public cloud. Without a hybrid model, these organizations risk falling behind on developer experience and deployment velocity.
2. Resilience and vendor independence. Public cloud providers offer high availability within their platforms, but a major outage or a deteriorating commercial relationship can strand teams. Spreading workloads across providers — or designing for portability between them — gives organizations an exit option that does not require a heroic re-engineering effort.
3. Access to best-of-breed services. No single cloud provider leads in every service category. Locking all workloads to one provider means accepting that provider’s capabilities across the board. Multi-cloud lets teams choose the right service for each job — a managed database from one provider, a machine-learning platform from another, object storage from a third.

Maturity and History

Hybrid cloud is the more mature pattern. It gained significant traction around 2015, driven largely by enterprise vendors framing it as a cornerstone of digital transformation. Many large organizations have been running some form of hybrid cloud for years, and substantial tooling exists to support it.

Multi-cloud, by contrast, became a practical reality alongside the rise of container orchestration. Containers made it genuinely feasible to package and move workloads between providers without rebuilding application infrastructure from scratch. In that sense, Kubernetes and the container ecosystem did not just benefit multi-cloud — they arguably made it a viable production strategy in the first place.

Why Containers and Kubernetes Are Essential to Both

It is technically possible to build a hybrid or multi-cloud environment without containers. You can template virtual machine images, use infrastructure-as-code tools, and stitch clouds together with VPNs and shared DNS. But without containers, you give up the portability that is the central value proposition of either architecture.

Consider two specific reasons why containers and orchestration are effectively mandatory:

1. Portability requires abstraction. Connecting multiple clouds introduces rigidity by default. Each provider has its own networking model, storage primitives, and IAM system. Without an abstraction layer that decouples application runtime from the underlying infrastructure, moving workloads between environments is expensive and error-prone. Containers provide that abstraction at the application level; Kubernetes provides it at the orchestration level. Together, they allow workloads to be defined once and scheduled wherever the base infrastructure supports the container runtime.
2. Modern applications are not just containers. A realistic multi-cloud or hybrid architecture includes managed databases, object storage, serverless functions, and PaaS services alongside containerized workloads. Kubernetes does not manage all of these directly, but it provides the control plane that ties compute workloads together, and its ecosystem — through operators, service meshes, and external-secrets tooling — increasingly integrates with managed cloud services. Ignoring the container orchestration layer means losing the unified operational model that makes running across clouds coherent.

How Multi-Cloud Benefits Most from the Container Model

Software engineering has always favored abstraction and componentization. Applications are only as portable as their least portable dependency — and historically, that dependency has been the cloud platform itself. Abstracting cloud configuration away from any single provider so that the cloud becomes just another pluggable layer is the logical extension of the same principle that drove microservices, APIs, and package managers.

This matters especially for complex application architectures. In a microservices system, each service has its own independent stack, deployment lifecycle, and performance profile. Some services may need to run close to end users at the network edge; others may need to co-locate with specific managed data services. Multi-cloud, combined with container orchestration, gives platform teams the flexibility to place each component where it runs best — without rewriting that component for each environment.

As user expectations for real-time, low-latency experiences increase, infrastructure placement decisions become performance decisions. The ability to schedule workloads dynamically across providers and regions — something Kubernetes is designed to support — directly affects the quality of the application delivered to end users.

The Cloud Management Plane: Where Tooling Still Falls Short

Cloud management tooling matured reasonably well for hybrid cloud scenarios. A number of platforms offer a unified view of on-premises and public cloud resources, templated infrastructure provisioning, and policy enforcement across environments.

Multi-cloud is a harder problem for these tools. Several gaps remain common:

• Loose coupling between clouds. Most cloud management tools treat each cloud as a separate entity and model the connection between them, rather than presenting a single unified cloud abstraction. Operators end up managing individual cloud implementations and their connection points rather than a coherent whole.
• Tooling lock-in. Some cloud management platforms introduce their own proprietary configuration formats or template schemas. This can simplify operations within the platform but creates a new form of vendor dependency separate from the underlying cloud providers.
• Observability gaps. Visibility in a single dashboard is a minimum requirement. What teams actually need is unified monitoring and observability across cloud environments — consistent alerting, tracing, and log aggregation regardless of which provider is running a given workload. This remains an area where tooling is still catching up.

The ideal cloud management plane would allow an organization to define a cloud implementation as a templatized, deployable unit and push it to any environment where the base infrastructure supports it — with the same operational visibility in every location. That vision exists in partial form today across several tools and platforms, but no single solution delivers it completely.

Summary

Hybrid cloud and multi-cloud are meaningfully different patterns serving different organizational needs. Hybrid cloud bridges private and public infrastructure for organizations that cannot fully abandon on-premises control. Multi-cloud distributes workloads across public providers to maximize resilience, access best-of-breed services, and avoid lock-in.

Both patterns promise portability. Neither delivers on that promise without containers and container orchestration. Kubernetes has become the de facto standard for that orchestration layer precisely because it provides the infrastructure abstraction that multi-cloud and hybrid cloud require. Building either architecture without it is possible — but it means designing in rigidity from the start and paying for it every time you need to move a workload.

If portability is the goal, containers are not optional. They are the mechanism by which the goal becomes achievable.

Overview

Trend Micro Incorporated (TYO: 4704; TSE: 4704) announced the extension of its network protection capabilities to the cloud through Trend Micro Cloud Network Protection, made available on AWS Marketplace. The solution was designed specifically for AWS Transit Gateway and addresses a common enterprise pain point: the operational complexity of inserting and managing network security appliances inside cloud network topologies.

The Problem: Firewall-Based Approaches in the Cloud

Traditional firewall-based network security models were built for on-premises environments and carry significant operational baggage when lifted into the cloud. According to Trend Micro, customers consistently reported three major pain points:

• Operational complexity: Managing firewall rules and routing policies across multiple cloud accounts and VPCs is labor-intensive.
• Disruptive deployment: Inserting security appliances into existing network paths often requires rearchitecting workloads or changing IP address schemes.
• Inefficiency at scale: Stateful inspection appliances that work well on-premises can become throughput bottlenecks when cloud workloads scale dynamically.

How AWS Transit Gateway Enables the Solution

AWS Transit Gateway acts as a regional network hub, centralizing routing between Amazon Virtual Private Clouds (VPCs) and on-premises networks. Instead of managing complex VPC peering meshes, network teams attach VPCs and VPN connections to a single Transit Gateway, which then controls traffic routing across all connected spokes.

Trend Micro’s Cloud Network Protection plugs into this hub model to deliver transparent inline inspection—meaning traffic is inspected as it transits the gateway without requiring changes to application configurations, routing tables within individual VPCs, or IP addressing schemes. The approach avoids the application disruption that typically accompanies inserting a security appliance into an existing network path.

FPGA Acceleration for High-Throughput Workloads

For organizations with especially demanding network traffic volumes, Trend Micro made available deployment on Amazon EC2 F1 instances, which are equipped with field-programmable gate arrays (FPGAs). FPGA-accelerated instances can offload computationally intensive packet inspection tasks from general-purpose CPUs, enabling higher throughput at lower latency—relevant for financial services, media streaming, and other high-bandwidth workloads.

Key Capabilities of Cloud Network Protection

• Transparent inline deployment: No need to rearchitect existing VPC topologies or modify application network configurations.
• Scalable inspection: Designed to scale with cloud-native elasticity, avoiding the fixed-capacity limits of traditional appliances.
• Continuous visibility: Provides ongoing monitoring of east-west and north-south traffic flowing through Transit Gateway.
• Threat intelligence integration: Leverages Trend Micro Research, including the Zero Day Initiative (ZDI) bug bounty program, to detect advanced threats, vulnerabilities, and exploits.
• Security tool integration: Designed to interoperate with existing security toolchains rather than replace them.

AWS Marketplace Availability

By listing on AWS Marketplace, Trend Micro made Cloud Network Protection discoverable and purchasable by AWS customers without requiring a separate procurement process. At the time of announcement, AWS Marketplace had approximately 230,000 active buyers, giving the solution immediate distribution reach.

“As companies move and scale their infrastructure in the cloud, they are looking for ways to easily insert and manage security appliances in their network topologies. With AWS Transit Gateway, Trend Micro’s security solution is now available to 230,000 buyers through AWS Marketplace and will help our shared customers address their network security needs in the cloud.”

— Dave Brown, Vice President, EC2 Compute & Networking Services, Amazon Web Services

“Trend Micro’s approach removes these operational challenges. With transparent deployment into the network fabric, it delivers scalable security and continuous visibility, while eliminating the need to rearchitect and avoiding application disruption.”

— Nilesh Jain, Vice President, Southeast Asia and India, Trend Micro

Customer Perspective: Copa Airlines

Copa Airlines was cited as an early customer for the solution. Alex Tarte, IT Security & Risk Manager and CISO at Copa Airlines, noted that the solution’s promise of frictionless security operations was particularly relevant for business applications that must meet the airline’s scale and performance requirements.

Why This Matters for DevOps and Cloud Network Teams

Cloud network security has historically lagged behind the pace at which DevOps teams provision infrastructure. Security appliances that require manual route table changes or static IP assignments become blockers in automated, infrastructure-as-code pipelines. A transparent inline model—where the security layer is inserted at the Transit Gateway level rather than inside individual VPC routing—aligns better with how modern cloud environments are built and operated:

• Network teams can enforce consistent inspection policies centrally, independent of individual workload owners.
• Application teams are not required to change deployment templates or Terraform/CloudFormation configurations to accommodate the security layer.
• Security posture scales automatically as new VPCs attach to the Transit Gateway, without manual intervention.

About Trend Micro

Trend Micro is a global cybersecurity vendor offering layered security for data centers, cloud environments, networks, and endpoints. The company operates in over 50 countries and runs the Zero Day Initiative (ZDI), one of the largest independent bug bounty programs, which contributes threat intelligence to its product portfolio.