It might seem odd to give advice on cloud adoption at this point in the hype cycle. After all, much of the industry considers public cloud a settled area with established practices and success stories. Surely there’s more than enough advice to help newcomers plan and execute their cloud transition?

Despite all the available information, I still see organizations struggling along the way on their cloud journey. Many well-intentioned cloud migration programs sputter and stall in their attempt to turn the promise of on-demand elastic compute into concrete, measurable benefits to their business.

Sure, we have shelves of literature describing how to architect cloud systems “well” and how to securely engineer complex compute environments and network topologies. But there’s still very little information on how to structure your organization, to employ operating models that embrace the potential of extreme virtualization. Finally, I see businesses busily ignoring the lessons of the past and creating fleets of assets that will be, at best, costly to maintain and at worst, unmaintainable.

In their haste to move to the cloud, organizations are accruing technical debt faster than they can pay it down. They’re creating one-off, hard-to-replicate environments and failing to implement even the most basic quality checks on those assets. In the long run, these assets will consume far more in maintenance costs than will ever be saved in moving from an on-premise data center to a public cloud provider.

In this article I’ll try to point out some of the common pitfalls I’ve seen companies make in their move to the cloud and then humbly offer an alternative.

Why is cloud success so elusive?

I’ve seen this pattern play out a number of times over the course of my career. A new technology comes along, it promises to be the future. Industry analysts draw quadrants and select winners and businesses assume that by going with a winner, they can avoid the hard work of learning a new discipline. They assume that by selecting the right IT outsourcing partner and managing the costs closely, the business benefits will naturally accrue. This has never been the case.

Businesses that succeed with new technology do so by adapting their organization, their operating model, and their engineering capabilities to the new paradigm. In many cases they also need to adapt their business model as well.

In the case of cloud, one way this fallacy manifests is in the belief that cloud is simply an alternate form of infrastructure. Cloud becomes the responsibility of the infrastructure or operations division who previously managed data centers and physical networks.

But cloud isn’t just a virtual form of hardware infrastructure. Rather, it’s 100% software.

The same businesses that hand over cloud implementation to an infrastructure or operations team would never dream of handing that same team a major, multi-year software development project. But that’s what cloud implementation is: a major, multidisciplinary, software delivery effort.

Another common pitfall that businesses encounter in their rush to move to the cloud — and which constrains their long-term success — is to become deeply and inextricably entangled with a single cloud vendor.

The three major vendors have achieved relative parity across a fundamental set of services and are competing fiercely to capture a larger portion of the market. Their pricing, the services they offer, and their business practices all encourage cloud customers to consume ever more services and to take greater advantage of the vendor’s unique, differentiating features. These proprietary features are inherently difficult to port from one vendor to another. And single-vendor entanglement also carries risk — primarily by moving control over IT decision-making away from the business and into the hands of the vendor.

The four dimensions of successful cloud adoption

I’ve noticed that the most successful cloud adoption strategies go beyond replatforming and instead incorporate a 360-degree approach to change. You might be lucky enough to lower costs by considering infrastructure alone but to see an impact on top-line revenue, market share, or innovation, your response must be broader. Shifting from on-premise infrastructure to cloud hosting is only the first step. Maximizing the business benefit from a move to cloud requires attention to the following four dimensions:

Technical excellence

Cloud is software and effectively leveraging cloud requires an investment in software engineering capability. Cloud-native engineering is more than simply leveraging a vendor’s services, it requires rethinking some common assumptions about resilience and application design. Infrastructure code demands the same attention to quality as you would apply to customer-facing systems. Successful software delivery efforts should deliver business value early and often. Cloud implementation is no different.

Autonomy with alignment

Moving from a world of physical resources — maintained by specialists and housed in a remote colocation facility — to software-defined network, compute, storage and support is a significant organizational disruption. Delivery teams are now responsible for defining and maintaining their own hosting environments. Security, compliance, strategic alignment, and support responsibilities all shift to the left.

Self-service platforms

Cloud vendors — through their APIs and broad education efforts — have democratized access to hosting environments. This ease of access must be passed along to corporate developers if corporations are expecting to see the step change in productivity that cloud affords. Internal, self-service cloud platforms should be optimized to roll out customer-centric digital products at an accelerating pace.

Vendor choice

Every business needs a multi-cloud strategy. That strategy might be to accept the risk of single-vendor dependency in exchange for developer productivity and favourable pricing. But this must be a deliberate choice rather than a series of unconscious actions. It also pays to be aware of the unique services each vendor offers so that you can choose from a palette of options, rather than being tied to a single vendor for all your needs.

Introduction: Why Cybersecurity Predictions Matter

Cybersecurity is defined by a constantly shifting threat landscape. Attack vectors evolve, tooling matures, and threat actors adapt faster than most organizations can respond. Heading into 2020, several important trends were converging: accelerating cloud adoption, the early rollout of 5G networks, increasing use of artificial intelligence by both defenders and attackers, and a wave of industry consolidation. The following five predictions capture where security practitioners and analysts believed the industry was heading — and why each area deserved attention.

1. More Security M&A Activity

Consolidation in the cybersecurity market was already well underway by the end of 2019. According to Momentum Cyber’s Cybersecurity Market Review for Q3 2019, the third quarter of that year reached a record high, comprising 146 transactions valued at more than $15.5 billion. This included 39 mergers and acquisitions worth approximately $13 billion, plus 107 financing transactions totalling $2.5 billion.

The prediction for 2020 was straightforward: niche and emerging security vendors would continue to be acquired by larger, more established players seeking to fill capability gaps quickly rather than build internally. The strategic rationale was clear — buying proven technology accelerates time-to-market and eliminates a competitive threat in a single move.

A prominent example from late 2019 was VMware’s acquisition of Carbon Black, a move that signalled the intent of major infrastructure vendors to embed security directly into their core platforms rather than treat it as an add-on. VMware projected that the Carbon Black business would contribute approximately $1 billion in revenue in the near term. This “security baked in” philosophy — rather than bolted on — represented a meaningful architectural shift in how enterprise security is delivered.

2. Open Source Security Takes Hold

The security industry has historically been slower to adopt open source practices than other technology sectors, often citing concerns about exposing vulnerability information or undermining commercial differentiation. By the end of 2019, however, several significant open source security initiatives suggested that attitude was changing.

Google and a coalition of partners launched OpenTitan, an open source project focused on silicon root of trust (RoT). The project aimed to produce a reference design for a RoT silicon chip, along with integration guidelines for use in data center servers, storage hardware, and other devices. Establishing a hardware-level root of trust is fundamental to supply chain security — if you cannot verify the integrity of the silicon, you cannot fully trust anything running above it.

Separately, IBM Security and McAfee co-founded the Open Cybersecurity Alliance (OCA), an initiative organized under OASIS (the Organization for the Advancement of Structured Information Standards). The OCA’s stated goal was to create interoperable security technologies through shared open source code and content, reducing the friction caused by siloed, vendor-specific security tooling. Interoperability remains a genuine pain point in enterprise security stacks, where teams often manage dozens of tools that do not natively communicate.

The prediction was that 2020 would see broader industry adoption of open source security frameworks, driven by growing customer demand for transparency, collaboration, and vendor-neutral tooling.

3. Security Moves to the Edge

As workloads have moved from centralized data centers to distributed cloud and edge environments, the traditional perimeter-based security model has broken down. Routing all traffic through a central security stack introduces latency and becomes a bottleneck — an unacceptable tradeoff when low-latency connectivity is a core business requirement.

The emerging answer in 2019 was to distribute security capabilities closer to where users, applications, and devices actually operate. Several vendors were already building in this direction:

• Netskope launched its NewEdge infrastructure to deliver cloud security services with lower latency by positioning security closer to cloud on-ramps.
• Forcepoint rearchitected its Web Security platform with edge delivery in mind.
• Palo Alto Networks positioned its Prisma Cloud platform as a cloud-delivered security service spanning multiple environments — what analyst firm ESG described as an “elastic cloud gateway” model.

Palo Alto Networks also announced a partnership with Google Cloud to develop a multi-cloud security framework using Prisma Cloud. The prediction for 2020 was that edge-delivered security would shift from a differentiator to a baseline expectation, especially as 5G and IoT deployments expanded the number of endpoints requiring protection.

“We see a lot of vendors heading this way and we do see this as the way all should or will move in the future.”

Doug Cahill, Senior Analyst and Director of Cybersecurity Practice, ESG

4. AI Will Accelerate Both Security Response and Attacks

Artificial intelligence and machine learning were already being applied to security operations by 2019, primarily for threat detection and anomaly identification at a scale and speed that human analysts cannot match. The volume of telemetry generated by modern cloud environments, endpoint agents, and network flows makes manual triage effectively impossible without automation.

However, the same capabilities that make AI valuable for defenders also make it valuable for attackers. The prediction heading into 2020 was that AI-enabled offensive techniques would become more prevalent. Specifically, security vendor Blue Hexagon forecast that malware using AI models to evade sandbox analysis would emerge. Traditional sandbox evasion relies on static rules to detect a sandbox environment — for example, checking for signs that the malware is running in a virtual machine rather than on real hardware. AI-based evasion would allow malware to more accurately analyze its execution environment, making sandbox-based detection less reliable.

Blue Hexagon CTO Saumitra Das wrote: “As a result of these malware author innovations and existing limitations, the sandbox will become ineffective as a means to detect unknown malware.”

The broader implication for security teams is that AI is not a silver bullet. As defenders adopt AI-assisted tooling, adversaries adapt. Security operations need to treat AI as one layer of a defense-in-depth strategy, not a replacement for other detection and response mechanisms.

5. 5G Security Becomes a Real Concern

Commercial 5G network deployments began rolling out at scale in 2020, and with them came a new and significantly larger attack surface. Unlike previous generations of mobile networks, 5G is built on a more complex, software-defined architecture. This introduces both the flexibility of software-driven networking and the corresponding security risks of software vulnerabilities, misconfiguration, and supply chain exposure.

Key concerns identified by security researchers and vendors heading into 2020 included:

• Expanded attack surface: 5G networks are designed to connect billions of IoT devices. Each additional endpoint is a potential entry point for attackers. IoT devices are notoriously difficult to patch and often remain in service for years beyond their intended security support window.
• IoT traffic interception: Vulnerabilities in 5G protocols could allow attackers to snoop on IoT traffic or remotely compromise IoT devices — including, in some scenarios, reprogramming them entirely.
• Supply chain risk: The hardware and software components that make up 5G infrastructure come from a broad set of vendors, each with their own security posture. CEO Saryu Nayyar of Gurucul noted: “The vast 5G supply chain is susceptible to the introduction of vulnerabilities such as malicious software or hardware and poor designs.”
• Confidentiality and availability impacts: Compromised network assets can affect both the confidentiality of data in transit and the availability of services, with downstream consequences for enterprises and consumers relying on 5G connectivity.

Saumitra Das of Blue Hexagon summarized the architectural challenge: “This new architecture means services will operate within a more complex environment with a broader attack surface that requires more security diligence on the part of the service providers.”

Key Takeaways for Security and DevOps Teams

Looking at these predictions together, several themes are relevant for DevOps and platform engineering teams responsible for securing their organizations:

• Consolidation creates integration opportunities — as vendors merge, watch for improved native integrations between security tooling and infrastructure platforms.
• Open source security frameworks reduce lock-in — initiatives like OCA and OpenTitan create vendor-neutral foundations worth tracking for enterprise adoption.
• Security architecture must follow workload architecture — if your workloads run at the edge or in multiple clouds, your security controls need to follow them there.
• AI-assisted detection requires adversarial thinking — assume attackers will probe and probe your detection models; build for resilience, not just detection accuracy.
• 5G and IoT demand explicit security design — connected devices should be treated as untrusted endpoints by default, with network segmentation and least-privilege access enforced at the infrastructure level.

Originally sourced from SDxCentral (December 2019). Quotes and statistics are attributed to their original sources as cited in the SDxCentral article.