Italy plans to set up a national agency tasked with combating cyber attacks as it continues work on its unified cloud infrastructure.

The country is one of many European nations attempting to enhance their cybersecurity capabilities.

Many aspects of Italy’s digital security, which are dispersed among various Ministers and state bodies, are to be brought together under the authority of the Prime Minister.

The general director and his deputy will be appointed for four years, according to a draft decree reportedly seen by Reuters. Their mandate can only be renewed once.

The new agency will involve six departments and will, in the first instance, be staffed by 300 employees, with the intention of boosting this number to 800 by 2027.

In April 2021, the Italian Government delivered a 2,500-page recovery plan tothe European Commission, which detailed an intention to utilise new cloud technology for public administration to increase security.

The plan would need investment from the EU with about €900 million apparently earmarked for it.

The project would also involve overseas tech companies, Innovation Minister Vittorio Colao announced in May.

With American-owned Amazon, Google and Microsoft being the world’s major cloud players, concerns over potential surveillance had been raised due to the adoption of the U.S. CLOUD Act of 2018.

Italy intends to create the cloud infrastructure through a public-private partnership, which will be implemented by a European tender.

Demonstrating its strength in data centre and integrated solutions, Ingram Micro Inc, has said it is first to market with all-in-one compute- and storage- As-a-Service solution sets from Veeam and Zadara.

At the heart of the new alliance is Ingram Micro’s state-of-the-art Integration Centre. Established in 2018, the Integration Centre builds technology from the ground up to spec or specialisation – offering channel partners everything from system design to compatibility and regulatory engineering. Both Veeam and Zadara are leveraging the qualified engineering skill and solutions expertise found within Ingram Micro’s Integration Centre to extend their reach into the channel and deliver a better and differentiated partner experience.

“In today’s ‘do business from anywhere’ environment, corporations want and need secure and scalable storage and compute solutions that can be consumed as a service and managed remotely with ease and greater efficiency,” said Ryan Grant, Executive Director, Integrated Solutions, Ingram Micro. “By bringing Veeam backup and Zadara Cloud Services to market together, we are shortening the sales and deployment cycles for our channel partners.”

Dangvy Keller, Vice President, Distribution Sales, Americas, Veeam, said: “Ingram Micro has served as a preferred distributor for Veeam since 2009 and continues to add more value to the mix for our mutual channel partners through its Integration Centre.”

With the UK in the midst of its third lockdown of the last twelve months, the enforced shift to remote learning has been a learning curve for schools, universities and other education providers, with teachers and students now required to access course materials and administrative documents via digital means. It has shown just how essential digital solutions are to creating a successful learning environment online.

Additionally, continued advances in the education sector mean that it’s an industry generating huge troves of data. The data produced is vast and varied: from research data to digitised library assets, student and faculty information, and video assets. As institutions continue to operate remotely, the scale of data is increasing rapidly.

The changing landscape of education requires that students and staff become more data literate. It also means that IT departments need to develop a comprehensive data management strategy for planning and implementing increasingly data-intensive education systems – one that’s efficient, compliant, and doesn’t cost the earth.

Keep your data secure
As data proliferates, one of the biggest demands for educational institutions is how to store their data cheaply and in a way that is easily and quickly accessible from everywhere.

Unless checked, organisations can easily lose control of where data is stored and how it is used. This can especially become a problem where IT security policy is concerned, so it is worth enforcing system wide protocols such as two-factor authentication to protect data against potential breaches from external threats or insiders.

A backup and disaster recovery solution is also essential. Here I’d advise adopting the ‘3-2-1 rule’ in association with cloud backups: keeping three copies of your data on at least two different formats with one copy offsite is also a good strategy. Should something happen to the primary copies of your data, your copies in the cloud will remain unaffected and will enable you to get back up to speed with little business impact. Moreover, a good storage provider should offer immutable buckets – a means of storage which renders contents fixed and unchangeable according to the minimum data immutability standards, to guard against accidental alterations or deletions.

Keep costs down
Given the growth in digital data, educational institutions are consuming far more storage space than they did a few years ago. In addition to student records and digital coursework, it’s increasingly common for institutions to need to store video lectures and other supplementary materials. Some universities have even created entire digital libraries and archives from offline resources that are accessible online to students and staff to bolster their offerings to students, teachers and faculty members.

When dealing with the petabytes of data generated by educational institutions, primary, on-prem storage can quickly eat up the IT budget as you keep needing to store more data. Cloud storage takes advantage of economies of scale, providing the ability to dynamically scale resources up or down as required, and is therefore a more cost-effective option for universities looking to store and access their data in a way that’s fast and easy to access.

However, that’s not to say all cloud storage solutions are equally economical. Many first-generation cloud providers, like Amazon or Google, don’t just charge customers based on the amount of data stored, but charge extra for accessing the data. This could quickly prove problematic for universities, if faculty members need frequent access to files. Fortunately, not all storage providers work on these models – a number of second generation services operate on all-you-can eat data models without any surprises in the form of egress fees.

IT decision makers should act as their own managed service providers (MSPs) – offering support for multiple cloud services, rather than being the gatekeepers of one provider. Rather than relying on outside MSPs to help them set up networks, provision compute resources, recommend and implement software, and so forth, education IT departments should play an active role in considering staff and student needs internally to help them choose the right solutions and avoid incompatible and fragmented services.

Embrace the hybrid cloud
Adopting a hybrid cloud approach can give you the ability to flexibly scale up on existing on-premises legacy systems. This approach enables you to keep on hand a larger amount of storage whilst relieving the stress on IT teams by moving some applications into public clouds.

With a hybrid cloud solution, IT decision makers can optimise infrastructure to meet a plethora of needs and diverse workload requirements. For example, there are applications that require rapid deployment and/or rapid scaling which are a better fit for public cloud. Other systems such as HR can be moved to a software as-a-service (SaaS) model to free up storage and on-prem capacities. With hybrid cloud, educational systems can dynamically shift workloads between on and off-premises environments based on specific performance, regulatory needs or for specific periods of time.

A hybrid cloud approach is also useful from a security perspective and can help combat the “shadow IT” problem. Key systems containing sensitive student and school data can remain in-house and behind an educational organisation’s firewall to safeguard student privacy and meet compliance regulations, whilst employees can be empowered to use public clouds for different use cases as appropriate.

There’s no doubt that the pandemic has showcased the importance of transitioning an organisation’s infrastructure to a cloud-centric approach, something that’s been recommended as far back as 2019 by the UK’s Department for Education. Today, educators can see huge benefits from adopting next-generation cloud technologies, and the transition needn’t be costly nor complex – and to protect the future of remote learning and collaboration, it’s no longer a want, but a need.

Defense-in-depth is a popular security strategy that places the applications and data (or groups of applications and data) that inhabit an architecture into designated security layers. While attackers could still gain access to one part of a system, the idea is that these multiple, varied security layers will prevent that attack from universally gaining system access. However, the defense-in-depth strategy presents a unique challenge when it comes to microservices, simply because the proliferation of independent services involved creates a massive attack surface.

Thankfully, architects can use a combination of encryption, access management, traffic analysis, monitoring and logging tools designed to address this additional complexity. For instance, microservices-centric API gateways can isolate services from outside access, manage credentials and regulate user permissions.

But while they are certainly helpful, it’s not enough to simply install and run these tools. To properly apply a defense-in-depth strategy to a microservices architecture, there are four fundamental rules every software team must abide by. Let’s review those four rules here.

Rule 1. Implement full protection
You can’t simply protect your individual microservices: You must also secure the platforms they run on, the components they connect to and the information they access. Little good is done when the services are secured, but the underlying containers, network, service mesh and management systems are left vulnerable.

Play close attention to database resources and services that cross application boundaries. Generally, it’s advisable to limit microservices interactions so that they only communicate with the applications authorized to access them. All shared resources should retain their own security mechanisms, perhaps at the network connection level, to limit risks. At any rate, you should avoid leaving any services or other application components universally accessible as much as possible

Rule 2. Never ignore edge security
Defense-in-depth doesn’t equate to simply relying on deeper layers of security to catch breaches. It’s critical to ensure that user interaction and network-edge security are also strong, particularly when remote users are involved. Teams must absolutely monitor and investigate any suspected breach attempts to prevent gradual erosion of barriers through repeated attacks.

Most edge-security strategies employ API brokers to isolate internal services, manage user credentials and maintain role-based access control. These role-based access rights reduce the burden of controlling access on a per-user basis, a practice that all-too-often results in failures and exposed vulnerabilities. Just remember to avoid getting too granular with role definitions and assignments, which compromises the simplified access control this role-based approach was meant to provide.

Rule 3. Follow your workflows to determine protection points
In microservices applications, messages flow along predictable paths. This makes it easy to see logical points for security focus, such as where messaging paths intersect. However, this doesn’t mean developers can ignore low-volume data paths. In fact, they should concentrate diligently on providing additional security in areas with considerable concentrations of workflow traffic.

Network-level security mechanisms provide the easiest way to address the security of microservices workflows, mainly by encrypting messages between microservices. However, be careful not to encrypt entire packets. Otherwise, intermediary handlers will have to decrypt the header to route traffic, holding up the entire workflow.

Rule 4. Consider zero-trust security
The final rule is to seriously consider implementing a zero-trust security model for all microservices-based applications. Most IP networks are inherently permissive when it comes to allowing connectivity, and allowing universal access is obviously problematic. Security measures like firewalls can protect assets over IP networks by limiting this universal connectivity; but, if something gets overlooked by the firewall, it immediately creates an unsafe environment.

Zero-trust mechanisms implement a default mode where no connectivity is allowed whatsoever until credentials are 100% validated. Sure, you’ll get the occasional complaint from users who make a mistake with their credentials and are denied access. However, it’s better to get a fixable complaint from a user than to be the victim of an unannounced attack on critical application systems.

But maintaining multiple cloud platforms simultaneously adds real complexity to IT environments already crowded with diverse technologies, applications, and processes. While enterprises are increasing investment in multi-cloud for business-critical workloads, a significant share of those same organizations report experiencing operational and deployment issues along the way.

The core difficulties cluster around three recurring problems: underestimating the need for cultural transformation, failing to close the skills gap, and attempting a DIY approach to cloud management without the right tooling. Addressing each of these deliberately is what separates a multi-cloud strategy that delivers value from one that quietly collapses under its own weight.

1. Make Culture Change a Priority

Cultural transformation in a multi-cloud context goes well beyond shifting the budget conversation from capital expenditure to operational expenditure, or simply selecting a cloud vendor and announcing a strategy. It requires dismantling the knowledge silos that naturally form across disparate IT teams—teams that may have deep expertise in specific vendors, legacy systems, or emerging technologies, but rarely share that knowledge across boundaries.

Achieving faster application development and shorter time-to-market depends on building trust between those teams. Concretely, this means equipping central IT with modern processes and management platforms that prioritize visibility and resource governance, while simultaneously giving developers fast, reliable access to the compute, storage, and networking resources they need. Governance and developer velocity are not opposites—a well-designed culture treats them as complementary.

Cultural maturity in a multi-cloud environment also accelerates DevOps practices in specific ways:

• Eliminating workflow bottlenecks through better process definitions and automation
• Advancing self-service provisioning so teams are not blocked waiting for infrastructure tickets
• Consolidating resources to reduce sprawl and redundant spend
• Integrating security into development from the start, rather than treating it as a gate at the end of a release cycle

Without deliberate culture work, even a technically sound multi-cloud architecture will be hampered by inter-team friction and slow decision-making.

2. Invest in Multi-Cloud Expertise and Emerging Technology Skills

The more cloud environments an organization operates, the greater the demand for specialized skills. Cloud platforms have commoditized many baseline capabilities, but meaningful differences still exist between providers in areas such as managed services, pricing models, compliance tooling, networking constructs, and geographic availability. Exploiting those differences to align workloads with the platform best suited to them requires people who understand the nuances.

Key skill areas to build or hire for in a multi-cloud context include:

• Containerization and orchestration — Kubernetes has become the dominant orchestration layer for multi-cloud workload portability, making expertise here foundational.
• Microservices architecture — Decomposing applications into independently deployable services is what makes it practical to run different components on different clouds.
• Serverless computing — Understanding the trade-offs of serverless offerings across providers (AWS Lambda, Azure Functions, Google Cloud Functions) allows teams to select the right execution model per workload.
• Infrastructure as Code (IaC) — Tools such as Terraform and Pulumi enable consistent, repeatable provisioning across cloud environments, reducing manual configuration drift.
• Cloud cost management — Tagging strategies, reserved instance planning, and rightsizing analysis all require dedicated attention as multi-cloud environments scale.

Investing in a cloud management platform that supports self-service provisioning also pays dividends here: it frees both administrators and end users from repetitive low-value tasks, giving skilled engineers more time for higher-order work.

3. Select the Right Cloud Management Platform

A cloud management platform (CMP) addresses the inherent complexity of hybrid and multi-cloud environments by providing a centralized control point. Rather than having separate teams log into separate provider consoles to provision and manage resources, a CMP creates a consistent operational layer that spans environments.

Key capabilities to evaluate when selecting a CMP:

• Broad connectivity — The platform should connect to public cloud providers (AWS, Azure, GCP), private infrastructure (VMware, on-premises bare metal), and container orchestrators such as Kubernetes from a single interface.
• Unified inventory and provisioning — Administrators should be able to discover existing resources and provision new ones across all connected environments without switching tools.
• Self-service catalog — Enabling developers and end users to request pre-approved resources on demand reduces IT queue depth and accelerates delivery.
• Single pane of glass visibility — A consolidated view of resource utilization, health, and cost across all environments is essential for proactive governance and spend optimization.
• Legacy and modern technology support — Enterprises rarely operate in a greenfield environment. The CMP must bridge existing on-premises systems with modern cloud-native services without requiring a full migration first.

The goal is to abstract complexity away from the people who consume IT resources—developers, data engineers, business analysts—while giving the IT and platform teams the visibility and control they need to manage it responsibly. Complexity does not disappear; it gets managed in the right place, by the right people, using the right tooling.

Putting It Together

A multi-cloud strategy that succeeds in the long run treats culture, skills, and tooling as mutually reinforcing investments rather than independent check-boxes. Culture change enables the collaboration that makes cross-cloud operations possible. Skills investment ensures the organization can actually exploit the capabilities each platform offers. And the right management platform ensures that the operational complexity of running multiple clouds is contained and controlled, rather than distributed across the organization as a source of daily friction.

Enterprises that approach multi-cloud with this three-part discipline are far better positioned to deliver on the original promise—agility, performance, and cost efficiency—without inadvertently creating more problems than they solve.

The Macro Shift in Enterprise IT Spending

Enterprise IT budgets are under pressure from two converging forces: the accelerating migration from traditional, capital-intensive infrastructure to flexible hybrid multi-cloud architectures, and the deepening integration of artificial intelligence into core business systems. Together, these trends are forcing technology product managers and CIOs to fundamentally rethink how and where they allocate technology investment.

According to Gartner’s 2019 global IT spending forecast, worldwide IT expenditure was projected to reach $3.79 trillion for the year—a modest increase of just 1.1 percent over 2018. Currency volatility driven by a strengthening US dollar, trade tensions, and uncertain macroeconomic conditions contributed to a downward revision of that forecast from earlier in the year.

“Currency headwinds fuelled by the strengthening US dollar have caused us to revise our 2019 IT spending forecast down from the previous quarter. Through the remainder of 2019, the US dollar is expected to trend stronger, while enduring tremendous volatility due to uncertain economic and political environments and trade wars.”

John-David Lovelock, Vice President, Gartner

IT Infrastructure Market Development

Not all segments of IT spending are moving in the same direction. The data centre systems segment was expected to experience the sharpest decline in 2019—a drop of approximately 2.8 percent—driven primarily by falling average selling prices (ASPs) in the server market. Component cost adjustments and improved hardware efficiency were major contributors to that compression.

In contrast, the enterprise software market was forecast to grow to $427 billion in 2019, up roughly 7.1 percent from $399 billion in 2018. The primary driver of this growth is the ongoing migration of enterprise workloads from traditional, on-premises software to cloud-based alternatives. Application software has seen the most significant cloud shift to date.

Looking beyond application software, Gartner anticipated increased near-term growth in the infrastructure software segment, particularly in:

• Integration Platform as a Service (iPaaS): Middleware and integration tooling delivered as cloud services, enabling organizations to connect disparate on-premises and cloud applications without managing underlying infrastructure.
• Application Platform as a Service (aPaaS): Cloud-hosted environments for developing, running, and managing applications, reducing the operational overhead traditionally associated with platform management.

For technology product managers, this environment requires a more deliberate portfolio strategy: balancing investments in high-growth cloud and software categories against the natural decline in hardware-centric markets. According to Gartner’s assessment, product managers who take a long-term view of portfolio decisions made in 2019 will be better positioned for success through 2020 and beyond.

Outlook for AI Applications and Spending Growth

Artificial intelligence is increasingly cited as a disruptive force reshaping IT investment priorities—but Gartner’s analysis makes an important distinction that is often overlooked in market commentary: AI is not a standalone product category. It is a set of techniques and a computer engineering discipline that is being embedded into existing products, services, and development pipelines across virtually every industry.

“The choices CIOs make about technology investments are essential to the success of a digital business. Disruptive emerging technologies, such as artificial intelligence, will reshape business models as well as the economics of public- and private-sector enterprises. AI is having a major effect on IT spending, although its role is often misunderstood.”

John-David Lovelock, Vice President, Gartner

This framing has practical consequences for how IT leaders should evaluate AI-related spending. Rather than tracking a discrete “AI budget line,” organizations should expect AI capabilities to appear as enhancements within their existing software, cloud platform, and infrastructure investments. Examples include:

• Cloud platform AI services: Major cloud providers embed machine learning APIs, natural language processing, and computer vision directly into their platform offerings, making AI accessible without specialized infrastructure.
• Enterprise software augmentation: CRM, ERP, and ITSM vendors are integrating AI-driven features—predictive analytics, anomaly detection, intelligent automation—into their core products.
• DevOps and operations tooling: AIOps platforms use machine learning to correlate events, predict incidents, and reduce alert noise, embedding AI into the operational workflow rather than treating it as a separate initiative.

Strategic Implications for CIOs and Technology Leaders

The combined effect of cloud migration and AI integration is pushing IT investment decisions in a consistent direction: away from owned, depreciating hardware assets and toward recurring service-based expenditure that can scale with business demand. For CIOs and IT strategy teams, several practical considerations follow from this:

• Rebalance CapEx vs. OpEx: Continued cloud adoption shifts capital expenditure to operational expenditure. Budget models, approval processes, and financial governance frameworks need to account for this structural change.
• Evaluate AI as a platform feature, not a project: Rather than funding standalone AI initiatives, assess how cloud vendors and software providers are embedding AI capabilities into platforms already in use. This often delivers value faster and with lower implementation risk.
• Prioritize integration investment: As multi-cloud and hybrid architectures mature, integration complexity grows. iPaaS and aPaaS investments that reduce integration friction can unlock value across the broader portfolio.
• Plan for currency and macroeconomic risk: Global IT procurement is exposed to foreign exchange volatility. Multi-year cloud agreements and vendor negotiations should factor in currency hedging considerations where applicable.
• Take a multi-year view of portfolio decisions: Near-term market softness in hardware segments does not eliminate the need for infrastructure investment. Strategic leaders plan for the 2-to-3-year horizon, not just the current fiscal year.

Summary

The convergence of cloud adoption and AI integration is not a temporary market fluctuation—it represents a structural shift in how IT value is created and delivered. Organizations that recognize AI as a cross-cutting discipline embedded in cloud platforms and enterprise software, rather than an isolated product category, will make more coherent investment decisions. Meanwhile, the continued decline of traditional data centre hardware spending and the growth of enterprise software and cloud services reflect a market that has already begun to price in this new reality. For DevOps teams, platform engineers, and technology strategists, aligning investment priorities with these structural trends is increasingly a competitive necessity.

Why Cloud Computing Market Dynamics Matter to Engineers

Technical decisions rarely happen in a vacuum. Procurement choices, architectural patterns, and vendor lock-in concerns are all influenced by market competition, pricing pressure, and the strategic direction of major cloud providers. Keeping a finger on the pulse of the broader cloud market helps engineers anticipate platform changes, negotiate better contracts, and design more resilient multi-cloud strategies.

Major Cloud Computing Providers

The cloud computing market is dominated by a small group of hyperscalers alongside a broader ecosystem of specialist and regional providers. The most widely recognised players include:

• Amazon Web Services (AWS) – the longest-established hyperscaler, with the broadest service catalogue.
• Microsoft Azure – strong enterprise integration, particularly with Microsoft 365 and Active Directory ecosystems.
• Google Cloud Platform (GCP) – known for data analytics, Kubernetes (which Google originated), and machine learning tooling.
• IBM Cloud – focused on hybrid cloud and regulated industries, bolstered by the Red Hat acquisition.
• Alibaba Cloud (Aliyun) – the dominant provider in China and a significant force across Asia-Pacific.
• Salesforce – specialises in SaaS-based CRM and the broader customer experience platform market.
• Rackspace – managed cloud services across multiple providers.
• SAP – enterprise application software delivered increasingly as cloud services.
• Oracle Cloud – strong in database and enterprise application workloads.
• VMware (now part of Broadcom) – virtualisation and hybrid cloud infrastructure.
• Dell Technologies / EMC – on-premises and hybrid infrastructure that feeds into cloud strategies.

Competition among these vendors continues to drive down compute and storage pricing while simultaneously raising the bar on managed services, security tooling, and developer experience.

Cloud Service Delivery Models

The cloud computing market is typically segmented by service delivery model. Each model places responsibility for different infrastructure layers with either the provider or the customer.

Infrastructure as a Service (IaaS)

IaaS providers supply virtualised compute, storage, and networking resources on demand. The customer manages the operating system, middleware, and application stack. Examples include AWS EC2, Azure Virtual Machines, and Google Compute Engine. IaaS suits teams that need maximum control over their environment or are lifting-and-shifting existing workloads.

Platform as a Service (PaaS)

PaaS abstracts away the underlying infrastructure, providing a managed runtime, database, and middleware layer. Developers deploy code and configuration; the platform handles patching, scaling, and availability. Examples include Google App Engine, Azure App Service, and AWS Elastic Beanstalk. PaaS accelerates development cycles by reducing operational overhead.

Software as a Service (SaaS)

SaaS delivers fully managed applications over the internet. The provider is responsible for the entire stack — infrastructure, platform, and application. End users interact with the software through a browser or API. Familiar examples include Salesforce CRM, GitHub, Datadog, and Google Workspace. From a DevOps perspective, SaaS tools are often the fastest path to capability but introduce third-party dependency risks.

Economic and Competitive Forces Shaping the Market

Several macro-level factors influence how the cloud computing market evolves and how providers compete:

• Pricing competition: Hyperscalers regularly reduce list prices for commodity services such as object storage and egress, forcing smaller providers to specialise or compete on service quality.
• Regulatory and data sovereignty requirements: Governments in the EU, India, China, and elsewhere are introducing data localisation laws that affect architecture decisions and provider selection.
• Hybrid and multi-cloud adoption: Many enterprises distribute workloads across on-premises infrastructure and multiple public clouds to avoid lock-in and meet compliance requirements.
• Mergers and acquisitions: Consolidation — such as Broadcom’s acquisition of VMware and IBM’s acquisition of Red Hat — reshapes vendor roadmaps and support commitments that teams depend on.
• Sustainability pressure: Large cloud consumers are scrutinising provider carbon commitments, driving competition on renewable energy usage and efficiency metrics.

Regional Market Considerations

Cloud adoption rates and dominant providers vary significantly by geography:

• North America – the largest market by revenue, led by AWS, Azure, and GCP.
• Europe – strong growth, heavily influenced by GDPR compliance requirements and interest in European-sovereign cloud alternatives.
• Asia-Pacific – rapid expansion, with Alibaba Cloud dominant in China and AWS, Azure, and GCP competing strongly in markets such as Japan, Australia, Singapore, and India.
• Latin America, Middle East, and Africa – growing markets where hyperscalers are investing in new regional infrastructure to reduce latency and meet data residency requirements.

SWOT Considerations for Cloud Vendor Evaluation

When evaluating cloud providers for a workload or platform decision, a structured SWOT analysis is a useful starting point:

• Strengths: Breadth of services, global infrastructure footprint, ecosystem integrations, managed security controls.
• Weaknesses: Pricing complexity, support quality at lower tiers, potential lock-in through proprietary services.
• Opportunities: AI/ML managed services, serverless and edge computing, industry-specific cloud offerings.
• Threats: Regulatory changes, outage risk concentration, vendor pricing changes, and long-term contractual commitments.

Practical Takeaways for DevOps Teams

Understanding the broader cloud market landscape has direct practical value for engineering teams:

• Monitor provider roadmaps and acquisition activity — service deprecations and pricing changes can have significant operational impact.
• Evaluate total cost of ownership (TCO) across IaaS, PaaS, and SaaS options; managed services often reduce operational burden enough to justify a higher unit cost.
• Design for portability where it matters — use open standards such as Kubernetes, Terraform, and OpenTelemetry to reduce hard lock-in on proprietary APIs.
• Factor in regional availability when designing for disaster recovery and compliance.
• Revisit vendor commitments periodically; the competitive landscape shifts quickly enough that a decision made two years ago may no longer reflect the best available option.

The cloud computing market continues to evolve rapidly. Staying informed about provider strategies, service model trade-offs, and regional dynamics is as much an engineering discipline as it is a business one.

Digitization offers IT teams unprecedented opportunities to create value by becoming digital change agents for the enterprise. But the way most IT departments currently operate cannot support that ambition. As technology moves to the center of company strategy and growth, IT teams face faster business change, rising volatility in demand, and increasing pressure to respond to technology spending that originates outside of IT.

In this environment, traditional IT operating frameworks — such as the sequential plan/build/run model — are falling short. CIOs need a fast, flexible operating model that can adapt to the blurring boundaries between IT and the rest of the business. Nine operating model changes have been identified that will position IT teams for digital success.

The first change underpins the entire new model. The remaining eight are independently valuable and are not listed in strict priority order — their relative importance depends on each organization’s context and digital ambitions.

1. Products Over Projects

The shift from projects to product lines lies at the heart of the new IT operating model. To enable fast, business-aligned decision making, CIOs are replacing portfolios of discrete capital projects with enduring product lines — sometimes called end-to-end services or value streams. Each product line enables a specific business capability and is managed by a dedicated product line or service manager who works with business stakeholders to build a product strategy and roadmap, overseeing the full lifecycle from launch through enhancement, maintenance, and eventual retirement.

This shift means IT investment decisions are made continuously against a living roadmap rather than through periodic, project-by-project funding cycles — a significant cultural and structural change for most IT organizations.

2. Adaptive Business Engagement

The technology needs of business partners have grown too broad and varied to be served adequately through traditional business relationship manager roles. A more effective approach is to flex IT engagement based on business context and need. Rather than routing all interaction through a fixed intermediary, IT staff shift fluidly between roles — evangelizing, consulting, brokering, coaching, and delivering — depending on business partners’ digital ambition and capability.

This adaptive engagement model requires IT staff to be commercially aware, consultative, and comfortable operating across organizational boundaries.

3. Agile, DevOps, and Continuous Delivery

To meet business expectations for responsiveness, output quality, and always-on products, IT teams are integrating delivery, engineering, and support functions so that software releases happen as soon as new functionality is ready. This is achieved by combining iterative software development methods with DevOps practices and aligning the resulting cross-functional teams to product lines. Each product line can then deliver functionality at its own cadence, independently of other teams.

Continuous delivery pipelines, automated testing, and infrastructure automation are key enablers of this shift, reducing the time between a business need being identified and working software reaching users.

4. Customer-Centric Design

Consumer technology from companies like Apple and Amazon has permanently raised user experience expectations — for both customers and employees. Corporate IT teams cannot afford to fall significantly behind those benchmarks. In response, leading IT organizations are embedding customer-centric design techniques — such as user research, journey mapping, and usability testing — directly into their operating practices. This allows IT to understand actual customer experiences, identify the root causes of suboptimal interactions, and design simpler, more effective solutions.

5. Application Building Blocks

Speed and flexibility in application delivery depend on how well IT teams exploit modern architectural patterns. APIs, microservices, and containers allow development teams to compose applications from reusable, independently deployable components rather than building monolithic systems from scratch. IT organizations are operationalizing this by providing application development teams with shared tooling, reuse libraries, and integration platforms that accelerate delivery and reduce duplication of effort.

6. Cloud-Based Scalable Infrastructure

Fixed-cost, capital-intensive on-premises infrastructure prevents IT teams from scaling rapidly in response to digital demand. Leading IT organizations are moving beyond experimenting with cloud, automation, and infrastructure-as-code to making these approaches foundational to how they operate. This shift enables elastic capacity, faster provisioning, and lower unit costs — all critical in a digital business environment where demand is unpredictable and speed to market matters.

7. Strategy Over Governance; Management Over Operations

Governance functions such as Information Security and Enterprise Architecture are increasingly expected to help shape business strategy, not just IT policy. To make this shift, governance and architecture teams are delegating and automating many day-to-day operational and compliance tasks while retaining responsibility for oversight, coaching, and auditing. This frees senior IT staff to contribute to strategic conversations at the enterprise level rather than being consumed by operational detail.

8. Data Strategy Over Data Ownership

Virtually every digitization strategy involves big data, advanced analytics, or data-driven products and services. Yet many organizations still lack an enterprise-wide data strategy and are hampered by fragmented, ownership-centric approaches to data governance. A more effective model takes a business-centric approach: identifying specific business opportunities where data and analytics can create value, then aligning the people, platforms, and processes needed to exploit those opportunities — rather than getting stuck in debates about who owns which dataset.

9. Adaptive Skills and Mind-Sets

No operating model change succeeds without the right talent to support it. To operate effectively in a fast-moving and volatile digital environment, IT employees need strong competencies in areas such as influencing without authority, cross-functional teamwork, communication, and learning agility. They must be tolerant of ambiguity and risk, comfortable moving rapidly between priorities, and willing to work closely alongside business partners. Technical specialists also need the versatility to work across multiple technologies rather than focusing exclusively on a single domain.

Evolving the Model Incrementally

While this list of changes may appear daunting, each element has standalone value and can be pursued independently. Attempting to overhaul every aspect of the IT operating model simultaneously is rarely practical or advisable. The most effective CIOs set clear priorities based on their organization’s most pressing digital challenges and evolve their operating model incrementally, in step with the company’s broader digital ambitions.

The underlying principle is straightforward: digital transformation demands that IT stop operating as an internal service bureau and start operating as a strategic capability — one that is fast, adaptive, and deeply aligned with the business it serves.

What DevOps Actually Means

If you are still uncertain about what DevOps means in practice, The DevOps Handbook by Gene Kim, Jez Humble, Patrick Debois, and John Willis is one of the most thorough resources available. It is a practical, case-study-driven book aimed at helping engineering organizations dramatically improve their delivery throughput, reliability, and team culture.

Notably, the book is not structured around continuous delivery alone. Only one section covers what the authors call “the technical practices of flow” — the pipeline from development to operations. The remaining sections address feedback loops from application monitoring, building a culture of continual learning and experimentation, and integrating security and compliance into the delivery process from the start.

This scope is intentional and revealing. As the authors argue, DevOps is transformational to technology work in the same way that Lean manufacturing transformed factory floors in the 1980s. It is not purely a technology initiative — it is an organizational one. In this framing, DevOps becomes the operating model that underpins broader digital transformation efforts.

DevOps in Practice: The Seven Essential Elements

Most engineers want concrete details, not philosophy. Armon Dadgar, co-founder of HashiCorp, breaks DevOps down into seven core elements that must be addressed in any mature delivery workflow:

1. Build — Compile and assemble application artifacts from source code.
2. Test — Validate correctness, performance, and security through automated test suites.
3. Package — Bundle artifacts into deployable units such as container images or binaries.
4. Provision — Create and configure the infrastructure and environments where software will run.
5. Secure — Harden environments, manage secrets, and enforce access controls.
6. Deploy — Release packaged software to target environments in a controlled manner.
7. Monitor — Observe running systems to detect issues and gather feedback for future iterations.

You might notice these same steps exist in a traditional waterfall process. The difference, according to Dadgar, is in execution: “The goal of DevOps is to parallelize as much of this as possible. These seven steps are necessary and sufficient, but they don’t have to be done sequentially.”

In a well-functioning DevOps organization, responsibilities are decoupled rather than handed off sequentially. Operations teams handle provisioning and deployment. Security engineers lock down runtime environments. Developers build, test, and package applications — and critically, they remain responsible for those applications in production. This last point is a key DevOps principle: developers should not simply throw code over the wall for operations to manage.

Why Infrastructure Provisioning Has Become the Hard Problem

Dadgar identifies provisioning as one of the most significant pain points driving DevOps adoption today. In earlier, simpler infrastructure landscapes — where everything ran on bare metal or a single vSphere cluster — provisioning was relatively straightforward: open a UI, click through a wizard, done.

Modern infrastructure is fundamentally different. A typical production environment might span multiple cloud providers, SaaS platforms, PaaS services, and on-premises hardware simultaneously. Dadgar describes the challenge this way:

How do you provision and manage that complexity, especially as these things interact with each other? It’s not that my web server is totally divorced from my cache and my database and my frontend load balancer. They’re all tightly related in a complex way. As you get more and more outsourced, it’s like, great, I’m going to run my web server and I’m going to use Amazon’s database and I’m going to use DynDNS and CloudFlare in front of that. Now I’m managing lifecycle across resources of totally different vendors.

The answer to this complexity is not more Jira tickets — it is code. Dadgar’s principle is to “disintermediate all of our work with software.” Tools like HashiCorp’s Terraform express infrastructure as declarative configuration that can be versioned, reviewed, and applied automatically, regardless of which cloud or vendor is involved. Critically, such tools are designed to integrate with existing toolchains rather than replace them wholesale.

DevOps Is More Process Than Tools

Despite co-founding a company that sells DevOps tooling, Dadgar is clear-eyed about where the real challenge lies: “DevOps is more process than it is tools. I think that’s what gets missed in the way it’s represented. There’s a fixation on tools because tools are easy. It’s hard to change organizational process.”

This observation aligns directly with The DevOps Handbook‘s emphasis on culture and learning. Tools can automate a deployment pipeline in weeks. Changing the way teams communicate, share responsibility, and respond to failure takes far longer and requires sustained leadership commitment.

A Realistic View: What DevOps Can and Cannot Guarantee

Any sufficiently popular IT trend eventually attracts criticism, and DevOps is no exception. Critics have argued that it places an unrealistic burden on developers, raises naive expectations about developers and operations teams suddenly collaborating harmoniously, and glosses over real organizational constraints.

There is truth in some of those critiques. DevOps is ultimately more philosophy than prescriptive methodology. Its success depends on organizational culture and the specific people involved at least as much as it depends on tooling or documented processes. The DevOps Handbook is candid about this reality:

We have a dirty secret to reveal. In many of our case studies, following the achievement of the breakthrough results presented, many of the change agents were promoted — but, in some cases, there was a later change in leadership which resulted in many of the people involved leaving, accompanied by a rollback of the organizational changes they had created.

This is the fundamental fragility of culture-dependent change. DevOps transformations that are tied to individual champions rather than embedded in organizational systems can — and do — reverse when those champions move on. Lasting change requires leadership that reinforces DevOps principles continuously, not just during an initial rollout.

The Scale of the Opportunity

Gene Kim, one of the authors of The DevOps Handbook, has observed that even with significant industry interest, the proportion of software engineers and operations professionals actively applying DevOps principles remains small. The implication is that the majority of organizations are still leaving substantial productivity gains, reliability improvements, and competitive advantage on the table.

Whether framed in terms of dollars, developer hours, or system reliability, the gap between current practice and the potential of well-implemented DevOps is large. The barrier is rarely technical — it is organizational will, sustained leadership, and a genuine tolerance for the disruption that meaningful process change requires.

Key Takeaways

• DevOps is not just CI/CD. Continuous delivery is one component. Monitoring, feedback loops, security integration, and cultural practices are equally important.
• Parallelism, not sequence. The seven core DevOps elements — build, test, package, provision, secure, deploy, monitor — gain their power when decoupled and parallelized, not run as a linear waterfall.
• Provisioning complexity is a real driver. The explosion of hybrid and multi-cloud infrastructure has made automated, code-driven provisioning a practical necessity, not a luxury.
• Tools are the easy part. Organizational culture, shared responsibility, and sustained leadership commitment are what determine whether a DevOps initiative succeeds long-term.
• Gains can be reversed. Without embedding DevOps principles into organizational DNA, improvements tied to individual change agents are vulnerable to regression when leadership changes.

Further reading: The DevOps Handbook by Gene Kim, Jez Humble, Patrick Debois, and John Willis is the primary source referenced throughout this article.