Cloud migration is an operating model, not a change of address. Where the commercial return actually comes from, how costs drift, and how to choose a migration path per system.
Cloud migration is often presented as a change of location: the same systems, someone else's hardware. Organisations that treat it that way tend to end up with their old constraints and a larger bill. The growth comes from adopting the operating model, not the address.
On owned hardware, capacity is a forecast made months ahead and paid for whether or not it is used. That forecast shapes behaviour: teams avoid experiments because provisioning is slow, and they over-specify because being wrong is costly.
When capacity is available in minutes and released just as quickly, the calculation inverts. Seasonal peaks stop requiring year-round hardware. A new product can be launched to a small audience without a capital request. The value is not primarily the saving — it is the number of things the business can now try.
The clearest commercial benefit is the shortened distance between an idea and a working service. Environments that once took weeks to provision take minutes. Automated deployment pipelines turn releases from events into routine. Managed databases, queues and identity services remove work that was never a differentiator.
For a mid-sized organisation this often matters more than infrastructure cost. Reaching a customer two months earlier is worth considerably more than a modest reduction in hosting spend.
Cloud spending grows quietly. Resources provisioned for a test stay running. Storage tiers are never reviewed. Environments duplicated for a migration are never decommissioned. None of this is visible until the invoice arrives.
The organisations that keep costs under control treat them as an engineering concern: spending attributed to the team that creates it, budgets visible to the people making the decisions, and regular review of what is running and why. Done from the beginning this is straightforward. Introduced after two years of drift it is a project.
Major cloud providers operate infrastructure more securely than almost any individual organisation could. That is the part they are responsible for. The configuration on top — who can reach what, how data is encrypted, what is exposed publicly — remains yours, and it is where incidents actually occur.
For businesses operating in the EU, data residency and GDPR obligations are design inputs rather than afterthoughts. Choosing regions, understanding where backups land and knowing which sub-processors are involved belongs in the architecture discussion, not in a later compliance review.
Not every system deserves the same treatment. Moving an application unchanged is fast and low-risk, and appropriate for stable systems nobody intends to develop further. Re-platforming — swapping a self-managed database for a managed one, containerising a service — captures much of the operational benefit for moderate effort. Rebuilding is expensive and justified only where the application is central to the business and genuinely constrained by its current design.
Most estates need all three. The mistake is applying one strategy uniformly because it is easier to explain.
Cloud removes a set of constraints that used to limit how quickly an organisation could act. It does not supply the decision about what to do with that freedom. The businesses that grow are the ones that pair the migration with a genuine change in how they build and release — and that part cannot be bought from a provider.