Moving workloads off the public cloud can offer greater control over costs and data, but it also brings new security responsibilities and operational demands.
After a decade of cloud-first strategies, a growing number of organizations are bringing some workloads back on-premises or shifting them to private infrastructure. Many factors are driving this repatriation trend, including concerns over cost, performance, data sovereignty, security and, increasingly, the demands of AI.
This is not a mass exodus from the cloud, but rather a more deliberate reassessment of where it makes most sense to run individual workloads. In fact, many organizations that are repatriating workloads from the cloud are also actively expanding their cloud footprint.
A deliberate approach to workload placement
Three-quarters of organizations have moved some workloads back from the public cloud over the last 24 months, according to a survey of 212 senior IT decision-makers by object storage platform Cloudian and research firm Centiment. Data sovereignty was the primary driver, with 81.7% of respondents calling it a primary or significant factor in infrastructure decisions. About 59% of survey respondents said they have considerable concern over cloud providers accessing data for analytics or model training.
Cost pressure was another major factor, as 84% of respondents reported exceeding their public cloud budgets due to egress fees, data volume costs and premium pricing for residency-compliant regions.
AI is also accelerating cloud repatriation timelines, with 85.1% of respondents citing latency needs that cloud providers can't consistently meet and a desire to keep training data in-house for security reasons.
At the same time, nearly 30% of the organizations moving workloads back on-premises also expanded their cloud footprint, suggesting that enterprises are becoming more deliberate about which workloads they offload to cloud services.
"Cloud repatriation is less about a mass exodus from the cloud and more about organizations making targeted adjustments to align technology investments with business priorities," said Mark Odom, senior solutions engineer at cybersecurity vendor Black Duck. "For many, the primary driver is cost predictability."
Expenses related to licensing, storage, compute and other cloud services can add up quickly, making private infrastructure an attractive option for organizations seeking greater control over budgeting and resource allocation.
Security is another factor. Roughly half of organizations are either considering or actively repatriating some of their cloud workloads due to high security and compliance requirements, according to a VMware global survey of more than 1,800 IT decision-makers.
The types of workloads IT decision-makers reported moving to private cloud and on-premises infrastructure include data-intensive workloads, business-critical apps, AI apps, productivity apps and latency-sensitive apps.
The security tradeoffs of cloud repatriation
This nuanced approach to workload placement has its tradeoffs. Bringing workloads back in-house gives organizations greater control over costs, data and infrastructure, but they must also consider whether they have the skills and resources to operate at scale and maintain the security, flexibility and redundancy associated with the cloud.
Cloud service providers invest considerable budget in security, resilience and automation that organizations must match on their own when they move workloads back in-house, said Crystal Morin, senior cybersecurity strategist at cloud security vendor Sysdig.
"Repatriation trades elasticity and the shared-responsibility safety net for capital costs, physical security and full-time security operations," Morin said. "None of that makes one form of private cloud, on-prem or public cloud better or easier than the other. But they are certainly compute costs to consider."
Bringing workloads back on-premises does not inherently reduce cyber-risk, either, said Ensar Seker, CISO at threat intelligence vendor SOCRadar. Rather, it shifts more responsibility onto the organization to secure the underlying infrastructure, including patching, hardening, monitoring, redundancy and recovery.
Rather than asking whether cloud or on-premises infrastructure is inherently more secure, organizations should consider in which environment a workload can operate more securely, Seker said.
Understand the security debt risk
Cloud repatriation can create security debt if organizations underestimate the operational burden of running infrastructure themselves, Seker cautioned. That can happen when decision-makers compare visible cloud risks with an idealized view of their own infrastructure.
There's also a risk that workloads currently running in modern cloud environments could end up on older, less secure hypervisors, OSes, storage platforms or network infrastructure.
"When organizations repatriate, they need to determine whether they can reproduce the security capabilities they were previously consuming as a service," Seker added.
Another often-overlooked challenge when repatriating is having the right expertise to operate infrastructure in the long term. Recreating the capabilities of a hyperscale provider requires specialized skills in areas such as network architecture, DDoS protection and security operations, said Randolph Barr, CISO at cybersecurity vendor Cequence Security.
When organizations repatriate, they need to determine whether they can reproduce the security capabilities they were previously consuming as a service.
Ensar SekerCISO, SOCRadar
This talent can be difficult to find as more expertise has, ironically, concentrated within major cloud providers. The challenge might not become apparent until well after the migration, when staffing and operational demands begin to mount, he said.
Organizations must also account for the security gaps that can emerge in hybrid environments, Barr added. Cloud repatriation is rarely an all-or-nothing move, and organizations could leave some application components in the cloud while moving others on-premises.
"A login portal or API front end might stay in the cloud while the core service moves on-prem," Barr said. "If security enforcement isn't consistent across that boundary, you've created exactly the kind of inconsistency attackers look for, probing whichever side has the weaker controls."
More than just an architecture decision
When evaluating cloud workload repatriation, CISOs should approach the topic as a security architecture decision rather than simply an architecture or cost decision. That means comparing the two environments control by control, including identity and privileged access, vulnerability management, monitoring, network segmentation, backup protection and disaster recovery. CISOs then need to determine who will be responsible for each capability post-migration.
The key question is whether organizations can replicate the security capabilities they are getting from their cloud provider.
"Can your on-prem security actually match what the provider was giving you where it concerns patching, identity management, monitoring and resilience?" Morin asked. If not, organizations are increasing risks regardless of what the cost model says.
The migration itself warrants scrutiny because it is often the most exposed phase of the whole project, Morin added.
"Above all, insist on the same breadth of visibility and 'assume breach' posture you'd want in the public cloud, because although the environment changes, the adversary doesn't," she said.
CISOs should also ensure that security policies and visibility remain consistent across workloads that remain in the cloud and those that move on-premises, while accounting for the operational risks of owning and scaling physical infrastructure, Barr said.
Security leaders should ultimately make the decision based on whether their organizations' security capabilities travel with the workload, not just on where the workload physically sits, he said. Greater control over infrastructure does not automatically translate into greater security.
Jaikumar Vijayan is a freelance technology journalist with more than 20 years of award-winning experience in IT trade journalism, specializing in information security, data privacy and cybersecurity topics.