https://www.techtarget.com/searchcio/feature/The-multi-cloud-reckoning-Simplify-for-cost-security-and-sanity
Multi-cloud sprawl has reached a breaking point, resulting in disproportionate security exposure, governance complexity and operational fatigue. Originally used to help save money and create vendor lock-in, CIOs are facing unintended consequences, such as high-profile breaches and tool sprawl with inconsistent logging and monitoring.
I recently started watching an AMC series called Halt and Catch Fire. While there are technical inaccuracies, the plot has this IT and cybersecurity professional hooked. Set in the 1980s, the main character, Joe MacMillan, is a serial innovator who drives his team of computer engineers to create the world's first truly portable, aka laptop, IBM-compatible computer. In Season Two, Joe has moved on from his team of hardware and software engineers and lands a job at his future father-in-law's energy company, doing data entry. He soon learns that the company has made a significant investment in an IBM mainframe, but it uses the computing power only during business hours, Monday through Friday. Joe comes up with an idea that allows companies to "rent" the unused portion of their IBM mainframe, creating an unrealized revenue stream.
While a term wouldn't be coined for at least another decade, Joe MacMillan did indeed lay the foundation for what is now known as "cloud computing." Using someone else's computers, networking and data center to process, transmit and store a corporation's data.
This article will explore risks and potential mitigations for the CIO's cloud and multi-cloud strategy.
Having worked exclusively as a cybersecurity professional for over twenty years, I may be biased. However, it's clear that cybersecurity is a top concern for corporate executives.
With the race to develop and innovate using AI, corporations are being pressured to explore all cloud AI offerings, leading to multi-cloud complexity. The lack of mature IT and cybersecurity processes will be exacerbated as organizations transition from on-premises to cloud-based programs. Without a cloud strategy, CIOs may find themselves in a challenging situation as they try to mitigate risks with AI and cloud.
Here are areas to address as part of an overarching cloud governance and risk management practice.
In the past, a multi-cloud strategy helped protect against vendor lock-in and aided cost negotiations. This worked well when using cloud compute or storage. AI is transforming public clouds into highly specialized AI models and agents, using non-standardized AI tools such as the Model Context Protocol. This puts strain on your existing IT and cybersecurity teams as they seek to balance day-to-day operations with upskilling for every new cloud environment.
Each platform has specific skills required, creating skills gaps as the myriad of cloud platform tools continues to expand. Security and cloud engineers cannot maintain deep expertise across three or more platforms. Yet, organizations continue to spread expertise too thin to be effective. Even when trying to be effective, organizations often do the opposite – causing operational inefficiency. The mean-time-to-detect and the mean-time-to-respond both increase as the number of monitored outlets increases. As one issue is addressed, other problems can cascade as time is spent troubleshooting them one by one.
Existing tools do not provide support or feature parity across all cloud platforms, resulting in the need to manage multiple SIEMs, endpoints, data platforms and DevOps pipelines. Tool duplication can lead to high overhead and inconsistent efficacy.
Because cloud teams are constantly monitoring multiple platforms and addressing issues, burnout and turnover may rise due to a lack of work-life balance. Maintaining standards across different environments can be challenging. Cloud engineers are in high demand, with the U.S. Bureau of Labor Statistics reporting a 15% career growth rate through 2034, which is higher than the average. This creates the opportunity for burned-out employees to leave their organizations more easily.
Simplifying does not necessarily mean moving to a single cloud. It's vital to define acceptable use within cloud providers. Your organization's goal should be "fewer patterns, not necessarily fewer clouds." You need to rationalize the architecture without eliminating choice.
Establish use-case patterns rather than simply choosing a cloud provider. For example, medical use cases can be deployed on cloud provider A because its security controls support HIPAA regulations. In contrast, operational efficiency use cases are set up in provider B because no personally identifiable information, payments or protected health information (PHI) are required. Defining these use cases will also simplify monitoring for misuse if PHI is detected in provider B.
Consolidate around your core platforms. For example, for commodity workloads such as storage, compute and VMs, look for fewer providers. Then choose specialized clouds if they deliver material differentiation similar to the example above.
When considering cybersecurity, centralize your IAM, which is vital. Move to a unified enterprise identity strategy to use single sign-on (SSO) and enforce other security measures such as multifactor authentication (MFA), zero trust, standardized encryption requirements and logging configurations.
When determining how to manage all clouds, create a "cloud control plane" and apply it to all existing platforms. This reduces the reliance on per-cloud consoles and custom integrations. This will help establish an integration layer for governance, observability and policy enforcement.
The cost of securing and operating multiple cloud platforms is often overlooked because it spans multiple organizational cost centers. As mentioned earlier, not all tools are compatible across cloud platforms, so it is necessary to purchase multiple products that provide similar functionality. Minimizing controls based on platform use-cases has the following cost benefits:
CIOs and CISOs must partner to build a cloud and AI simplification strategy for their organizations. Guardrails must be established based on business use cases rather than the 'anything goes' approach. Conversely, a defined strategy should enable organizations that have avoided using AI and instead take the "block it all" approach.
John Doan is the senior director of cybersecurity advisory and cybersecurity domain architect for a world-renowned healthcare organization.
15 Jan 2026