Ask most IT leaders where their critical data lives and you’ll get a confident answer. Ask them who ultimately controls access to it, and the conversation gets more complicated.
Cloud has delivered. Faster deployment, elastic infrastructure, reduced capital overhead – the case was strong and the results, for most organisations, justified the shift. But as cloud strategies have matured, a different question is emerging: not whether cloud was the right move, but whether organisations have quietly traded one set of risks for another.
Data has become a strategic asset – and a strategic vulnerability
Data now underpins almost everything – customer relationships, financial operations, AI initiatives, business intelligence. As organisations digitise further and automate more, its value keeps rising.
That makes the question of control more than a technical one. Where data resides, which jurisdictions govern access to it, and how quickly it can be recovered if circumstances change are now boardroom concerns. For many organisations, the discussion has quietly shifted from infrastructure costs to asset protection.
The context has changed
Most cloud strategies were built for a different moment – one focused on agility, scalability and cost. That context has shifted considerably.
Geopolitical tensions, tightening data protection regulation, increasingly sophisticated cyber threats, questions around AI governance and data ownership, and growing concentration risk across a small number of hyper-scale providers have all changed the calculation. None of these factors make cloud the wrong answer. Together, they make an unexamined cloud strategy a liability.
Cloud is no longer purely an IT conversation. It is a business continuity, governance and risk conversation.
Not everything belongs in the cloud
The shift isn’t towards abandoning cloud – it’s towards being more deliberate about it. Organisations are reassessing which workloads, applications and datasets genuinely belong there, and which carry risks that haven’t been fully accounted for.
The questions that rarely came up a decade ago are now the ones that matter most:
- Where is our critical data, and under which legal jurisdiction?
- How dependent are we on a single provider?
- Could critical workloads be recovered elsewhere if required?
- Does our AI strategy align with our data governance position?
If cloud is the backup plan, what’s the backup to the backup?
Most organisations have disaster recovery strategies. Many of those strategies rely on the same cloud providers that support day-to-day operations – which isn’t resilience, it’s a single point of failure with extra steps.
The principle of resilience is maintaining options. As more applications, data and services consolidate within the same cloud ecosystems, the ability to respond quickly to disruption, regulatory change or shifting business requirements can quietly erode.
Understanding whether workloads can be moved, how quickly data can be recovered, and what contingency exists if access to critical services is disrupted should be a standard part of any modern resilience strategy – not an edge case.
