With AI tools rapidly emerging from major cloud vendors, a new opportunity cost for CIOs’ cloud strategies is arising to bring new twists on old questions about the risks of cloud concentration. Credit: Gorodenkoff / Shutterstock As CIOs seek to achieve economies of scale in the cloud, a risk inherent in many of their strategies is taking on greater importance of late: consolidating on too few if not just a single major cloud vendor. And while vendor lock-in has long been a key issue in the cloud, especially for organizations that have not established a credible threat of defection, the emerging AI tools market — and its accompanying arms race among the major cloud vendors — could leave CIOs at risk of the opportunity costs of AI lock-in as well. The concentration of a handful of cloud vendors supporting enterprise infrastructure “is a significant emerging risk,” according to Gartner’s last two quarterly risk reports, which surveyed roughly 300 C-suite executives who say they worry about three key issues when depending on a particular vendor for multiple aspects of the business: a “wide incident blast radius,” vendor lock-in, and possible regulatory compliance failures. The more applications and businesses that depend on a single cloud provider, the greater the potential for wide-scale impact of business continuity failures, Gartner’s surveys revealed. C-suite executives betting on a primary cloud provider are also worried about reducing their options in the long term. For example, what if Google’s Gemini AI technology proves to be significantly better than Azure’s OpenAI Service, but a CIO has gone all in on Microsoft’s cloud? This is the kind of risk that may increasingly keep CIOs up at night in the year ahead. Here is a look at how CIOs view the nature and nuances of cloud concentration risks — and what many are doing to mitigate them. Caveat emptor in the cloud Bob McGowan, CIO of Regeneron Pharmaceuticals, acknowledges the risk of cloud concentration is valid but he is more concerned about the readiness of SaaS partners. “If we have core business functions running in the cloud, how well are they prepared for a failure?” McGowan asks about SaaS partners such as Salesforce, Veeva, Box, and Oracle Cloud. “The focus on this is increasing and many of those providing cloud-based solutions as a service are coming under pressure to demonstrate how well they are managing our data and how well they are prepared for business continuity,” McGowan says. Ciena CIO Craig Williams sees the three primary cloud vendors’ control over the leading AI platforms as a significant issue IT leaders face today. “If you’re talking about pure AI tools and using LLMs, yes, it’s tough to avoid vendor lock-in, at least now, because this is such a nascent space,” Williams says. “CIOs should proceed with caution, especially now.” While McGowan and other CIOs emphasize that the risks of cloud concentration are not new, they acknowledge that IT leaders must have airtight strategies to avert fallout from a failure. “You have to look at it in the context of your business to select where it really matters and then frame out how to mitigate against potential risks,” McGowan says. John Marcante, US CIO in residence at Deloitte and former global CIO at Vanguard, stresses the importance of selecting an architecture that does not rely on vendors’ most proprietary services. “Many companies have multiple cloud providers and understand the nuances of developing in multiple cloud environments. This helps keep the providers competitive and helps enterprises understand what it will take to switch an application workload among cloud providers,” Marcante says. Still, at times, tailoring one’s strategy to fit a single provider has its benefits, he says. “Picking a cloud provider for a specific workload does make sense if we desire efficiency, speed, and simplicity, so the risk of concentration does exist and needs to be managed,” Marcante says. “Those benefits outweigh the complexity of trying to create an application that runs on multiple clouds versus a single cloud provider.” In its most recent report released this fall, Gartner ranked cloud concentration fourth among the top five risks identified by hundreds of C-suite executives. Third-party viability, evolving sociopolitical expectations, and mass generative AI availability are cited as the top three emerging risks in Gartner’s survey. Strategies for CIOs Dave McCarthy, a cloud analyst at IDC, sees industry consolidation on the major hyperscalers introducing risks but emphasizes a simultaneous rise in market choice. “It is true that hyperscale cloud providers have hit such a critical mass that they create their own gravitational pull,” he says. “Once you adopt their cloud platforms, it can be difficult and expensive to migrate out. [But] CIOs today have more choice in cloud providers than ever. It is no longer a decision between AWS and Azure. Google has been successfully executing a strategy to attract more enterprise customers. Even Oracle has made the transition from focusing on in-house technology to become a full-service cloud provider.” CIOs may consider other approaches, McCarthy adds, such as selecting a single-tenant cloud solution offered by HPE or Dell, which bundle hardware and software in an as-a-service business model that gives CIOs more cloud options. “Another alternative includes colocation companies like Equinix, which has been offering bare-metal IaaS for several years and has now created a partnership with VMware to extend those services higher up the stack,” he says, adding that CIOs should not view a cloud provider “as a location but rather as an operating model that can be deployed in service provider data centers, on-premise, or at the edge.” One top IT chief believes the risks are well-established and that CIOs should know how to counter with a variety of strategies to guard against failure. “Don’t companies have the same issue for data centers on-premise? Lock-in has always been there for a long time,” says Eric Norman, head of infrastructure architecture and innovation at IHG Hotels and Resorts, in Alpharetta, Ga. “Companies have a shared responsibility, and though the cloud/SaaS providers provide building blocks, companies must architect their solutions for high availability/business continuity in mind,” Norman says. “Having a hybrid strategy helps mitigate the risk to a company’s product portfolio.” Another CIO of a large enterprise, who declined to be named, says IT chiefs should “find the balance between cloud diversification and getting maximum discounts and rebates when it comes to concentrating your spend.” “Building or buying cloud-agnostic solutions is key,” this CIO says. As for the AI question, this CIO’s approach mirrors that of many CIOs today. “We are focusing first on leveraging AI and generative AI capabilities within existing SaaS tools and only then explore proprietary or open-source AI accelerators or models,” the CIO says. “We have found that who you do business with is largely use-case driven.” And for CIOs looking to align use cases with the best AI tool for the job, that may mean engineering greater flexibility in their cloud strategies to ensure they can capitalize on the optimal offering as it arrives. Related content brandpost Sponsored by VMware The Java migration imperative: Why your business should upgrade now To truly take advantage of modern Java, apps built for the ecosystem must be constantly maintained to maximize performance and minimize exposure to risks and security vulnerabilities. By Ryan Morgan, Senior Director, VMware Tanzu, Broadcom Apr 29, 2024 8 mins Cloud Computing news Get Ready for FutureIT Boston With This AI Infographic By Shane O'Neill Apr 29, 2024 1 min Events Artificial Intelligence IT Leadership news Atos may sell national security activities to French government The troubled IT service provider could net up to $1 billion from the sale, meeting most of its financing needs for the next year. By Peter Sayer Apr 29, 2024 4 mins Government IT Government Managed IT Services feature Top 10 barriers to strategic IT success Data challenges, tech debt, and talent shortages are among the issues that can derail your IT org’s work on high-value initiatives. Here’s how some CIOs are addressing them. By Mary Pratt Apr 29, 2024 12 mins Hiring IT Skills Business IT Alignment PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe