In it’s third year, the Hashicorp State of the Cloud Survey is consistently well done and insightful. Despite a skew toward the Hashicorp user base, the study is a good portrayal of the state of large cloud users.
Skews toward the Hashicorp client base. “1,000 technology practitioners and decision makers in a variety of industries around the world, drawn from random samplings as well as the HashiCorp opt-in contact database.”
The Rightstack Research DB
The third annual HashiCorp State of Cloud Strategy Survey reveals the continued evolution of enterprise cloud strategy. The 2021 survey welcomed enterprises to the multi-cloud era, demonstrating the prevalence of a common multi-cloud operating model. The 2022 results reiterated those findings and underscored how a multi-cloud approach is delivering meaningful business value.
This year, the State of Cloud Strategy Survey focuses on operational cloud maturity — defined not by the amount of cloud usage, but by adoption of a combination of technology and organizational best practices at scale, covering infrastructure, security, networking, applications, and their use of platform teams. For 2023, we once again commissioned Forrester Consulting to perform the survey. In addition, we worked with Forrester to develop a cloud maturity model for describing where organizations are in their cloud adoption journey: low maturity, those experimenting with these practices; medium maturity, organizations standardizing their use of these practices; and high maturity, organizations that are scaling these practices broadly.
The results were clear: Organizations demonstrating the most maturity are also the ones unlocking the most value from their cloud efforts. Mature cloud practices were strongly correlated with positive business outcomes with respect to speed, risk, and efficiency.
Specifically, high-maturity companies were more likely to report that they were boosting their cloud spending and also that the cloud was saving them money. Not coincidentally, highly mature organizations were also less likely to waste money on avoidable cloud spending. Highly mature companies had an easier time dealing with cloud security issues and coping with the ongoing shortage of cloud skills. This process of maturing cloud practices is typically driven by cloud platform teams that centralize and standardize infrastructure and application services — including widespread automation, infrastructure as code, self-service infrastructure, CI/CD, site reliability engineering, observability, dynamic secrets management, and more — across the entire organization.
On the flip side, less-mature organizations struggled to implement their cloud operating model, scale their multi-cloud adoption, and achieve business success. (For more on the survey methodology and the cloud maturity model, see the Forrester study: Operational Maturity Optimizes Multicloud.)
7 Numbers to remember
56%
Boosted cloud spending in the last year, despite macroeconomic uncertainty
92%
Of high-cloud-maturity organizations say multi-cloud is working, or is expected to within a year
53%
Of high-maturity organizations are using multi-cloud to save money
#1
Rank of security as a multi-cloud success factor
#1
Rank of skills shortages as a multi-cloud barrier
74%
Of high-maturity companies say multi-cloud helps them attract, motivate, and retain talent
92%
Of organizations are adopting, standardizing, or scaling platform teams
Cloud spending is up, but cloud waste remains high
Despite worldwide macroeconomic uncertainty, more than half (56%) of survey respondents actually increased their cloud spending in the last 12 months. Only about 1 in 5 (22%) cut their spending. Some of that increase may be due to inflation, but even as companies work to improve governance, risk management, and compliance (GRC) to cut waste with individual cloud service providers, the secular trend is so powerful that their overall cloud investments continue to grow.
The distribution of the responses is even more telling. Almost two-thirds (62%) of respondents from high-maturity organizations boosted their spending, by an average of 16%. Even as high-maturity organizations doubled down on the cloud, however, many low-maturity organizations retreated or stood pat: Only 38% of low-maturity organizations increased their cloud spend, by an average of 11%, while 37% either kept spending flat or didn’t know how their spending had changed.
To what degree has the macroeconomic environment caused your organization to decrease or increase its level of cloud spending over the last 12 months?
94% are still wasting money in the cloud
Even as many companies boost their cloud investments and hope to save money with multi-cloud, almost all respondents (94%) report avoidable cloud spend for a variety of reasons. That number is virtually unchanged from the 2022 State of Cloud Strategy Survey results.
Low cloud-maturity firms, in particular, struggle with over-provisioning resources (53%) and idle or underused resources (55%) compared to 50% overall for those issues. The third most common factor, lack of needed skills, cited as a factor in cloud waste by 43% of respondents, was evenly distributed across all levels of maturity.
Which of the following factors contribute to avoidable cloud spend, also known as cloud waste, at your organization?
Overprovisioning resources
Idle or underused resources
Lack of needed skills
Lack of expiration date on temporary cloud resources
Cost premiums based on geographical region
We're still investing hugely in IT and modernization, and cloud solutions are a core part of that effort. — Director, Cloud Center of Excellence, at a North American retail organization
Multi-cloud delivers big results across the board
In the 2023 State of Cloud Strategy Survey, 76% of respondents were implementing, expanding, or planning a multi-cloud strategy — but the more telling result is that 86% of respondents from high-maturity companies said they were implementing, expanding, or planning multi-cloud, compared to just 54% of low-maturity organizations.
These differences are important because the overwhelming majority of multi-cloud users (92%) continue to believe the strategy is helping them reach their business goals (or they expect it to in the next year). That tops the already-robust 90% who said multi-cloud was paying off for them in their answers to a similar question in last year's survey.
Has your multi-cloud strategy advanced or achieved your company's business goals?
Significantly, high-maturity organizations were much more likely to report multi-cloud has or is about to help them achieve their business goals (94%) compared to low-maturity organizations (only 60% of which said they were already enjoying these benefits, while another 22% expect to do so in the next year).
Reliability, cost, and security & governance drive multi-cloud adoption
But what exactly are the problems that organizations are seeking to address with multi-cloud? The most commonly cited multi-cloud drivers are reliability (51%), cost reduction (48%), security and governance (45%), digital transformation (45%), and scalability (45%). Notably, in times of macroeconomic disruption, cost reduction charted much higher this year than last year. Only 10% had no choice but to go multi-cloud due to acquisitions or other issues, but that's still double last year's percentage.
What are the business and technology factors driving your multi-cloud adoption?
Reliability
Cost reduction
Security and governance
Digital transformation
Scalability
Diving more deeply, high-maturity organizations reported better results across many multi-cloud benefits, most notably cost savings. More than half (53%) of high-maturity respondents used multi-cloud to cut costs, compared to just 42% of low-maturity respondents. Similarly, reliability was named a multi-cloud driver by 59% of high-maturity companies vs. 49% of low-maturity companies. But the biggest difference between high and low maturity organizations was for portability of data and applications, which was a driver for almost half (49%) of high-maturity companies but less than a third (29%) of low-maturity firms.
Globally, the Asia-Pacific region (56%) found cost savings in multi-cloud even more compelling, while Europe-Middle East-Asia (42%) was less focused on this.
Multi-cloud success relies on security, availability, and scaling
Now that we know what’s driving multi-cloud adoption, what factors determine its success? Notably, all of the choices presented scored highly, being called important or very important by almost three-quarters of respondents.
Security (88%), availability (84%), and scalability (84%) were the most often named important/very important multi-cloud success factors, followed by regulatory/compliance requirements (82%), staffing and skill levels (82%), budget (80%), visibility into cloud infrastructure (78%), automated tooling (77%), and platform teams (75%).
How important are the following factors in determining the success of your organization's multi-cloud strategy?
Ability to deliver uptime and availability
48%
35%
84%
Infrastructure scaling
45%
39%
84%
Meeting regulatory/compliance requirements
46%
35%
82%
Staffing/skill level
38%
44%
82%
Very important
Important
Note: Total percentages may not equal separate values due to rounding.
Security (60%) and availability (48%) also top the list when looking only at what respondents considered very important, while regulatory/compliance requirements (46%) edge out infrastructure scaling (45%) and budget (45%) from that perspective.
Location also matters: Budget was a very important factor for 51% of Asia-Pacific respondents vs. just 41% for respondents in EMEA and North America (and 45% overall).
Multi-cloud benefits include security, visibility, tooling, and more
Put it all together, and a multi-cloud strategy delivers a wide variety of benefits, ranging from promoting a stronger security posture (74%) to helping attract, motivate, and retain skilled staffers (68%, and more on that later). Those two factors appear related: while multi-cloud clearly creates security challenges, working in multiple cloud environments can help organizations keep their security professionals engaged, and also be a forcing function toward more intentional oversight of their security operations. The big news, though, is that all 11 of the possible choices were selected by more than two-thirds of respondents, suggesting that multi-cloud benefits are broad, and broadly distributed.
To what extent has your organization gained the following benefits from its multi-cloud strategy?
Stronger security posture
42%
31%
74%
Better visibility into cloud infrastructure
43%
30%
73%
Increased/improved automated tooling
39%
32%
72%
Improved speed/pace of change in cloud service options
39%
32%
72%
Improved uptime and availability
40%
31%
71%
We are currently and have been benefitting from this for at least the last 12 months
We have only recently begun to gain this as a benefit
Note: Total percentages may not equal separate values due to rounding.
Mature organizations realize more multi-cloud benefits
Despite the clustering of the overall results, however, there were big differences between high- and low-maturity organizations. Large differences showed up in the areas of compliance and risk (80% to 56%), infrastructure visibility/insight (82% to 59%), and speed (76% to 59%). But the biggest difference between high- and low-maturity organizations surfaced in their ability to attract, motivate, and retain talent (74% to 48%, and again, more on that below).
Mature organizations handle staffing and skills issues better
The ongoing shortage of skilled cloud talent is a critical but complex issue for companies across the entire maturity spectrum. When asked what factors complicate their organizations' ability to operationalize multi-cloud, skills shortages (27%) was the most commonly selected response, followed by related issues such as siloed teams (26%) and lack of training (25%).
Which of the following factors complicate your organization's ability to operationalize multi-cloud?
Skill shortages
27%
Teams working in silos
26%
Lack of training
25%
Compliance and risk management
24%
Budget constraints that affect purchase of enterprise tools
23%
Continuing this thread, a lack of necessary staff/skills was the second-most commonly cited internal security threat, just behind data privacy protection. Notably, that's up from a fifth-place ranking in last year's survey. Similarly, organizations that don’t use platform teams — a key component of multi-cloud maturity — were even more likely to cite skills issues as an internal threat, 56% compared to 43% for organizations that do use platform teams. (More on these issues below.)
Highly mature organizations rank skills as a top driver of multi-cloud success
But that's not the only way to look at the issue. As shown in the previous section, staffing/skill level was an important/very important driver of multi-cloud success for 80% of respondents, with 38% rating it very important. And more than half (51%) of highly mature organizations rated staffing/skill level very important, compared to less than a third (31%) of low-maturity respondents.
And while largely focused on other benefits, 68% of multi-cloud users said their strategy helps them attract, motivate, and retain talent. Importantly, almost three-quarters (74%) of highly mature organizations gained staffing benefits from multi-cloud, compared to less than half (48%) of low-maturity organizations.
Given the prevalence of the issue, organizations are addressing skills shortages with multiple tactics, most often via a common operating model/shared automated workflows (58%), followed by reskilling/upskilling (56%). Working with partners was a plan for 43% of respondents, while only 36% planned to boost budgets — though it's not clear whether that's because they thought the tactic wouldn't work or it wasn't economically feasible.
How will your organization solve your top issues?
Standardize on a common operating model
58%
Reskill and/or upskill staff through certifications and education around our core initiatives
56%
Work more strategically/closely with your reseller/SI partners and consultants
43%
Increase budget to address headcount shortage
36%
Remove environmental or operational silos
34%
Ironically, while platform teams are often seen as a force multiplier that can help mitigate shortages of skilled technical talent, the biggest reason for organizations not to field platform teams is a lack of skilled staffers (more on that issue in the platform teams section below).
There are not enough platform specialists and there is not enough knowledge in the development teams, so the natural resolution is to have a small platform team that leads the way and supports developers in their efforts. — Network operations engineer at a European utility
Secrets management and access control becoming key security issues
Security has always been a key issue in the cloud, both as a goal and a barrier. In the 2022 State of Cloud Strategy Survey, 89% of respondents saw security as a key driver of cloud success, and in the 2021 survey, security was named the second most important cloud inhibitor, after cost concerns.
Those concerns are still with us, although the particulars continue to evolve. Multi-cloud success continues to be dependent on security and the tools that support it. For example, as noted above, security is once again the top factor in multi-cloud success and the most common benefit from a multi-cloud strategy. This year, however, data protection (77%) is joined by secrets management (75%) and access control (75%) in the top tools/initiatives seen as critical to the success of the organization’s cloud strategy.
How important are each of the following tools/initiatives to the success of your cloud strategy?
Data protection/encryption
49%
29%
77%
Secrets management
42%
33%
75%
Access control and session management
40%
35%
75%
Infrastructure as code
42%
31%
73%
CI/CD
41%
31%
73%
Very important
Important
Note: Total percentages may not equal separate values due to rounding.
Secrets leakage is now the most common security threat
At the same time, password/credentials/secrets leakage is now seen as the most common security threat (cited by 50% of respondents), topping highly publicized, long-standing concerns like data theft (49%), phishing (46%), and ransomware (42%).
What are the biggest threats that your organization faces when it comes to cloud security?
Password/credential/secrets leakage
50%
Data theft
49%
Phishing/social engineering attacks
46%
Ransomware
42%
Denial of service attacks
40%
But once again, there's a big difference in how high- and low-maturity organizations view the passwords/secrets issue. Only 47% of high maturity organizations listed credentials leakage as one of their biggest threats, compared to 61% of low-maturity organizations. Perhaps modern zero trust security practices employed in highly mature organizations help them feel more comfortable with their security posture, especially regarding secrets issues. Mature organizations also report more confidence when it comes to ransomware, with only 39% naming it as one of the biggest cloud security threats, compared to 47% of low-maturity organizations.
Internally, the most commonly cited security threats are data/privacy protection (45%) followed closely by lack of skills (44%) and threat detection and remediation (43%). And once again, low-maturity firms were more likely to cite skills issues as an internal security threat, 52% compared to 42% for high-maturity organizations. As noted above, organizations that don’t use platform teams were even more likely to cite skills issues as an internal threat, 56% compared to 43% for organizations that do use platform teams.
One of the benefits of having a platform team to manage our organization is having more robust data privacy. — Network Operations Engineer at a Latin American utility company
92% of organizations are adopting, standardizing, or scaling platform teams
Use of platform teams is one of the five key determinants of multi-cloud maturity. But while the other four maturity components (infrastructure, security, networking, and applications) are technology based, leveraging platform teams is an organizational function that cuts across technology best practices. So it shouldn't be a surprise that more than 9 out of 10 (92%) of respondents say they are adopting, standardizing, or scaling their use of platform teams. That's up from 86% who said they had “a centralized function or group with responsibility for formally managing cloud operations or strategy (CCoE, cloud platform team, etc.)” in 2022.
To what extent does your organization utilize a platform team to formally manage your cloud strategy?
We are scaling this practice throughout the organization
39%
We are standardizing on the use of a platform team
36%
We are adopting a platform team
17%
We do not use a platform team at all
6%
Don't know
1%
92% is a big number, but only 39% are scaling the use of platform teams throughout the organization. Looking at these results through the cloud maturity lens is even more revealing. More than one in five (22%) of low-maturity organizations said they either didn't know or didn't use a platform team at all, and only 14% are scaling their use. On the other hand, a full 100% of high-maturity organizations use platform teams and 69% are scaling them.
Given the continuing growth of platform teams, what's keeping the laggards from joining the party? The most common reason is a lack of skills and staff, named by more than a third of respondents without a platform team. For comparison, only 22% of non–platform team users mentioned this factor in the 2022 survey, when it was the sixth most common reason. The relationship between platform teams and skills shortages is complex. While platform teams can leverage scarce skills, they do require a certain amount of skilled staff to function properly.
As for other factors, almost a third of respondents (31%) who don't have a platform team are still exploring the need one. Only 11% say they don't see the need for a platform team.
You said that you don't have a platform team in place to manage your cloud strategy. Why is that?
We lack skills/staff
36%
We are still exploring the need to build a centralized cloud management function or group like this
31%
We plan to have a centralized cloud management function or group, but we have yet to implement it
28%
We have distributed responsibility for cloud strategy
28%
Our cloud usage is not significant enough to warrant a centralized cloud management function or group
26%
Platform teams help reduce operational complexity
Of course, having a platform team doesn't tell you much about what that team is actually doing. As shown in the chart below, platform teams often do pretty much all the things. When you combine the adoption, standardization, and scaling stages, responsibility for each practice approaches or exceeds 90% — collectively pointing towards the goal of reducing operational complexity through standardization.
Choose the response that best describes how your platform team manages each of the following responsibilities.
Develop and standardize cloud infrastructure strategy
18%
40%
37%
95%
Architect cloud solution(s)
19%
39%
37%
95%
Determine which cloud vendors and/or technologies are used in production
20%
38%
35%
93%
Define and measure site reliability
22%
35%
34%
91%
Create and distribute cloud management, operational policies, and best practices
21%
40%
33%
94%
We are standardizing this practice
We are scaling this practice throughout the organization
The platform team at my company helps us continuously set a north star for operational excellence as well as round the clock resiliency of our cloud resources. — Director, Cloud Center of Excellence at an Asia-Pacific retailer
Highly mature organizations highly value automation tools
One key to cloud success at scale is automating manual tasks to reduce labor and speed time to market. So it makes sense that more than 4 out of 5 respondents (83%) see automation tools as an important or very important facilitator of multi-cloud operationalization. Only a tiny fraction (3%) say it's not important.
How important are automation tools for your organization to operationalize your multi-cloud infrastructure?
Extremely important
50%
Important
33%
Somewhat important
14%
Not important
3%
The importance of automation tools becomes even clearer when you look at the difference between high- and low-maturity organizations. 59% of highly mature organizations say automation tools are extremely important, compared to just 41% of less mature organizations —that's almost half again as many.
Companies with a more mature cloud strategy better understand their workflows so they can be more confident automating them. This amplifies the business value they can extract from faster and easier configuration and security updates — meaning they get even more from their automation as they scale. The chart below notes the most commonly cited automation benefits, including security, efficiency, flexibility, and speed. Notably, a significantly higher percentage of high-maturity organizations report gaining these benefits almost across the board.
How has consistent and automated tooling operationalized your organization's multi-cloud strategy? Or how would it?
Improved security and governance
50%
Better utilization of cloud resources
49%
More flexible IT infrastructure
47%
Faster response to IT issues/events
43%
Self-service infrastructure
42%
Having a dedicated platform team enables the business to drive ahead with cloud network management and automation without the process being slowed down because the functionality is split across multiple teams. — Infrastructure Architect at an Asia-Pacific financial services firm
More about our model of operational cloud maturity
To create the multi-cloud maturity model used in this survey, HashiCorp worked with Forrester Consulting to track respondents' answers to five questions, each measuring the degree of practice implementation within five core areas of cloud technology and operations:
- Infrastructure
- Security
- Networking
- Applications
- Platform teams
Respondents were awarded points based on their level of implementation of certain practices within these categories.
- We do not use this practice at all (0 points)
- We are adopting this practice (1 point)
- We are standardizing this practice (2 points)
- We are scaling this practice (3 points)
Answers to the multipart questions were weighted to give equal value to each of the five dimensions, and each respondent's total score was used to calculate their level of maturity:
- The bottom 25% were considered low maturity, experimenting with these practices
- The middle 50% were considered medium maturity, standardizing these practices
- The top 25% were considered high maturity, scaling these practices
For more on the survey methodology and the cloud maturity model, as well as Forrester's key recommendations on multi-cloud strategy, security, skills development, and the need for automation, download the full Forrester Consulting study: Operational Maturity Optimizes Multicloud. To see regional results, check out our Europe/Middle East/Africa and Asia/Pacific/Japan breakdowns.
