The third annual HashiCorp State of Cloud Strategy Survey reveals the continued evolution of enterprise cloud strategy. The 2021 survey welcomed enterprises to the multi-cloud era, demonstrating the prevalence of a common multi-cloud operating model. The 2022 results reiterated those findings and underscored how a multi-cloud approach is delivering meaningful business value.
This year, the State of Cloud Strategy Survey focuses on operational cloud maturity — defined not by the amount of cloud usage, but by adoption of a combination of technology and organizational best practices at scale, covering infrastructure, security, networking, applications, and their use of platform teams. For 2023, we once again commissioned Forrester Consulting to perform the survey. In addition, we worked with Forrester to develop a cloud maturity model for describing where organizations are in their cloud adoption journey: low maturity, those experimenting with these practices; medium maturity, organizations standardizing their use of these practices; and high maturity, organizations that are scaling these practices broadly.
The results were clear: Organizations demonstrating the most maturity are also the ones unlocking the most value from their cloud efforts. Mature cloud practices were strongly correlated with positive business outcomes with respect to speed, risk, and efficiency.
Specifically, high-maturity companies were more likely to report that they were boosting their cloud spending and also that the cloud was saving them money. Not coincidentally, highly mature organizations were also less likely to waste money on avoidable cloud spending. Highly mature companies had an easier time dealing with cloud security issues and coping with the ongoing shortage of cloud skills. This process of maturing cloud practices is typically driven by cloud platform teams that centralize and standardize infrastructure and application services — including widespread automation, infrastructure as code, self-service infrastructure, CI/CD, site reliability engineering, observability, dynamic secrets management, and more — across the entire organization.
On the flip side, less-mature organizations struggled to implement their cloud operating model, scale their multi-cloud adoption, and achieve business success. (For more on the survey methodology and the cloud maturity model, see the Forrester study: Operational Maturity Optimizes Multicloud.)
Boosted cloud spending in the last year, despite macroeconomic uncertainty
Of highly cloud mature organizations say multi-cloud is working, or is expected to within a year
Of high-maturity organizations are using multi-cloud to save money
Rank of security as a multi-cloud success factor
Rank of skills shortages as a multi-cloud barrier
Of high-maturity companies say multi-cloud helps them attract, motivate, and retain talent
Of organizations are adopting, standardizing, or scaling platform teams
Despite worldwide macroeconomic uncertainty, more than half (56%) of survey respondents actually increased their cloud spending in the last 12 months. Only about 1 in 5 (22%) cut their spending. Some of that increase may be due to inflation, but even as companies work to improve governance, risk management, and compliance (GRC) to cut waste with individual cloud service providers, the secular trend is so powerful that their overall cloud investments continue to grow.
The distribution of the responses is even more telling. Almost two-thirds (62%) of respondents from high-maturity organizations boosted their spending, by an average of 16%. Even as high-maturity organizations doubled down on the cloud, however, many low-maturity organizations retreated or stood pat: Only 38% of low-maturity organizations increased their cloud spend, by an average of 11%, while 37% either kept spending flat or didn’t know how their spending had changed.
Even as many companies boost their cloud investments and hope to save money with multi-cloud, almost all respondents (94%) report avoidable cloud spend for a variety of reasons. That number is virtually unchanged from the 2022 State of Cloud Strategy Survey results.
Low cloud-maturity firms, in particular, struggle with over-provisioning resources (53%) and idle or underused resources (55%) compared to 50% overall for those issues. The third most common factor, lack of needed skills, cited as a factor in cloud waste by 43% of respondents, was evenly distributed across all levels of maturity.
Idle or underused resources
Lack of needed skills
Lack of expiration date on temporary cloud resources
Cost premiums based on geographical region
In the 2023 State of Cloud Strategy Survey, 76% of respondents were implementing, expanding, or planning a multi-cloud strategy — but the more telling result is that 86% of respondents from high-maturity companies said they were implementing, expanding, or planning multi-cloud, compared to just 54% of low-maturity organizations.
These differences are important because the overwhelming majority of multi-cloud users (92%) continue to believe the strategy is helping them reach their business goals (or they expect it to in the next year). That tops the already-robust 90% who said multi-cloud was paying off for them in their answers to a similar question in last year's survey.
Significantly, high-maturity organizations were much more likely to report multi-cloud has or is about to help them achieve their business goals (94%) compared to low-maturity organizations (only 60% of which said they were already enjoying these benefits, while another 22% expect to do so in the next year).
But what exactly are the problems that organizations are seeking to address with multi-cloud? The most commonly cited multi-cloud drivers are reliability (51%), cost reduction (48%), security and governance (45%), digital transformation (45%), and scalability (45%). Notably, in times of macroeconomic disruption, cost reduction charted much higher this year than last year. Only 10% had no choice but to go multi-cloud due to acquisitions or other issues, but that's still double last year's percentage.
Security and governance
Diving more deeply, high-maturity organizations reported better results across many multi-cloud benefits, most notably cost savings. More than half (53%) of high-maturity respondents used multi-cloud to cut costs, compared to just 42% of low-maturity respondents. Similarly, reliability was named a multi-cloud driver by 59% of high-maturity companies vs. 49% of low-maturity companies. But the biggest difference between high and low maturity organizations was for portability of data and applications, which was a driver for almost half (49%) of high-maturity companies but less than a third (29%) of low-maturity firms.
Globally, the Asia-Pacific region (56%) found cost savings in multi-cloud even more compelling, while Europe-Middle East-Africa (42%) was less focused on this.
Now that we know what’s driving multi-cloud adoption, what factors determine its success? Notably, all of the choices presented scored highly, being called important or very important by almost three-quarters of respondents.
Security (88%), availability (84%), and scalability (84%) were the most often named important/very important multi-cloud success factors, followed by regulatory/compliance requirements (82%), staffing and skill levels (82%), budget (80%), visibility into cloud infrastructure (78%), automated tooling (77%), and platform teams (75%).
Ability to deliver uptime and availability
Meeting regulatory/compliance requirements
Note: Total percentages may not equal separate values due to rounding.
Security (60%) and availability (48%) also top the list when looking only at what respondents considered very important, while regulatory/compliance requirements (46%) edge out infrastructure scaling (45%) and budget (45%) from that perspective.
Location also matters: Budget was a very important factor for 51% of Asia-Pacific respondents vs. just 41% for respondents in Europe-Middle East-Africa and North America (and 45% overall).
Put it all together, and a multi-cloud strategy delivers a wide variety of benefits, ranging from promoting a stronger security posture (74%) to helping attract, motivate, and retain skilled staffers (68%, and more on that later). Those two factors appear related: while multi-cloud clearly creates security challenges, working in multiple cloud environments can help organizations keep their security professionals engaged, and also be a forcing function toward more intentional oversight of their security operations. The big news, though, is that all 11 of the possible choices were selected by more than two-thirds of respondents, suggesting that multi-cloud benefits are broad, and broadly distributed.
Stronger security posture
Better visibility into cloud infrastructure
Increased/improved automated tooling
Improved speed/pace of change in cloud service options
Improved uptime and availability
Note: Total percentages may not equal separate values due to rounding.
Despite the clustering of the overall results, however, there were big differences between high- and low-maturity organizations. Large differences showed up in the areas of compliance and risk (80% to 56%), infrastructure visibility/insight (82% to 59%), and speed (76% to 59%). But the biggest difference between high- and low-maturity organizations surfaced in their ability to attract, motivate, and retain talent (74% to 48%, and again, more on that below).
The ongoing shortage of skilled cloud talent is a critical but complex issue for companies across the entire maturity spectrum. When asked what factors complicate their organizations' ability to operationalize multi-cloud, skills shortages (27%) was the most commonly selected response, followed by related issues such as siloed teams (26%) and lack of training (25%).
Teams working in silos
Lack of training
Compliance and risk management
Budget constraints that affect purchase of enterprise tools
Continuing this thread, a lack of necessary staff/skills was the second-most commonly cited internal security threat, just behind data privacy protection. Notably, that's up from a fifth-place ranking in last year's survey. Similarly, organizations that don’t use platform teams — a key component of multi-cloud maturity — were even more likely to cite skills issues as an internal threat, 56% compared to 43% for organizations that do use platform teams. (More on these issues below.)
But that's not the only way to look at the issue. As shown in the previous section, staffing/skill level was an important/very important driver of multi-cloud success for 80% of respondents, with 38% rating it very important. And more than half (51%) of highly mature organizations rated staffing/skill level very important, compared to less than a third (31%) of low-maturity respondents.
And while largely focused on other benefits, 68% of multi-cloud users said their strategy helps them attract, motivate, and retain talent. Importantly, almost three-quarters (74%) of highly mature organizations gained staffing benefits from multi-cloud, compared to less than half (48%) of low-maturity organizations.
Given the prevalence of the issue, organizations are addressing skills shortages with multiple tactics, most often via a common operating model/shared automated workflows (58%), followed by reskilling/upskilling (56%). Working with partners was a plan for 43% of respondents, while only 36% planned to boost budgets — though it's not clear whether that's because they thought the tactic wouldn't work or it wasn't economically feasible.
Standardize on a common operating model
Reskill and/or upskill staff through certifications and education around our core initiatives
Work more strategically/closely with your reseller/SI partners and consultants
Increase budget to address headcount shortage
Remove environmental or operational silos
Ironically, while platform teams are often seen as a force multiplier that can help mitigate shortages of skilled technical talent, the biggest reason for organizations not to field platform teams is a lack of skilled staffers (more on that issue in the platform teams section below).
Security has always been a key issue in the cloud, both as a goal and a barrier. In the 2022 State of Cloud Strategy Survey, 89% of respondents saw security as a key driver of cloud success, and in the 2021 survey, security was named the second most important cloud inhibitor, after cost concerns.
Those concerns are still with us, although the particulars continue to evolve. Multi-cloud success continues to be dependent on security and the tools that support it. For example, as noted above, security is once again the top factor in multi-cloud success and the most common benefit from a multi-cloud strategy. This year, however, data protection (77%) is joined by secrets management (75%) and access control (75%) in the top tools/initiatives seen as critical to the success of the organization’s cloud strategy.
Access control and session management
Infrastructure as code
Note: Total percentages may not equal separate values due to rounding.
At the same time, password/credentials/secrets leakage is now seen as the most common security threat (cited by 50% of respondents), topping highly publicized, long-standing concerns like data theft (49%), phishing (46%), and ransomware (42%).
Phishing/social engineering attacks
Denial of service attacks
But once again, there's a big difference in how high- and low-maturity organizations view the passwords/secrets issue. Only 47% of high maturity organizations listed credentials leakage as one of their biggest threats, compared to 61% of low-maturity organizations. Perhaps modern zero trust security practices employed in highly mature organizations help them feel more comfortable with their security posture, especially regarding secrets issues. Mature organizations also report more confidence when it comes to ransomware, with only 39% naming it as one of the biggest cloud security threats, compared to 47% of low-maturity organizations.
Internally, the most commonly cited security threats are data/privacy protection (45%) followed closely by lack of skills (44%) and threat detection and remediation (43%). And once again, low-maturity firms were more likely to cite skills issues as an internal security threat, 52% compared to 42% for high-maturity organizations. As noted above, organizations that don’t use platform teams were even more likely to cite skills issues as an internal threat, 56% compared to 43% for organizations that do use platform teams.
Use of platform teams is one of the five key determinants of multi-cloud maturity. But while the other four maturity components (infrastructure, security, networking, and applications) are technology based, leveraging platform teams is an organizational function that cuts across technology best practices. So it shouldn't be a surprise that more than 9 out of 10 (92%) of respondents say they are adopting, standardizing, or scaling their use of platform teams. That's up from 86% who said they had “a centralized function or group with responsibility for formally managing cloud operations or strategy (CCoE, cloud platform team, etc.)” in 2022.
We are scaling this practice throughout the organization
We are standardizing on the use of a platform team
We are adopting a platform team
We do not use a platform team at all
92% is a big number, but only 39% are scaling the use of platform teams throughout the organization. Looking at these results through the cloud maturity lens is even more revealing. More than one in five (22%) of low-maturity organizations said they either didn't know or didn't use a platform team at all, and only 14% are scaling their use. On the other hand, a full 100% of high-maturity organizations use platform teams and 69% are scaling them.
Given the continuing growth of platform teams, what's keeping the laggards from joining the party? The most common reason is a lack of skills and staff, named by more than a third of respondents without a platform team. For comparison, only 22% of non–platform team users mentioned this factor in the 2022 survey, when it was the sixth most common reason. The relationship between platform teams and skills shortages is complex. While platform teams can leverage scarce skills, they do require a certain amount of skilled staff to function properly.
As for other factors, almost a third of respondents (31%) who don't have a platform team are still exploring the need one. Only 11% say they don't see the need for a platform team.
We lack skills/staff
We are still exploring the need to build a centralized cloud management function or group like this
We plan to have a centralized cloud management function or group, but we have yet to implement it
We have distributed responsibility for cloud strategy
Our cloud usage is not significant enough to warrant a centralized cloud management function or group
Of course, having a platform team doesn't tell you much about what that team is actually doing. As shown in the chart below, platform teams often do pretty much all the things. When you combine the adoption, standardization, and scaling stages, responsibility for each practice approaches or exceeds 90% — collectively pointing towards the goal of reducing operational complexity through standardization.
Develop and standardize cloud infrastructure strategy
Architect cloud solution(s)
Determine which cloud vendors and/or technologies are used in production
Define and measure site reliability
Create and distribute cloud management, operational policies, and best practices
One key to cloud success at scale is automating manual tasks to reduce labor and speed time to market. So it makes sense that more than 4 out of 5 respondents (83%) see automation tools as an important or very important facilitator of multi-cloud operationalization. Only a tiny fraction (3%) say it's not important.
The importance of automation tools becomes even clearer when you look at the difference between high- and low-maturity organizations. 59% of highly mature organizations say automation tools are extremely important, compared to just 41% of less mature organizations — that's almost half again as many.
Companies with a more mature cloud strategy better understand their workflows so they can be more confident automating them. This amplifies the business value they can extract from faster and easier configuration and security updates — meaning they get even more from their automation as they scale. The chart below notes the most commonly cited automation benefits, including security, efficiency, flexibility, and speed. Notably, a significantly higher percentage of high-maturity organizations report gaining these benefits almost across the board.
Improved security and governance
Better utilization of cloud resources
More flexible IT infrastructure
Faster response to IT issues/events
To create the multi-cloud maturity model used in this survey, HashiCorp worked with Forrester Consulting to track respondents' answers to five questions, each measuring the degree of practice implementation within five core areas of cloud technology and operations:
Respondents were awarded points based on their level of implementation of certain practices within these categories.
Answers to the multipart questions were weighted to give equal value to each of the five dimensions, and each respondent's total score was used to calculate their level of maturity:
Want to know more about the survey methodology and the cloud maturity model, as well as Forrester's findings and key recommendations on multi-cloud strategy, security, skills development, and the need for automation? Download the full Forrester Consulting study: Operational Maturity Optimizes Multicloud. To see regional results, check out our Europe/Middle East/Africa and Asia/Pacific/Japan breakdowns.