Migration is a single dimension, and it tells you little about value. The Cloud Operating Model defines three competencies, Service Delivery, Operations, and Governance, and a programme's maturity is the balance across all three.
Microservices promise independent deployability and scalability, and often deliver a distributed complexity worse than the monolith they replaced. The escape is service boundaries drawn around domains, not technical decomposition.
The common DevSecOps failure is treating it as DevOps with security tools added to the pipeline. Real DevSecOps redesigns who owns security decisions and when, and the operational gap decides whether security enables delivery or blocks it.
Most cloud strategies fail because they start with the cloud and reason backwards to a business case. The logic only works forwards: business strategy drives application strategy, which drives cloud strategy, operationalised through the operating model.
Cloud cost has moved from an IT operations concern to a CFO agenda item. Most IT organisations cannot yet have the finance-led governance conversation that follows, and the time to prepare is before it becomes a crisis.
A year of cloud programme experience is an honest test of the operating model frameworks. Cost and platform engineering advanced; the people and governance dimensions are still where most programmes stall.
Shift-left security is now widely accepted in principle and rarely implemented in practice. Four process changes separate organisations that genuinely moved security left from those that relabelled the gate at the end.
The cloud patterns of 2021 point clearly at 2022: cost moving from CFO mandate to engineering discipline, platform engineering as a function, security shifting left, and multi-cloud becoming a governance problem. Four operating model trends, with budget and design implications.
Log4Shell exposed a systemic enterprise risk: dependence on open source components with unknown security postures, embedded deep in production with no reliable inventory. It is a preview of the supply chain challenge, not an anomaly.
Every cloud-native architecture deck ends with a target-state diagram and skips the organisational change required to reach it. The architecture decision and the change decision have to be made together, or the diagram never materialises.
