Multi-Cloud, Hybrid Cloud, or Strategic Cloud Concentration?

Regulatory status, commercial terms and survey figures in this article are as of 13 August 2026. INVISOM has no commercial relationship with any cloud provider.

Most multi-cloud is an accident

Ask an enterprise whether it is multi-cloud and the answer is almost always yes. Ask how its spend is split and the picture changes: one provider carries most of the workload, a second hosts what an acquisition brought in or what one team preferred, and a few SaaS platforms run on whichever cloud their vendor chose.

The data supports that picture. Flexera's 2026 State of the Cloud survey, of more than 750 cloud decision-makers and users, found that 73% of organizations run hybrid estates and that multi-cloud adoption keeps rising, but often unintentionally, through mergers, siloed application teams and inherited architectures rather than deliberate strategy. The UK Competition and Markets Authority's market investigation, concluded in July 2025, found that fewer than 1% of cloud customers switch provider each year, and that while large customers are more likely to use several providers, their spending generally remains concentrated with one main provider.

So the real choice is not between one cloud and many. It is between concentration you have chosen and engineered for, and concentration that happened while you believed you were multi-cloud. This article argues for the first, and sets out when a genuine second cloud or a hybrid footprint earns its cost.

Four postures, defined

The terms are used loosely, so it helps to separate four distinct postures:

• Strategic concentration: one primary cloud for nearly all workloads, with architecture choices (open data formats, infrastructure as code, a model gateway) and a documented exit plan that keep switching feasible.
• Hybrid: a primary public cloud plus on-premises or private cloud for workloads that must stay there, typically for latency, regulation, existing investment or steady, predictable load.
• Multi-cloud by workload: different workloads on different clouds, each placed where it fits best, with limited interaction between them.
• Symmetric multi-cloud: the same applications able to run on more than one cloud, through abstraction layers and portable designs, so that workloads can move or fail over between providers.

The first three can all be sensible. The fourth is where most of the cost and disappointment lies.

Why symmetric multi-cloud rarely pays

The promise of symmetric multi-cloud is leverage and resilience: avoid lock-in, negotiate harder, survive a provider failure. The costs are less visible and usually larger.

You build to the lowest common denominator. To run the same application on two clouds, teams avoid the managed services that differ between them: proprietary databases, serverless platforms, AI services, identity integrations. They are left with virtual machines, Kubernetes and self-managed data stores, which is to say, with many of the operational burdens they moved to cloud to escape.

You pay twice for skills and controls. The CMA identified a lack of transferable skills among customers' staff, latency between clouds and the differentiation of features and interfaces as technical barriers to multi-cloud. Each additional cloud needs its own security baseline, identity model, network design, monitoring and on-call expertise.

You dilute volume discounts. Committed-spend agreements are widespread, and the CMA found that they influence how customers allocate workloads. In INVISOM's experience, splitting spend evenly across providers usually weakens the commitments, and so the discounts, available on each.

Resilience gains are smaller than they look. The failure most customers should plan for first is the loss of a region or a regional service, not of an entire provider. In October 2025, a race condition in DynamoDB's DNS automation in AWS's Northern Virginia region (US-EAST-1) caused a disruption that, with knock-on effects, lasted about 15 hours. The lesson for most customers was about dependency on a single region, which multi-region design within one provider addresses at a fraction of the cost of running on two providers.

Symmetric multi-cloud is justified in a narrow set of cases: systemically important services where provider-level failure is unacceptable and the organization can fund two full operating models, or software vendors whose customers demand a choice of cloud.

The regulatory view: exit and substitutability, not multi-vendor

Regulators have become much more concerned about cloud concentration, but their prescriptions are more nuanced than "use more than one cloud".

The EU's Digital Operational Resilience Act (DORA), applicable to financial entities since 17 January 2025, is the clearest example. On 18 November 2025 the European Supervisory Authorities published the first list of 19 critical ICT third-party service providers, which now face direct EU oversight. It includes the EU entities of Amazon Web Services, Google Cloud and Microsoft, along with Oracle, IBM, SAP and several large IT service and network providers.

What DORA asks of the financial entities themselves is telling:

• Article 6(9) says financial entities may define a multi-vendor strategy. It is permitted, not required.
• Article 28(8) requires exit strategies for ICT services supporting critical or important functions, including transition periods during which the provider continues to serve.
• Article 29 requires entities to assess, before contracting, whether a provider is not easily substitutable and whether they are concentrating critical services with one provider, and to weigh the benefits and costs of alternatives such as using different providers.

In other words, the regulatory expectation is that concentration is a conscious, assessed and reversible decision, which is exactly what strategic concentration means. The UK CMA reached a similar position from a competition angle: in March 2026 it chose not to open strategic market status investigations into AWS and Microsoft's cloud businesses, accepting their commitments on egress fees and interoperability instead, while opening a strategic market status investigation into Microsoft's business software ecosystem, which would allow it to act on its concerns about Microsoft's software licensing in cloud.

Exit is getting cheaper, which strengthens concentration

The main argument for paying the multi-cloud premium was that leaving a provider was prohibitively expensive. That argument has weakened considerably.

Google Cloud removed data transfer fees for customers leaving its platform in January 2024, and AWS and Microsoft followed in March 2024. The EU Data Act limits switching charges to providers' direct costs and bans them entirely from 12 January 2027; it also caps egress charges for parallel use of several providers at cost. In the UK, AWS and Microsoft committed in March 2026 to remove egress fees from UK customers' contracts when they switch, for a switching period of at least 180 days and as soon as they switch even one service, and to lower fees for multi-cloud data transfers.

These changes do not eliminate switching costs. The technical barriers remain, and licensing can matter more than egress: the CMA found that Microsoft's licensing practices disadvantage AWS and Google for customers using products such as Windows Server and SQL Server. But they shift the economics. If the commercial cost of exit is falling, the rational response is to invest in making exit technically feasible, not to pay continuously for running everywhere at once.

When hybrid and a second cloud do earn their place

Strategic concentration is not purism. A second environment is justified when a specific workload needs it:

• Data residency without an in-country region. Where the primary cloud has no region in a required jurisdiction, a second provider or a local private cloud may be the only option. Gulf enterprises have faced exactly this, and the new Saudi hyperscaler regions announced for late 2026 change the calculation for some of them.
• A best-in-class service with no equivalent. A specific data platform, AI model or analytics engine may justify a second cloud for one workload, accessed through open formats. Our Snowflake and Databricks comparison shows how open table formats make this more practical.
• Steady, predictable load. Some workloads are cheaper on owned or co-located hardware. Hybrid makes sense where utilization is high and demand predictable.
• Latency and sovereignty at the edge. Plants, branches and classified environments may need on-premises processing.
• Acquisitions. Inherited estates are often best left in place until a natural replatforming point, provided they are governed as part of one portfolio.

Capital One illustrates the opposite end. By AWS's account (vendor material), the bank spent eight years moving to AWS, closed all eight of its data centers and became the first US bank to announce going all in on the cloud. Concentration at that depth is a strategic choice that comes with board-level scrutiny of the provider relationship, which is precisely what DORA-style rules now formalize.

Choosing a posture

Three principles keep the result coherent, whatever posture you choose:

1. Concentrate by default, diversify by exception. Every workload outside the primary cloud should have a written reason, recorded as an architecture decision.
2. Engineer for exit, then test it. Keep data in open table formats, infrastructure in code and model access behind a gateway. Rehearse the exit for one critical workload at least once.
3. Spend resilience budget on regions first. Multi-region and multi-zone design within the primary cloud addresses most real outages before a second provider is worth considering.

What to do in the next 90 days

1. Measure your actual concentration. Report spend and critical workloads by provider and by region, including SaaS platforms and the clouds they run on.
2. Name the posture. Decide explicitly between strategic concentration, hybrid and multi-cloud by workload, and record the rationale.
3. Write a substitutability assessment for each critical service on the primary cloud: alternatives, migration effort, data volumes and licensing constraints.
4. Document the exit plan using each provider's free-egress process, time window and contractual terms, and test it on one non-trivial workload.
5. Review regional resilience for critical workloads before considering a second provider for failover.
6. For regulated entities, align with DORA-style expectations on concentration risk and exit strategies even outside the EU; they are a useful benchmark for any board-level review of cloud dependency.

Frequently asked questions

Is multi-cloud better than a single cloud?

Not in general. Symmetric multi-cloud adds cost, complexity and duplicated skills, and regional failures can be addressed within one provider. One primary cloud with multi-region design and a tested exit plan is usually stronger, with other clouds used for specific workloads.

What is the difference between hybrid cloud and multi-cloud?

Hybrid cloud combines public cloud with on-premises or private cloud. Multi-cloud uses more than one public cloud provider. Many enterprises are both, since Flexera's 2026 survey found 73% operate hybrid estates.

Does DORA require financial institutions to use more than one cloud?

No. DORA allows a multi-vendor strategy but does not mandate one. It requires exit strategies for critical services and an assessment of concentration and substitutability, weighing the costs and benefits of alternatives.

Are cloud egress fees still a barrier to switching?

Less than before. Google, AWS and Microsoft waived egress fees for customers leaving in 2024, the EU Data Act bans switching charges from 12 January 2027, and the UK regulator secured further commitments in 2026. Technical and licensing barriers remain significant.

Sources and further reading

• Cloud services market investigation: final decision report, UK CMA, 31 July 2025.
• Actions on cloud and business software and press release, UK CMA, 31 March 2026.
• Flexera 2026 State of the Cloud Report and press release, Flexera, March 2026.
• Digital Operational Resilience Act, Regulation (EU) 2022/2554, Articles 6, 28 and 29.
• ESAs designate critical ICT third-party providers and list of designated CTPPs, 18 November 2025.
• EU Data Act, Regulation (EU) 2023/2854, Articles 29 and 34.
• Exit fees: Microsoft, as reported by The Register, 13 March 2024; Google Cloud, 12 January 2024; AWS, 5 March 2024.
• Summary of the Amazon DynamoDB service disruption in US-EAST-1, AWS, October 2025.
• Capital One goes all in on AWS, AWS case study (vendor material).