Hybrid Cloud Won, and CIOs Must Now Run It Properly

Hybrid cloud is no longer a transition state, argues David Linthicum, the former chief cloud strategy officer at Deloitte Consulting — it is the destination, and enterprises should stop apologizing for it. After more than a decade of listening to executives promise "100% cloud in five years," he concludes the hybrid model won because business, technology, economics and regulation pushed it there. Until early 2024, Linthicum served as managing director and chief cloud strategy officer at Deloitte Consulting LLP, with more than 30 years in enterprise technology.

What killed the all-in cloud migration?

Linthicum recalls the early migration wave in blunt terms. Executives would declare five-year, three-year, sometimes 18-month deadlines for full public cloud adoption. Then the assessment teams looked "under the floorboards" and found the usual suspects:

• Manufacturing systems running on platforms nobody dared touch
• A database that had become a critical dependency for 12 other applications
• Licensing restrictions that made cloud moves financially absurd
• Latency requirements indifferent to the strategy deck
• Regulatory rules that grew teeth once legal, compliance and security entered the room

He has watched teams spend months planning a migration, only to find the move would make a workload slower, costlier or harder to operate. The public cloud was not the fault. The assumption that every workload belonged there was. In his verdict: "That assumption has probably wasted more enterprise cloud budget than any single technical mistake."

Where should a workload actually run?

Workloads, Linthicum insists, are not abstract boxes on a diagram — they have opinions. A customer-facing platform with seasonal spikes suits public cloud. A high-volume analytics workload may favor one hyperscaler for its native data services. A regulated transaction system may stay on premises because its compliance model is already proven. An edge workload in a factory or hospital must sit close to the machines, sensors or patients it serves.

He tells teams to stop asking "How do we move this to the cloud?" and start asking where the workload creates the most value at the lowest acceptable risk and cost. Sometimes the answer is AWS, Azure, Google Cloud, Oracle Cloud or a SaaS provider. Sometimes it is the data center you already own. The answer will be hybrid more often than purists admit.

What changed when the CFO read the bill?

Money settled the argument. Many enterprises treated cloud as a cheaper data center, and Linthicum has seen the results firsthand: organizations that lifted and shifted inefficient applications, overprovisioned, ignored egress charges and forgot to turn things off. The monthly bill "looked like a ransom note." His diagnosis is concise: "The issue was not that cloud was bad. The issue was that they moved bad architecture to a metered platform."

Once finance got involved, the conversation changed. Keeping steady-demand, predictable-capacity workloads on existing infrastructure stopped looking old-fashioned and started looking rational. Hybrid cloud buys economic flexibility — workloads placed where the cost model makes sense. Not glamorous, he concedes, but how grown-up IT works.

Why compliance never read the brochure

In healthcare, finance, government and insurance, infrastructure decisions answer to data residency rules, audit obligations, retention laws, privacy statutes and risk committees that demand evidence, not enthusiasm. Linthicum credits hyperscalers with impressive compliance certifications and, often, better security tooling than traditional environments. That still does not let every workload move freely overnight.

His model: sensitive data stays in a controlled private environment while analytics, digital channels and AI services run in public cloud. Some systems modernize gradually through APIs rather than being ripped out and relocated. That satisfies the auditor and keeps the business running.

Is hybrid itself the problem — or bad hybrid?

When people complain about hybrid cloud, Linthicum argues, they are really complaining about badly designed hybrid cloud: inconsistent security models, five identity systems, no common observability, manual deployments, unclear ownership, networking designed during a fire drill, and cloud and infrastructure teams that barely speak. "That is not an argument against hybrid cloud. It is an argument against accidental architecture."

A workable strategy, in his list, needs:

• Common control planes where possible
• Consistent identity and access management
• Automated policy enforcement and clear data architecture
• Unified monitoring and a mature FinOps practice
• Platform engineering that makes the right thing the easy thing for developers
• Security built into the pipeline, not stapled on at the end

Above all, honesty. If you run three public clouds, two data centers, a handful of SaaS platforms and edge locations worldwide, say so, design for it, fund it, govern it. Stop calling it a temporary inconvenience.

Linthicum closes with a warning to those waiting for simplicity. "Everything in one cloud" fits on a bumper sticker; a governed architecture spanning public cloud, private infrastructure, SaaS and edge does not. Enterprise IT has always been a layered accumulation of acquisitions, regulations and budget constraints. The winners are not waiting for hybrid to disappear — they know where their workloads live and why, understand their cost models, automate across environments and build governance that enables rather than paralyzes. Hybrid cloud won because reality won.