A regional insurance carrier had been operating on-premises for two decades. In 2023, the board approved a cloud migration initiative driven by a combination of infrastructure refresh pressure, competitive pressure from more digitally capable peers, and a technology vendor’s persuasive total cost-of-ownership analysis. Two years into the program, the carrier had successfully migrated a significant portion of its workloads to a major hyperscaler. The cloud bill was running 40 percent over the initial projection. The compliance team had surfaced data residency questions that had not been addressed before the migration began. And three of the carrier’s most latency-sensitive actuarial workloads had been migrated back on-premises after performance degradation became visible in production. 

The carrier is not an outlier. IDC research found that half of cloud buyers spent more on cloud than originally projected, with the majority anticipating continued overruns in subsequent years. The cloud migration decision is not inherently flawed. Rushing toward a predetermined conclusion before understanding the workload portfolio. 

The on-premises versus cloud question, when asked correctly, is not a question about which model is better. It is a question about which placement is right for each workload in a specific organization, given its regulatory obligations, cost structure, operational maturity, and AI and analytics ambitions. Answering it correctly requires a different kind of analysis than most organizations conduct before they commit. 

Why the Binary Framing Fails 

The conversation that most infrastructure decisions begin with, cloud versus on-premises, is a framing issue. It treats two different answers to the same question as a single choice that applies to the entire environment. In practice, most mid-to-large enterprise environments contain workloads that belong in different places for entirely different reasons, and a cloud migration strategy that ignores this reality leads to cost overruns, compliance exposure, and performance problems that are expensive to remediate after the fact. 

According to IDC research, 49 percent of production workloads still run on-premises today. According to Gartner’s 2025 cloud trends analysis, 50 percent of critical enterprise applications will reside outside of centralized public cloud locations through 2027, a figure that reflects the growing recognition among infrastructure leaders that workload placement is a nuanced, application-level decision, not an organizational ideology. The market has already reached this conclusion. The organizations still framing the decision as cloud versus on-premises are behind it. 

The alternative framing is a workload-level portfolio assessment: for each class of workload, what placement produces the best outcome across cost, performance, compliance, and operational manageability? That framing produces a hybrid cloud strategy by default for most mid-to-large enterprises, not because hybrid is fashionable, but because a portfolio of workloads in a regulated industry will almost always contain some that belong in the cloud, some that belong on-premises, and some where the answer changes over a three-to-five year horizon as the organization’s AI programs mature and its regulatory environment evolves. 

The Six Considerations That Determine Placement 

When Paragon Shift works on infrastructure strategy with CIOs and CTOs in regulated industries, the assessment framework starts with six questions that the cloud-versus-on-premises framing skips consistently. The answers to these questions determine the workload placement map before any technology selection or vendor conversation begins.

Regulatory Obligations and Data Residency Requirements

This is not a secondary consideration. It is the first filter, and in regulated industries, it is often the most constraining one. A financial services firm operating across multiple jurisdictions may have data that is legally required to remain within specific geographic boundaries. A healthcare organization subject to HIPAA has specific requirements around where protected health information can be processed and stored. A private equity firm managing client data subject to SEC regulations has audit trail and data-custody obligations that affect where certain workloads can run. 

Gartner’s 2026 top strategic technology trends identify digital sovereignty as one of the defining infrastructure priorities for CIOs, noting that geopolitical risk and regulatory requirements are reshaping how organizations think about workload placement. For organizations in Paragon Shift’s primary verticals, regulatory obligation is often the decision, not a factor in the decision.

Workload Performance and Latency Requirements

Some workloads can tolerate the round-trip latency of a remote cloud data center. Others cannot. A manufacturing organization running real-time control systems on the plant floor cannot route those decisions through a cloud environment without introducing latency that affects production outcomes. A capital markets firm running intraday risk calculations has response-time requirements that on-premises infrastructure or colocation close to the trading environment is better positioned to meet. A healthcare system running clinical decision support at the point of care has latency requirements that vary by use case: a real-time bedside alert has a different tolerance than a population health analytics report generated overnight. Workloads with hard latency constraints belong on-premises or at the edge. Workloads with flexible timing belong in the cloud.

True Total Cost of Ownership Over Three to Five Years

The cost comparison that most cloud business cases present is not a total cost of ownership analysis. It compares the capital expenditure of on-premises hardware against the subscription cost of cloud services, without accounting for data egress fees, cross-zone traffic costs, the operational overhead of cloud governance and FinOps, the staffing cost of managing a cloud-native environment, and the cost of parallel environments during migration.

According to research from McKinsey, roughly 80 percent of enterprises report some form of cloud cost overrun, often because the economics of scale, storage growth, and data movement were underestimated at the planning stage. A genuine total cost of ownership comparison accounts for all categories of spend over a realistic horizon, including the staffing and skill investment cloud operations require and the data egress costs that data-intensive workloads generate at scale.

AI and Analytics Readiness Requirements

The infrastructure decision and the AI program decision are increasingly the same. A Forrester Consulting study commissioned by Microsoft found that only 34 percent of organizations on on-premises infrastructure reported their environment makes AI and ML innovation easy. Cloud platforms provide access to managed AI services, GPU infrastructure for model training, and elastic compute that AI workloads require during experimentation phases.

For organizations in the early stages of their AI programs, the cloud’s access to AI tooling is a genuine advantage. For organizations with mature, high-volume AI workloads running sustained inference at scale, on-premises GPU infrastructure can deliver a lower cost per inference over a multi-year horizon. The question is not whether cloud or on-premises supports AI better in the abstract. It is the placement that supports the specific AI workloads the organization is running now and planning to run within the next three years.

Operational Maturity and Staffing Capability

On-premises infrastructure only makes financial sense if the organization has, or can build, the IT capability to operate it effectively. The true cost of on-premises operation includes the staffing required to manage hardware, maintain security, plan capacity, and execute refresh cycles.

Cloud operations require a different skill set: cloud architecture, FinOps discipline, identity and access management in a cloud-native model, and operational practices that prevent cloud waste, which industry estimates put at 30 to 35 percent of cloud spend for organizations without mature cost governance. The question of whether to move a workload to the cloud is, in part, whether the organization has the operational maturity to manage it there cost-effectively. Organizations that migrate workloads to the cloud without building the operational capability to manage them are not reducing costs. They are trading one form of operational overhead for another, at a higher per-unit price.

Vendor Lock-in and Exit Cost

Cloud migration decisions that do not account for the cost of reversing them produce the repatriation scenarios that are increasingly visible across regulated industries. Gartner has noted that nearly half of organizations are now moving certain critical workloads back on-premises, not because the cloud is insecure, but because maintaining a consistent security posture, auditability, and regulatory confidence has become harder to justify at scale in a public cloud environment. Architect for portability where it matters. The workloads most likely to be repatriated or moved between providers are the ones where designing for exit at the outset would have cost a fraction of what the move ultimately requires.

What the Cost Comparison Requires

The total cost of ownership comparison between on-premises and cloud is one of the most frequently misrepresented analyses in enterprise technology decision-making. The version that creates the most misleading result compares capital expenditure for hardware procurement and data center operations against the subscription cost of cloud services, leaving out the cost categories that most frequently drive overruns. 

A genuine total cost of ownership comparison covers capital expenditure on hardware, facilities, and software licensing for on-premises; subscription and consumption costs for cloud; staffing costs for both environments, including the difference in skill requirements between on-premises engineering and cloud-native operations; data egress and inter-region traffic costs, which contribute five to seven percent to total ownership cost in data-intensive workloads according to industry analysis; the cost of parallel environments during migration; ongoing optimization and FinOps investment for cloud environments; and hardware refresh cycles for on-premises infrastructure. 

When all categories are included, the analysis produces a different picture than the one most vendor-provided business cases present. On-premises wins over predictability for stable, high-volume workloads over a seven-to-ten year horizon, provided the staffing and maintenance costs are fully loaded into the comparison. Cloud wins on year-one cash outlay, elasticity for variable workloads, and access to managed services that would require significant on-premises capital investment to replicate. Hybrid architectures that deliberately place workloads across environments win over total optimization for most mid-to-large enterprises in regulated industries. 

At Paragon Shift, the infrastructure strategy conversations we have with CIOs and CTOs typically begin not with a vendor comparison but with a workload inventory. Which systems are authoritative for regulated data? Which workloads have hard latency constraints? Which teams are currently building AI programs that will scale in the next 18 months? The answers to those questions shape the placement map before the technology evaluation begins. Technology choices made in the other sequence, platform selected before workloads are understood, produce migrations that are technically complete and operationally misaligned. 

What This Means for Regulated Industries 

The cloud migration strategy question looks different in each of Paragon Shift’s primary verticals because the regulatory, operational, and AI maturity contexts differ meaningfully across them. 

In financial services and insurance, the primary constraints are regulatory. Data residency requirements, audit trail obligations, and the systemic risk implications of cloud concentration in critical financial infrastructure mean that certain workloads have limited placement flexibility regardless of the cost or performance case for cloud migration. The practical cloud migration strategy for a financial institution is a tiered model: cloud for development, testing, and non-sensitive analytics workloads; on-premises or private cloud for core transaction processing, regulatory reporting, and risk systems where audit trail requirements demand a level of data custody that public cloud shared responsibility models complicate. 

In healthcare, the primary constraints are clinical latency and HIPAA compliance. Real-time clinical workloads and workloads involving protected health information have specific placement requirements that the cloud can accommodate with appropriate controls, but that require careful architectural design rather than lift-and-shift migration. Population health analytics, care management reporting, and research workloads, which are non-real-time and can be appropriately de-identified, are strong candidates for cloud migration and for the AI and analytics services cloud environments provide. 

In manufacturing, the primary constraints are operational technology integration and latency. Plant floor control systems, quality inspection workloads, and predictive-maintenance models that feed into production decisions require on-premises or edge deployment. Manufacturing analytics, supply chain optimization, and enterprise resource planning integration workloads are strong cloud candidates, particularly for organizations seeking access to AI-enabled demand forecasting and supply chain intelligence that cloud platforms have made accessible without the capital investment required by on-premises equivalents. 

Key Takeaways

1. The cloud-versus-on-premises decision is a workload-level portfolio question, not an organizational ideology choice. According to Gartner’s analysis, 50 percent of critical enterprise applications will reside outside centralized public cloud locations through 2027, reflecting the reality that most enterprise workload portfolios contain workloads that belong in different environments.

2. Budget overruns are the most common cloud migration failure mode. IDC research found that half of cloud buyers spent more on cloud than originally projected, with the majority anticipating continued overruns in subsequent years.

3. The six factors that determine workload placement are regulatory obligations, latency requirements, true total cost of ownership over three to five years, AI and analytics readiness, operational maturity, and exit cost. A cloud migration strategy that skips any of these produces a placement decision that will require remediation.

4. Gartner’s 2026 top strategic technology trends identify digital sovereignty as a defining infrastructure priority for CIOs, with geopolitical risk and data residency requirements reshaping workload placement decisions across regulated industries. For organizations in financial services, insurance, and healthcare, regulatory obligation is often the placement decision, not a factor in it.

5. Cloud infrastructure spending is accelerating significantly and is driven primarily by AI workloads. Gartner forecasts worldwide public cloud spending will reach $723.4 billion in 2025, up 21.5 percent year over year. Organizations whose AI programs require elastic compute and managed AI services have a genuine cost and innovation case for the cloud. Organizations running stable, high-volume, latency-sensitive workloads in regulated environments have an equally genuine case for on-premises or hybrid architecture.

6. The organizations that execute cloud migration strategies most effectively are the ones that start with a workload inventory and a regulatory map, not a vendor selection. Technology choices made before workload requirements are understood produce migrations that are technically complete and operationally misaligned.

Conclusion

The insurance carrier that migrated 40 percent over budget and repatriated its most latency-sensitive workloads did not make a wrong decision about cloud. It made an incomplete decision, one that selected a destination before fully understanding what needed to go there, what the compliance obligations attached to each workload were, and what the true cost of operating those workloads in the cloud would be over the first three years. 

The cloud migration decision, made correctly, is a workload-level analysis that produces a placement map rather than a migration mandate. For most organizations in regulated industries, that map produces a hybrid architecture, with cloud for workloads that benefit from elasticity, managed AI services, and operational flexibility, and on-premises or private cloud for workloads where data custody, latency, or cost predictability make that the right answer. 

The organizations that execute this well are not the ones that committed earliest to cloud-first. They are the ones who asked the right questions before they committed to anything. Building that analysis with precision and executing the migration in a sequence that matches workload placement to actual requirements is where the program succeeds or fails. 

Why financial institutions struggle to trust their own data