Cloud transformation 2.0

For much of the last decade, cloud transformation had a relatively straightforward destination to move workloads out of ageing data centres, exploit hyperscale economics, modernise applications and consume increasingly sophisticated services on demand.

The question facing CISOs is no longer simply how to secure a cloud environment. It is whether the enterprise can still understand, govern and assure a digital estate assembled from cloud platforms, SaaS, APIs, data services, software supply chains and, increasingly, AI models and autonomous agents.

Cloud transformation is entering a second, arguably more consequential phase, as cloud becomes the underlying fabric for a machine-scale world.

The perimeter disappeared. Now the infrastructure is disappearing too

Today, applications increasingly consume managed services rather than infrastructure. Developers call APIs rather than provision servers. AI agents can select tools, interrogate data and execute workflows dynamically.

Cloud providers can assume substantial responsibility for securing infrastructure, but organisations remain accountable for understanding their requirements, configuring services appropriately and deciding what data and authority they entrust to them.

The uncomfortable consequence is outsourcing infrastructure does not outsource accountability and for organisations that are still surviving on control sets, risk and assurance practices designed for infrastructure they owned but are now in a world of services they consume need to watch out.

Identity is becoming the new control plane

Cloud estates already contain vast populations of service accounts, workload identities, API keys, certificates and tokens. AI introduces something potentially more consequential: an identity capable of reasoning, selecting tools and taking action.

A conventional service account executes predetermined instructions. An AI agent may determine how to achieve an objective and dynamically exercise delegated authority to do so.

Increasingly, the questions become ‘What are you authorised to do, for what purpose, under what circumstances, for how long, and can I stop you?’

Cloud security is becoming the architecture of authority

Assurance must now move at cloud speed. Cloud configurations change constantly. Identities and permissions are created dynamically. Infrastructure is deployed through code. Vulnerabilities emerge continuously. Data moves between services and jurisdictions. AI agents may increasingly initiate actions at machine speed and scale.

Yet many organisations continue to demonstrate control through annual audits, quarterly reviews, point-in-time penetration tests and spreadsheets assembled for governance committees.

The next stage of cloud transformation requires a shift from periodic assurance towards continuous evidence and real-time assurance. Collecting signals from cloud platforms, identity systems, security controls, configuration, data controls and AI activity, then translating them into an authoritative view of operational risk on demand.

The objective should be a continuously maintained chain between business requirement, policy, technical control, operational evidence and risk. If excessive privilege appears, a workload changes jurisdiction, an AI agent exceeds its authority or a critical control stops operating, the organisation should understand the resulting change in exposure rapidly.

AI makes this simultaneously more necessary and more achievable. It introduces systems capable of operating at machine speed/scale and can also help correlate evidence and identify control drift much faster than traditional manual assurance.

The principle is straightforward: machine speed operations require machine speed assurance.

Concentration has become a Board-level risk

An enterprise may appear diversified across hundreds of suppliers, yet discover that many depend on the same hyperscaler, identity provider, region, software ecosystem or underlying service. The visible supply chain may therefore be considerably more diverse than the infrastructure beneath it.

Running everything twice is rarely economically or operationally sensible. Understanding where concentrations exist, the consequences of failure and the options available when strategic dependencies become unacceptable is far more important.

Sovereignty is no longer simply about where data sits

Where is the control plane? Who can administer the service? Where are encryption keys controlled? Which jurisdictions can compel access? What software supply chains underpin the service? Can functionality or access be withdrawn remotely? And increasingly, whose AI model is processing the information and what dependencies does that create?

This does not mean abandoning hyperscale cloud. Its advantages remain compelling. It means understanding precisely what strategic dependencies have been accepted in exchange for those benefits.

Then AI arrived, with a credit card

AI accelerates nearly every one of these issues. Where cloud gave organisations elastic computing, generative and agentic AI give software the ability to consume compute, data and services at machine speed. That creates both security and economic consequences.

Security, FinOps and AI governance increasingly converge around one strategic question: What authority are we granting, what is consuming it, and what business value are we receiving in return?

From cloud first to control first

None of this suggests cloud transformation has failed. Quite the opposite. Cloud has become so successful that it is disappearing into the fabric of how a modern org operates. That makes the next transformation fundamentally different.

The organisations best positioned for the future will not necessarily be those consuming the greatest number of cloud or AI services. They will be those capable of changing provider, model and technology without continually rebuilding their governance around them.

That requires architectures in which identity, policy, data access, telemetry, cost controls, AI authority and assurance can be governed consistently across environments in real-time.

For the CISO, the strategic objective is therefore changing. It is no longer simply to secure the cloud. It is to create a digital operating environment in which the enterprise can exploit cloud, AI and whatever follows without surrendering visibility, resilience, economic discipline or control, while continuously demonstrating that those controls remain effective.

The first cloud transformation was about where technology ran. The next will be about who, or what, is allowed to run the business and whether the organisation can prove that it remains in control, on demand.