Moving everything to the cloud is not an IT strategy.

Let us be clear: the cloud offers considerable advantages.

For an SME, it can enable rapid service deployment, make remote working easier, provide access to shared infrastructure and open up technologies once reserved for large enterprises.

Microsoft 365 is an excellent example.

But moving to the cloud does not make IT responsibilities disappear.

They simply change in nature.

You still need to manage identities, secure access, define permissions, protect data, monitor configurations and plan for incidents.

You also need to understand the dependencies being introduced.

What happens when the internet connection fails?

When a cloud service becomes unavailable?

When an administrator account is compromised?

When subscription costs rise?

Or when a critical application becomes difficult to move to another platform?

Outsourcing infrastructure does not mean outsourcing responsibility for keeping it working.

This is probably one of the most persistent misconceptions.

The cloud can often reduce the initial investment in hardware. But it also turns some capital expenditure into recurring operating costs.

Take an SME with 30 employees.

Each user has several subscriptions: a collaboration suite, security, backup, a business application and possibly other services.

Add virtual machines, storage, network traffic, additional backups and a few managed services.

Individually, each amount may seem reasonable.

But added together over three or five years, those costs deserve a proper analysis.

Does that mean an on-premises server is always cheaper?

Absolutely not.

On-premises infrastructure also involves hardware, electricity, licences, maintenance, technical expertise, replacements and continuity solutions.

Simply comparing the price of a server with the cost of a cloud subscription makes no sense.

You need to compare the total cost of ownership over a defined period, with equivalent levels of availability, security and service.

In some scenarios, the cloud will clearly offer greater value.

In others, on-premises or hybrid infrastructure will make more financial sense.

And sometimes the price difference matters less than the operational requirements.

You still sometimes hear that a business keeping servers on site must be behind in its digital transformation.

I do not share that view.

Properly designed on-premises infrastructure can readily incorporate virtualisation, high availability, monitoring, automation, network segmentation and advanced cybersecurity mechanisms.

It can also meet requirements that are difficult to satisfy using remote services alone.

Consider a few practical situations.

An architectural practice working with large BIM models every day may benefit from keeping certain processing tasks and workspaces close to its users.

An industrial business that depends on machinery, controllers and specialist software may need local services that can continue operating even when connectivity is lost.

An SME using a legacy business application may face technical or financial constraints that make a cloud migration inappropriate.

That does not mean everything should remain on site.

It simply means a technical decision should address a real use case.

The modernity of infrastructure is measured not by its location, but by its ability to meet the business's needs.

Why should you have to choose a side?

For many Swiss SMEs, a hybrid architecture is worth considering.

A perfectly reasonable combination might include:

• Microsoft 365 for email, collaboration and office applications.
• On-premises infrastructure for certain business applications or processing that requires low latency.
• Independent backups, with off-site copies and restore tests.
• Centralised, secure identity management.
• Complementary cloud services for occasional or changing needs.
• Consistent monitoring across the whole environment.

This architecture can provide a useful balance of flexibility, performance, control over data and resilience.

But hybrid is not a magic solution either.

It introduces its own challenges: interconnections, security, synchronisation, dependencies and operational complexity.

A poorly designed hybrid architecture can become more expensive and harder to maintain than an entirely cloud-based one.

Once again, the aim is not to follow a trend.

It is to make the right trade-offs.

In Switzerland, data location, confidentiality and conditions of access are important issues for many businesses.

But beware of oversimplification.

Hosting data in a Swiss data centre does not automatically guarantee its sovereignty.

And using an international provider does not necessarily mean losing all control over your data.

The reality depends on the provider, contractual terms, administrative access, encryption, subcontractors and applicable jurisdictions, among other factors.

Businesses should ask practical questions:

Where are the data and their backups hosted?

Who can technically access them?

What contractual and technical safeguards are in place?

Can all the data be exported in a usable format?

What happens if you decide to leave the provider?

What are your compliance and retention requirements?

Sovereignty is not simply about choosing a country on a map. It is about understanding and controlling the dependencies associated with your data.

Another aspect is often overlooked in migration projects: the ability to reverse the decision.

At first, everything seems simple.

You adopt a platform, deploy its services, automate processes and train your teams.

Gradually, the business becomes dependent on particular features, interfaces and formats.

A few years later, changing provider can become a substantial transformation project.

With migration costs, application changes, potential interruptions and training needs.

This risk also exists with some proprietary solutions installed on premises.

The point is therefore not to reject major providers or proprietary technologies.

It is to plan ahead.

A sound architecture should be documented, allow data export, limit unnecessary dependencies and provide realistic exit scenarios.

The freedom to choose a solution today should not remove the ability to change it tomorrow.

'It is in the cloud, so it is secure.'

'It is on our premises, so nobody can access it.'

Both statements are misleading.

Misconfigured cloud infrastructure can expose sensitive information.

An inadequately maintained on-premises server can have critical vulnerabilities.

Conversely, both cloud and on-premises environments can achieve high levels of security when they are properly designed, operated and monitored.

What really makes a difference includes:

• Identity and privilege management.
• Network and system segmentation.
• Configuration hardening.
• Vulnerability and patch management.
• Incident detection and response.
• Backup protection.
• The quality of disaster recovery procedures.

Security does not rest on a logo, a subscription or a server's geographical location.

It rests on a structured, controlled approach that is regularly assessed.

When an SME is considering a major change to its infrastructure, I believe the discussion should start with business needs, rather than a supplier's catalogue.

These are the questions I consider essential:

1. Which applications are genuinely critical to the business?

2. How long can the business operate without those applications?

3. What are the data volumes, performance expectations and connectivity constraints?

4. What security, confidentiality and compliance requirements must we meet?

5. What will each scenario cost overall over three to five years?

6. Who will be responsible for administration, monitoring and service continuity?

7. How will we be able to change solutions if our needs evolve?

Only after answering these questions does it make sense to compare public cloud, private cloud, on-premises infrastructure or a hybrid architecture.

I am neither against the cloud nor in favour of keeping everything on premises.

I see the cloud as an excellent tool when it meets a clearly identified need.

Equally, I believe on-premises infrastructure still has an important role when it provides real operational, financial or strategic value.

And hybrid architectures can be particularly useful when designed as a coherent whole.

By contrast, migrating simply because 'everyone is moving to the cloud' is not a strategy.

An SME does not need the most fashionable technology.

It needs IT that performs well, is secure, has controlled costs and can support its development.

The best IT environment is neither the one with the most cloud services nor the one that keeps the most on-premises servers.

It is the one that best meets the business's needs, both today and tomorrow.

In my approach to IT infrastructure, I prioritise needs analysis, risk management and freedom of technology choice over the automatic adoption of any one solution.

Do you think the cloud has become a default choice, sometimes at the expense of a proper discussion about IT architecture?

#CloudComputing #ITInfrastructure #SMEs #Cybersecurity #DigitalTransformation