Connecting cloud maturity to business success
To be truly cloud-mature, organizations must scale key infrastructure and security practices across their entire estate.
Read the study from Forrester Consulting: Cloud Maturity Drives Business Success
This site presents key insights revealed in the 2024 State of Cloud Strategy Survey, commissioned by HashiCorp and conducted by Forrester Consulting. Forrester surveyed nearly 1,200 technology practitioners and decision makers in companies with more than 1,000 employees in a variety of industries around the world, drawn from random samplings as well as the HashiCorp opt-in contact database. Note: Total percentages may not equal separate values due to rounding.
Executive summary
The fourth annual HashiCorp State of Cloud Strategy Survey tackles the critical importance of cloud maturity: the ability to scale key infrastructure and security practices across the organization — and the business impact of doing so.
Out of nearly 1,200 respondents around the world, only 8% qualified as highly mature. In this “haves” vs. “have nots” world, a few trailblazers are already enjoying the fruits of cloud maturity while many others continue to struggle. Highly cloud-mature organizations are making more and bigger cloud investments, waste less of that spending, and get a better return while speeding development and improving security.
Why? High-maturity organizations cope better with common cloud challenges:
When faced with the ongoing shortages of skilled technical staff, they’re scaling platform teams and internal development platforms to maximize the impact of staff expertise.
While others struggle with cloud security, they’re using cloud operating principles to strengthen their security posture.
They’re leading the way toward experimenting with generative AI to automate cloud infrastructure and security.
Our previous State of Cloud Strategy surveys describe the trends for organizations entering the multi-cloud era (2021) and the resulting business value (2022). Last year's surveyintroduced the concept of operational cloud maturity — defined not by the amount of cloud usage or the number of clouds used, but by how organizations were adopting, standardizing, and scaling best practices.
For 2024, we again commissioned Forrester Consulting to perform the survey and collaborate with us to refine our cloud maturity model to focus on the impact of scaling key practices across the entire organization. The results demonstrate that achieving true cloud maturity is difficult but more than worth the effort. (For more on the survey methodology and the cloud maturity model, see the section on Cloud maturity is elusive but valuable and the Forrester study: Cloud Maturity Drives Business Success
Numbers to remember
Cloud maturity
The cloud today
Looking ahead
Cloud maturity is elusive but valuable
For 2024, we refined our cloud maturity model to better reflect the actual state of organizations in their cloud journey. Unlike the relative, points-based model we used in 2023, this year’s gated, logic-based maturity model focuses on the prevalence of 21 key practices in cloud infrastructure and security:
Cloud maturity is rare
In 2024, only 8% of respondents qualified as highly mature. To be considered highly mature, most of their teams had to be using all the adopting (basic) and standardizing (intermediate) best practices across both Infrastructure and Security Lifecycle Management, and the org had to be at least starting to use scaling (advanced) practices. Organizations that had not spread their use of even basic best practices were considered low maturity (33%), while everyone in between (59%) were categorized as medium maturity. We took this matrixed approach because both security and infrastructure play a critical role in organizational success. Growing maturity in one area cannot succeed without growing maturity in the other. (Last year, the top-scoring 25% of respondents were considered high maturity, the lowest-scoring quartile were low maturity, and everyone in between was medium maturity.)
Cloud maturity is powerful
Highly cloud-mature organizations invest more in the cloud (71% boosted cloud spending last year, compared to 60% of low-maturity orgs), but they get a lot for their efforts, including stronger security, faster cloud development, agile provisioning, and the ability to attract and retain talented practitioners. High-maturity orgs were almost 20 percentage points more likely to say they have the right amount of staff expertise than were low-maturity orgs.
To what extent has your organization gained the following benefits from its cloud infrastructure strategy?
High-maturity orgs are also far more likely to have standardized their cloud operations via platform teams (67% vs. 31% for low-maturity orgs). And they’re at the forefront of looking to genAI to support their cloud infrastructure and security objectives (85% vs. 67% of low-maturity orgs). Perhaps that’s why 89% of high-maturity organizations say their cloud strategy has helped them achieve their business goals, compared to just 55% of low-maturity orgs and 68% of all respondents.
Of course, cloud maturity isn’t distributed evenly around the globe. Only 5% of respondents in Europe/Middle East/Africa were highly mature, while 12% of North American respondents qualified. Looked at by country, Singapore, the US, Brazil, Canada, and India had the highest percentage of high-maturity respondents, while South Korea, France, Mexico, the UK, and Australia had the lowest (among countries with a statistically significant number of respondents).
Highly cloud-mature organizations invest more in the cloud, and they get a lot for their efforts, including stronger security, faster cloud development, agile provisioning, and better staff retention.
Cloud spending keeps rising — but cloud waste persists
Almost two-thirds (66%) of respondents said they increased their cloud spending in the last year, up from 56% in 2023. Notably, 71% of highly mature organizations boosted cloud spending compared to 60% of low-maturity organizations.
Using your best estimate, how has your organization's spending on cloud infrastructure changed over the last 12 months?
Even as organizations pour money into the cloud, some of it is going down the drain. 91% of respondents report wasted cloud spending.
More than three-quarters (78%) of respondents are spending that money on multi-cloud deployments (or are planning to do so), and more than a third (36%) are expanding their multi-cloud infrastructure. These findings solidify the notion that multi-cloud deployments are the most pervasive choice, while many orgs continue to maintain on-premises datacenters and private clouds.
Which of the following describes your organization's multi-cloud infrastructure strategy?
Even as organizations increase cloud spending year over year, they continue to struggle with how they spend it. More than 9 out of 10 respondents (91%) report waste in their cloud spend (down slightly from 96% in 2023). The three most-commonly cited contributors to cloud waste were lack of needed skills, overprovisioning of resources, and idle or underused resources — the same trio of issues that topped the list in 2023. The order has changed, however, with skills shortages taking the top spot this year, cited by 41% of respondents.
Which of the following factors contribute to avoidable cloud spend, also known as cloud waste, at your organization? (Important/Very important)
Another potential contributor to cloud waste is that only two-thirds (66%) of respondents are incentivizing cloud cost optimization with showback or chargeback processes for their business units. Not surprisingly, that percentage jumps to 85% at highly cloud-mature organizations, compared to just 59% at low-maturity orgs.
Cloud maturity drives business success
As in previous years, the overwhelming majority (90%) of respondents say their cloud infrastructure strategy has already or is about to help them achieve their business goals. But high-maturity organizations were much more likely (89%) to already be reaping cloud benefits, compared to just 55% of low-maturity respondents and 68% overall.
Has your organization’s cloud infrastructure strategy helped it achieve its overall business goals?
Security (81% important or very important) is the most commonly cited factor determining cloud infrastructure success, followed by infrastructure scaling (75%), uptime and availability (75%), budget (74%), and staffing/skill levels (73%). The prioritization is due to the ever-increasing complexity of interconnected services and third-party applications, coupled with the challenge of secret sprawl and the lack of full Security Lifecycle Management.
How important are the following factors in determining the success of your organization's cloud infrastructure strategy?
But while security sits at the top of the list for both high- and low-maturity organizations, the rest of their top five differ significantly. High-maturity firms are more focused on getting the right people on the right projects, orchestrated through a centralized platform team, factors they rank third and fourth, respectively. Low-maturity respondents were more worried about important but tactical issues like budgets and regulatory requirements.
The big question, of course, is exactly what benefits organizations are getting in the cloud. While we didn’t see big deltas between the 11 options we presented (68% - 73%), stronger security and better visibility into infrastructure topped the list. While the answers remained closely bunched, high-maturity orgs were much more likely to get any given benefit.
Security is the #1 factor high-maturity organizations use to assess cloud success and the #1 one benefit they say they get from their cloud program.
In addition to being the top cloud infrastructure success factor, security was also the most-cited benefit resulting from the cloud strategy at high-maturity orgs, rising from third place in last year’s survey. For low-maturity respondents, improved uptime and availability topped the list. Critically but not surprisingly, highly mature respondents were more likely to get all of these benefits.
To what extent has your organization gained the following benefits from its cloud infrastructure strategy? (% having seen these benefits shown)
Platform teams play an increasingly critical role
While more and more organizations are realizing the importance of centralizing and standardizing key functions and processes in the form of a platform team, most are still early in this journey. Some 95% of respondents say they have at least started the process of establishing a platform team, but less than half (42%) rely on their platform teams to fully standardize cloud operations throughout the organization. The small segment of highly mature orgs are more than twice as likely to say they have standardized their operations this way (67%), compared to 31% of low-maturity respondents.
To what extent does your organization utilize a platform team to manage its cloud infrastructure strategy and centralize/standardize developer consumption of cloud services?
Organizations that don’t employ a platform team often instead distribute responsibility for cloud infrastructure across the company, an approach cited by almost half (46%) of respondents who don’t have a platform team. But this low-maturity, every-team-for-itself approach foregoes the significant benefits of standardization — sharing and reusing of code, comprehensive policy enforcement, fewer images to maintain, and so on.
The leading barrier to platform teams? A lack of skills/staff (38%, up slightly from 36% in 2023). As noted later in the skills-shortages section, however, high-maturity orgs are flipping the script and relying on platform teams as a solution to skills shortages.
You said that your organization doesn't have a platform team in place to manage its cloud infrastructure strategy. Why is that?
The vast majority of organizations that do use platform teams rely on them to enable standardized and accelerated execution of many key functions, from standardizing cloud infrastructure strategy and building in security and compliance to risk management and tracking site reliability.
Choose the response that best describes how your organization's platform team manages each of the following practices
High-maturity orgs are much more likely to be standardizing on using platform teams to manage best practices.
Compared to low-maturity organizations, however, high-maturity orgs can be half again more likely more likely to be standardizing each practice.
Choose the response that best describes how your organization's platform team manages each of the following practices: (% begun to standardize this practice/fully standardized this practice)
For many organizations, deploying an internal developer platform (IDP) is the culmination of a platform team’s charter to standardize cloud infrastructure and security best practices. IDPs — pre-approved deployment environments incorporating all relevant governance and security policies — are increasingly finding homes in highly cloud-mature organizations where they help accelerate developer productivity.
While 43% of the limited number of high-maturity organizations claim to have deployed an IDP with robust features and adoption, only 20% of overall respondents say they have done so. That means a true IDP remains an aspirational goal for the vast majority of organizations — for example, just 14% of low-maturity organizations have deployed robust IDPs.
To what extent has your organization's platform team deployed an internal developer platform (IDP)?
Cloud maturity strengthens security
Done right, the cloud can help organizations bolster their security posture: stronger security remains the most commonly cited cloud benefit.
Has your organization’s cloud infrastructure strategy helped it achieve its overall business goals?
At the same time, of course, internal and external security remains a huge, multifaceted, and continuously evolving cloud concern. When asked to name their top five security threats, data theft (47%) topped the list (up from number two in 2023), followed by phishing (46%) and password/secrets leakage (45%). IoT attacks (29%), cryptojacking (27%), and state-sponsored attacks (26%) generated less concern.
The number one cloud benefit for highly mature organizations is stronger security.
What are the biggest threats that your organization faces when it comes to cloud security?
Internally, data/privacy protection (41%) is the most commonly cited security threat, followed by threat detection and remediation (39%), and cloud complexity (35%). These threats were followed by higher-level concerns, such as the ubiquitous lack of skills/staff (34%) and a poor security culture (34%). The order flips, though, when looked at by maturity level. For low-maturity organizations, the skills issue jumps to the number two position (40%) and remote work environments comes in at number four (35%). For high-maturity orgs, the skills issue (18%) doesn’t even make the top 10 for security threats, replaced by overprovisioned/issued access (34%).
What are the biggest threats from within your organization when it comes to cloud security? (Top 5 ranked)
Skills shortages remain critical
Previous State of Cloud Strategy surveys highlighted the ongoing shortage of skilled cloud staffers that has dogged enterprises for years, and the problem shows no signs of letting up. This year, almost two-thirds (64%) of respondents said they don’t have all the staff expertise they need to support their cloud infrastructure strategy. And while the problem is even worse for low-maturity organizations (71%), it also affects more than half of highly mature enterprises (52%).
Which of the following statements best describes the level of expertise held by staff members in your organization that are focused on accomplishing its cloud infrastructure objectives?
The cloud skills shortage is deep and broad. As noted above, for example, the skills shortage is the most commonly cited contributor to cloud waste, a key security concern especially for low-maturity firms, and the second factor keeping companies from establishing a platform team. Tellingly, highly mature organizations know the importance of having the right cloud skills — it’s their third most-cited cloud success factor, while it doesn’t make the top five for low-maturity respondents, who tend to worry more about budget issues.
Highly mature organizations know the importance of having the right cloud skills — it’s their third most-cited cloud success factor — while it doesn’t make the top five for low-maturity respondents.
Staffing issues may also be pushing enterprises toward increasing their use of automation tools. Three-quarters of respondents called automation tools important (36%) or very important (39%) to carrying out their cloud infrastructure strategy. And highly mature organizations better understand the need for automation tools, with more than half (54%) calling them very important, compared to less than a third (32%) of low-maturity companies.
How important are automation tools for your organization to operationalize its cloud infrastructure strategy?
According to survey respondents, consistent and automated tooling improves security (49%), efficiency (47%), flexibility (47%), and IT response speed (45%). The more organizations can automate their processes and workflows, the more their limited supply of skilled cloud staffers can focus on building competitive advantage instead of repetitive manual maintenance and management.
How has (or would) consistent and automated tooling contributed to your organization's cloud infrastructure strategy?
Finally, even as AI promises to address the skills shortage by automating operational tasks and processes (the most commonly cited AI use case and most important AI benefit), a lack of skills is the most commonly cited barrier keeping organizations from adopting generative AI for their cloud infrastructure strategy. (Interestingly in this context, AI-powered skills training was the fourth most-cited benefit.)
AI: Exciting but still experimental
With all the hype around generative AI, it should be no surprise that 95% of respondents are at least interested in using it to support cloud infrastructure and security. But these are still early days for AI: just 40% of respondents have actually implemented even rudimentary versions of the technology, while another 30% plan to do so in the next year. Once again, highly mature firms are taking a much more aggressive approach, with 85% implementing or planning to implement genAI compared to just 67% of low-maturity respondents.
To what extent is your organization using/planning to use generative AI (genAI) to support its cloud infrastructure objectives?
The most common AI use cases are low-hanging fruit such as the automation of operational tasks (47%), analyzing large data sets (43%), chatbots (43%), and natural language processing for internal use (39%). More complex AI use cases, like supporting real-time analytics or text-to-code queries, have yet to see as much uptake.
Highly mature firms are taking a much more aggressive approach to using AI to support cloud infrastructure, with 85% implementing or planning to implement it.
Across the board, however, high-maturity organizations are significantly more likely to use AI for almost all use cases. Several respondents noted that they were still searching for the right AI use cases: “We are sorting through the pieces of our organization, trying to find where genAI fits into the bigger picture,” said one Vice President of Technology at a North American media company.
For which of the following cloud infrastructure strategy use cases does your organization use genAI?
As AI adoption ramps up, it’s not too soon to ask what benefits these pioneers are getting. The top answers include better automation (47%), security (44%), customer experience (42%), skills training (41%), and code development (41%).
Which of the following are the most important benefits of using a genAI solution to augment your existing cloud infrastructure strategy?
Not everyone is getting those benefits yet, of course, for a variety of reasons. The most common factor holding back AI adoption is a lack of skills (33%), followed by data privacy concerns (31%), and difficulty scaling (27%). But organizations also cited a variety of concerns around AI’s readiness for prime time and a lack of compelling use cases.
Which of the following factors are preventing your organization from adopting genAI for its cloud infrastructure strategy?
To overcome those barriers, respondents are “creating teams of experts and specialists,” “offering reassurance and training” to workers, “collaborating with industry partners,” “prioritizing pilot projects to test the feasibility of genAI tools in real-world scenarios,” and “ensuring that genAI initiatives align with our strategic objectives.” To keep their AI efforts safe, many are also “drafting corporate policies on AI use” and “implementing data privacy protocols and encryption measures to … ensure compliance with regulations.”
Finally, while AI is already affecting how organizations consider the future of their infrastructure and security around the world, countries such as Australia (79%), the US (78%), and Japan (76%) lead the way.
Forrester's key findings and recommendations, maturity model, and methodology
Want to know more about the survey methodology and the maturity model? Want to see Forrester's key findings and recommendations on cloud maturity, security, skills shortages, and AI?
Read the study from Forrester Consulting: Cloud Maturity Drives Business Success