Module 10 · Multi-Cloud — The Complexity Tax 🔒

Multi-cloud was sold as “avoid vendor lock-in.” In practice, multi-cloud means carrying the attack surface of every cloud you use. Each cloud has its own IAM, its own security tools, its own event schema, its own corner cases. Security teams manage complexity N times instead of once. This module closes the Cloud Mindset track by addressing the tax of multi-cloud.

Why this happens

• Acquisitions inherit workloads on different clouds
• Different teams choose based on skill or preference
• Specific services only on specific clouds (AWS for breadth, GCP for BigQuery, Azure for M365 integration)
• Region availability / pricing / compliance drives splits
• Vendor-negotiation leverage (whether achieved or not)

Reality: most “multi-cloud” organizations are single-cloud-primary with 10-20% in secondary clouds. The 10-20% carries disproportionate operational cost.

Security costs of multi-cloud

Per-cloud skillset

AWS IAM ≠ Azure RBAC ≠ GCP IAM. Each has syntactic and semantic differences. Security engineers need depth in each. One organization’s AWS expertise may be weak on Azure.