Global IaaS Providers Tenant Security Controls

The Market Compass assesses global IaaS providers, including IaaS-adjacent PaaS services, with a specific emphasis on the capabilities that help tenants use cloud services securely and in compliance. IaaS is positioned as a key enabler of digital transformation by providing rapid access to advanced technologies without capital expenditure, but real-world adoption typically occurs within hybrid IT models that combine cloud and on-premises services. While early IaaS adoption focused on “born in the cloud” applications, current enterprise needs center on migrating and modernizing business-critical workloads, where security and compliance have become the primary constraints on growth.

A central theme is the shared responsibility model: providers secure the underlying infrastructure, while tenants remain responsible for configuration and control of everything above it, including networks, operating systems, middleware, applications, and compliance with data-processing laws. Many cloud incidents are attributed to tenant misconfiguration, increasing the importance of tools that prevent, detect, and remediate control gaps. The report highlights major business risks—business continuity loss, data breaches, and compliance failure—and argues that hybrid delivery increases management complexity, requiring better integrated controls across cloud and non-cloud environments.

The report expects market evolution toward greater transparency of provider controls for auditability, tighter integration with enterprise GRC and identity governance, industrialized confidential computing to protect data during processing, true multi-cloud/hybrid management, and AI/ML-driven autonomous security and compliance. It defines inclusion criteria based on multi-region delivery including EU/EEA availability, and compares vendors across security, interoperability, usability, deployment, and market standing, while also calling out “outstanding” vendors for specific capability areas such as tenant security breadth, container security, confidential computing, multi-cloud security management, autonomous security, and security/compliance services.

• Global-scale services in scope are available in the EU/EEA and delivered from data centers in the UK/EU/EEA plus either USA/Canada or Asia Pacific.
• Only around 4% of enterprise workloads have been moved to the public cloud.
• The potential market over the next five years is estimated at over $1 trillion according to IBM estimates.
• Major cloud-related business risks highlighted are loss of business continuity, data breaches, and regulatory compliance failure.
• Most reported cloud-related cyber incidents have been due to tenant misconfigurations.
• AWS services are delivered from 25 regions with 5 more announced and include 80 availability zones and 5 local zones.
• Google Cloud Platform operates 73 availability zones across 24 regions with further expansion planned in multiple geographies.
• IBM Cloud IaaS platform and services are delivered from over 60 data centers in six regions with 18 availability zones.
• OVHcloud operates 30 data centers globally, including 18 in Europe and 7 in Canada.
• In January 2021, OVHcloud obtained the SecNumCloud qualification from ANSSI.

• “The responsibility for security and compliance when these services are used is shared between the tenant and the CSP.”
• “The majority of reported cloud related cyber incidents have been due to misconfigurations of the services by the tenant.”
• “The limiting factor in all of these use cases is becoming security and compliance.”
• “Most organizations are now using a hybrid IT services delivery model where the use of multiple cloud services is integrated with business-critical services that are delivered in other ways.”
• “In these industries it [is] essential to be able to prove the existence and effectiveness of controls to demonstrate compliance.”
• “This needs to be done in a way that allows an organization using the service to map both their own controls and the controls in the service to their compliance obligations.”
• “Data is considered to be at risk at three points: during transfer, during storage and during processing.”
• “Currently these techniques exist but are either impractical or difficult to implement.”
• “An ideal solution would be a common management platform that covers all the cloud and on-premises services and components.”
• “Expect more CSPs to develop similar offers.”