Unlocking the benefits of public cloud IaaS Barracuda Networks Research results May 2017 Barracuda Networks - research results

Demographics 1,300 ITDMs from organisations using public cloud Infrastructure as a Service (IaaS) were interviewed in April and May 2017, split in the following ways... …respondent country …organisation size …organisation sector Figure D1: Analysis showing respondent country (1,300 respondents) Figure D2: “How many employees does your organisation have in your country?” Asked to all respondents (1,300 respondents) Figure D3: “Within which sector is your organisation?” Asked to all respondents (1,300 respondents) Barracuda Networks - research results

Five areas of interest: 1:. Public cloud infrastructure 2: Five areas of interest: 1: Public cloud infrastructure 2: Background of public cloud 3: Public cloud security 4: Challenges with public cloud 5: Benefits of public cloud Please note that due to rounding some charts may not add up to 100% Barracuda Networks - research results

1: Public cloud infrastructure Barracuda Networks - research results

Public cloud IaaS providers Microsoft Azure is the most likely (57%) public cloud IaaS provider being used by respondents’ organisations Amazon web services (48%) and Google Cloud platform (47%) are used by just under half Respondents in the US are more likely (66%) to use Microsoft Azure than those in other regions, whereas those in APAC are more likely (64%) to say that Google Cloud Platform is used Which providers do respondents see as having the best data security? Figure 1: “Which of the following public cloud Infrastructure-as-a-Service (IaaS) providers are your organisation using?” Split by respondent region, asked to all respondents (1,300 respondents) Barracuda Networks - research results

Best public IaaS data security Just under two in five (37%) respondents believe that Microsoft Azure has the best public cloud IaaS security offering Around one in five say the same for Google Cloud Platform (20%), IBM Bluemix (20%) and Amazon Web Services (18%) Amazon Web Services is the second most likely public cloud IaaS to be used (figure 1), despite fewer respondents feeling it has the best data security when compared to its main competitors Which drivers are public cloud IaaS providers successfully meeting? Figure 2: Analysis of respondents who feel that the public cloud IaaS providers above have the best offering for data security, asked to all respondents (1,300 respondents) Barracuda Networks - research results

Meeting customer needs Only 51% of respondents believe that their public cloud IaaS provider completely successfully offers strong protection of access to applications in the cloud A similar proportion report the same for having strong protection of applications in the cloud (50%) or strong protection of data in the cloud (49%) Around half or more are not completely satisfied that their public cloud IaaS provider is fully meeting each of these areas, suggesting that there is still plenty of room to improve the way these partnerships work Has the perception of public cloud improved over the last five years? Figure 3: Analysis of respondents who feel that their organisation’s public cloud IaaS provider has successfully met the areas above, asked to all respondents (1,300 respondents) Barracuda Networks - research results

Trusting public cloud Almost two thirds (64%) of respondents report that they trust public cloud more than they did five years ago, while around three in ten (31%) say that it has stayed the same (figure 4) The level of trust in APAC has increased more significantly (72%), with those in EMEA being less likely (58%) to report a trust increase (figure 5) Trust has increased for the majority, despite a large proportion not having their security needs completely met (figure 3) Figure 4: Analysis of respondents’ level of trust regarding public cloud (as a whole) changing over the last five years, asked to all respondents (1,300 respondents) Figure 5: Analysis of respondents who say that their level of trust of public cloud has increased over the last five years, split by respondent region, asked to all respondents (1,300 respondents) Barracuda Networks - research results

2: Background of public cloud Barracuda Networks - research results

Infrastructure in the public cloud On average, respondents’ organisations have 39.40% of their infrastructure in the public cloud, with this set to increase to 68.84% in the next five years Trust in public cloud overall has increased (figure 5) and this looks to be reflected in organisations’ continued use in the future Respondents in the US (43.79%) and in APAC (42.35%) report a higher current proportion of public cloud in their organisations’ infrastructure, on average Respondents from organisations in the public sector (32.37%) report lower proportions on average Figure 6: Analysis of the average percentage of respondents' organisations' infrastructure running in the public cloud, asked to all respondents (1,300 respondents) Figure 7: Analysis of the average percentage of respondents' organisations' infrastructure running in the public cloud currently, split by respondent region and organisation sector, asked to all respondents (1,300 respondents) Barracuda Networks - research results

Use of public cloud Figure 8: “What does your organisation use the public cloud for?” Asked to all respondents (1,300 respondents) Figure 9: Analysis of respondents who say that their organisation uses public cloud for data storage, split by organisation sector, asked to all respondents (1,300 respondents) Slightly more than four in five (83%) respondents report that their organisation uses public cloud for data storage, while, around three in five say the same for data recovery (62%) (figure 8) Data storage is more likely (91%) to be a cloud usage for those in the manufacturing and production sector, with this being less likely in the public (76%) and media, leisure and entertainment (72%) sectors (figure 9) Barracuda Networks - research results

Internal and external applications Just over three in five (63%) respondents report that their organisation only or mostly run external applications in the public cloud Running external applications is the more likely use of public cloud, however with public cloud usage expected to increase (figure 6), there could be more usage for internal applications in the future What is the reason for using public cloud? Figure 10: Analysis of respondents who say that their organisation uses public cloud for mostly or only internal or external applications, asked to all respondents (1,300 respondents) Barracuda Networks - research results

Purpose of public cloud Four in ten (40%) respondents say that their organisation uses public cloud to expand their services and replicate it across multiple regions Three in ten (30%) state that they only migrate selected services to public cloud while running the rest in their private datacentre Public cloud has mixed purposes, suggesting that there could be different benefits to be seen, depending on how organisations choose to use it How many public cloud providers does each organisation use? Figure 11: “Which of the following best describes your organisation's use of public cloud?” Asked to all respondents (1,300 respondents) Barracuda Networks - research results

Number of public cloud providers On average, respondents cite that their organisation uses three public cloud service providers (figure 12) Of those who use more than one, the most likely reasons for doing so are that different providers have different strengths (63%) and that it increases security (51%) In addition, one third (33%) of these respondents believe that no one provider can offer them everything they require from the cloud (figure 13), which suggests that there could be a lack of awareness of the offerings that exist in this space or that providers don't know what the market wants …public cloud service providers being used, on average 3… Figure 12: “How many public cloud service providers does your organisation use in total currently?” Asked to all respondents (1,300 respondents) Figure 13: “Why does your organisation use more than one public cloud service provider?” Asked to respondents whose organisation uses more than one public cloud service provider (907 respondents) Barracuda Networks - research results

Reasons for using more than one provider A third (33%) of those using more than one provider think that no single one can give them everything they require This is more likely to be cited by respondents from organisations in the media, leisure and entertainment (41%) and financial services (39%) sectors These sectors could be a target for a provider who can show that they help their customers to use fewer providers How much are organisations spending on public cloud? Figure 14: Analysis of respondents who say that their organisation uses more than one public cloud provider as no one provider can offer them everything they require, split by organisation sector, asked to respondents whose organisation uses more than one public cloud service provider (907 respondents) Barracuda Networks - research results

Public cloud expenditure Figure 15: Analysis of the average percentage of respondents' organisations' annual IT budget spent on public cloud, asked to all respondents (1,300 respondents) Figure 16: “What is your organisation's preferred payment option when considering its public cloud?” Asked to all respondents (1,300 respondents) Respondents report that 22.46% of their organisation’s annual IT budget is spent on public cloud, on average, with this being higher (25.42%) amongst those in APAC (figure 15) Almost two in five (38%) respondents report that their organisation’s preferred public cloud payment method is based on usage, while slightly fewer (28%) say it’s based on BYOL (figure 16) Public cloud providers will need to be flexible with their payment options to ensure that they cater for all their customers’ needs Barracuda Networks - research results

3: Public cloud security Barracuda Networks - research results

Confidence in moving to the public cloud Only just over half (52%) of those surveyed felt totally confident that their organisation’s move to the public cloud was secure, with this being lower (43%) for respondents in EMEA (figure 17) Respondents from organisations in the media, leisure and entertainment sector are the least likely (28%) to have had total confidence in the move (figure 18), which could explain why they are less likely to be storing data in the public cloud (figure 9) Figure 17: Analysis of respondents who are totally confident that their organisation’s migration to the public cloud was secure, split by respondent region, asked to all respondents (1,300 respondents) Figure 18: Analysis of respondents who are totally confident that their organisation’s migration to the public cloud was secure, split by organisation sector, asked to all respondents (1,300 respondents) Barracuda Networks - research results

Adding security to public cloud Around three in five (62%) respondents say that their organisation has added additional security solutions to their public cloud to protect it during access Additionally, a further 34% cite that they have not yet, but plan to in the future Respondents in the US (67%) and APAC (66%) are more likely to have already added these security solutions, which should reinforce their confidence in the public cloud (figure 17) Which additional security solutions have been added? Figure 19: “Has your organisation added any additional security solutions to your public cloud to protect it during access?” Split by respondent region, asked to all respondents (1,300 respondents) Barracuda Networks - research results

Security solutions being used Nearly two thirds (64%) of those who have added additional security solutions say that they route their branch locations’ traffic to their headquarters and then pass it to the cloud using a dedicated MPLS circuit in a central location (figure 20) The vast majority (95%) of respondents report that they see a need for additional security solutions to be added to their public cloud to protect it during access (figure 21) The additional security solutions currently being used by organisations (figure 20) are also the most likely to be those that are preferred by the market as a whole (figure 21), suggesting that organisations are likely to be using their preferred solutions already Figure 20: “Which of the following additional security solutions has your organisation added to your public cloud to protect it during access?” Asked to respondents whose organisation has added additional security solutions to its public cloud to protect it during access (811 respondents) Figure 21: “What would be your organisation's preferred additional security solutions to add to your public cloud to protect it during access?” Asked to all respondents (1,300 respondents) Barracuda Networks - research results

Understanding public cloud security responsibilities Just over seven in ten (72%) respondents report that they fully understand the public cloud security responsibilities of both their organisation and IaaS provider However, only 61% of those from EMEA report full understanding – far less than those in the US (84%) and APAC (78%) Furthermore, those in EMEA are less likely to have added additional security solutions (figure 19), which means that they could be leaving themselves open to cybersecurity issues due to not knowing who is responsible for what What do respondents think IaaS providers are responsible for securing? Figure 22: “Do you understand the public cloud security responsibilities of both your organisation and your IaaS provider?” Split by respondent region, asked to all respondents (1,300 respondents) Barracuda Networks - research results

IaaS provider responsibility Nearly all (99%) respondents believe that their IaaS provider is responsible for some element of security… …when asked to those who have an understanding of the cloud security responsibilities of both their organisation and IaaS provider Around seven in ten (71%) cite that their IaaS provider is responsible for securing customer data in the public cloud, while around two thirds believe the same for applications (66%) or operating systems (65%) More than a quarter do not have a complete understanding of the public cloud security responsibilities of both their organisation and IaaS provider (figure 22), yet the vast majority are leaving major security responsibilities to their provider, which could leave gaps in public cloud security How does this compare by region? Figure 23: “Which of the following do you think your IaaS provider is responsible for securing?” Asked to respondents who have an understanding of the cloud security responsibilities of both their organisation and IaaS provider (1,279 respondents) Barracuda Networks - research results

IaaS provider responsibility by region Figure 24: “Which of the following do you think your IaaS provider is responsible for securing?” Split by respondent region, asked to respondents who have an understanding of the cloud security responsibilities of both their organisation and IaaS provider (1,279 respondents) Respondents from EMEA are less likely to consider their organisation’s IaaS provider to be responsible for customer data in the public cloud (64%) and applications in the public cloud (61%) Securing operating systems in the public cloud is more likely (72%) to be considered a responsibility for the IaaS provider by those in APAC Barracuda Networks - research results

4: Challenges with public cloud Barracuda Networks - research results

Restrictions to the public cloud Around seven in ten (71%) of those interviewed state that security concerns restrict their organisation’s migration to the public cloud Despite a lack of understanding over security responsibilities (figure 22), those in EMEA are the least likely (64%) to report security concerns restricting migration, which could highlight a lack of understanding In addition, the vast majority (89%) of respondents believe that there are threats to their organisation’s public cloud infrastructure Despite these threats being in mind, the use of public cloud is still set to increase (figure 6), suggesting that organisations are willing to see past these concerns Figure 25: Analysis of respondents who say that their security concerns restrict their organisation’s migration to the public cloud, split by respondent region, asked to all respondents (1,300 respondents) Figure 26: “Which of the following are threats to your organisation’s public cloud infrastructure?” Asked to all respondents (1,300 respondents) Barracuda Networks - research results

Concerns over the public cloud Just over nine in ten (91%) surveyed IT decision makers say that they have concerns over their organisation’s use of public cloud, with the most likely (54%) being the impact of cyber-attacks. In addition, around a quarter of respondents report that they are concerned over the lack of an expert partner to work with for cloud security (28%) or a lack of in- house skills to maintain the cloud (25%) (figure 27) Over half (56%) of respondents’ organisations have been targeted by a cyber-attack and three in ten (30%) expect this to happen in the future (figure 28), highlighting the importance of having the right security in place (figure 20) Average attacks: 5 Figure 27: “Which of the following concerns do you have regarding your organisation’s use of public cloud?” Asked to all respondents (1,300 respondents) Figure 28: “Has your organisation ever been targeted by a cyber-attack?” Asked to all respondents (1,300 respondents) Barracuda Networks - research results

Impacts of cyber-attacks Of respondents whose organisation has been targeted by a cyber-attack, the vast majority (84%) admit that their organisation felt an impact as a result More than three in ten say that customers (35%) or employees (32%) lost faith in their cyber security Around one in five report a temporary closure of the business (21%) or a loss of customers altogether (17%) as impact Considering the majority have experienced cyber- attacks (figure 28), these threats should be of huge concern to organisations and security needs to be a priority What impacts have been seen due to using more than one public cloud service provider? Figure 29: “Which of the following have happened as a result of a cyber-attack in your organisation?” Asked to respondents from organisations that have been targeted by a cyber-attack (731 respondents) Barracuda Networks - research results

Using multiple providers Of respondents whose organisation uses more than one public cloud service provider, the majority (86%) report experiencing negative impacts as a result A more complex IT environment (47%) or higher IT costs (46%) are the most likely negative impacts Around a quarter also say the same for poor protection of applications in the cloud (26%) or access to applications in the cloud (25%) On average, respondents are using three providers (figure 12), however, if they can reduce this number and use one reputable provider, then they could avoid these impacts Are organisations storing sensitive data in the public cloud? Figure 30: “What negative impacts have there been on your organisation due to using more than one public cloud service provider?” Asked to respondents from organisations that use more than one public cloud service provider (907 respondents) Barracuda Networks - research results

Storing sensitive data Figure 31: “Which of the following types of sensitive data does your organisation store in the public cloud?” Asked to respondents whose organisation stores data in the public cloud (1,083 respondents) Figure 32: Analysis of respondents who say that their organisation stores bank details in the public cloud, split by respondent region, asked to respondents whose organisation stores data in the public cloud (1,083 respondents) Of respondents whose organisation stores data in the public cloud, around nine in ten (89%) say that their organisation stores sensitive data in the public cloud, with over half (56%) who report that their organisation stores personal employee data in the public cloud (figure 31) Only slightly fewer say the same for customer (45%) or employee (39%) bank details, although this is likely to be higher in APAC (53% and 51%) (figure 32), which could be due to an increased level of confidence in public cloud within the region (figure 17) Barracuda Networks - research results

5: Benefits of public cloud Barracuda Networks - research results

Drivers for choosing public cloud providers Over half of respondents report that easy integration with legacy technology (57%) or strong protection of applications in the public cloud (54%) were important drivers when choosing a public cloud IaaS provider to use in their organisation, while slightly less than half (46%) said the same regarding strong protection of access to applications in the public cloud (figure 33) Those in APAC were more likely to cite a strong protection of applications (60%) or access to applications (53%) in the public cloud as drivers (figure 34), suggesting that they were more likely to look into the security offerings of different providers and giving confidence to their migration (figure 17) Figure 33: Analysis of respondents’ organisations’ ten most likely important drivers for choosing their public cloud IaaS provider(s), asked to all respondents (1,300 respondents) Figure 34: Analysis of respondents who say that strong protection of applications/access to applications was a driver for their organisations choosing their public cloud IaaS provider(s), asked to all respondents (1,300 respondents) Barracuda Networks - research results

Benefits of public cloud migration Nearly all (99%) respondents report that their organisation has seen benefits as a result of moving to the public cloud, with just over half reporting that their organisation has seen greater scalability (52%) and reduced IT expenditure (52%) Respondents also report seeing improved security of applications (44%) or access to applications (39%) – one of the key drivers when choosing providers (figure 33) Respondents in APAC are most likely to say that their organisation has seen improved security of applications (55%) or access to applications (48%) These respondents were also the most likely to cite this as a driver to choosing their provider (figure 34), suggesting that their choice of provider was worthwhile Figure 35: “What benefits has your organisation seen as a result of moving to the public cloud?” Asked to all respondents (1,300 respondents) Figure 36: Analysis of respondents who say that improved security of applications/access to applications is a benefit of their organisation moving to the public cloud, asked to all respondents (1,300 respondents) Barracuda Networks - research results

Future benefits of public cloud Average ROI: 29.26% Figure 37: “Approximately, what positive ROI has your organisation seen from moving to the public cloud?” Asked to all respondents (1,300 respondents) Figure 38: “What benefits do you think your organisation could see from using fewer public cloud service providers?” Asked to respondents whose organisation uses more than one public cloud service provider (907 respondents) On average, respondents report that their organisation has seen a positive ROI of approximately 29.26% from moving to the public cloud This is on top of the non-financial benefits seen by organisations (figure 35) and suggests that investment is justified (figure 15) Of respondents whose organisation uses more than one public cloud provider, over nine in ten (93%) say that their organisation would see benefits from using fewer service providers, with better availability being the most likely (47%) Organisations are already seeing benefits (figure 35) and a positive ROI (figure 37) from the public cloud, however, even greater benefits could be seen if they use fewer providers (figure 12) Barracuda Networks - research results

In summary… Respondents’ organisations are most likely (57%) to use Microsoft Azure as their public cloud IaaS provider Amazon web services (48%) and Google Cloud platform (47%) are used by just under half Organisations use three public cloud service providers and spend 22.46% of their IT budget on this area, on average Of those whose organisation uses more than one public cloud service provider, 86% admit experiencing negative impacts as a result Only just over half (52%) of those surveyed felt totally confident that their organisation’s move to the public cloud was secure Yet, around four in five (83%) report that their organisation uses public cloud for data storage Of these, 89% admit that their organisation stores sensitive data in the public cloud Only 51% of respondents believe that their public cloud IaaS provider completely successfully offers strong protection of access to applications in the cloud However, 64% state that they trust public cloud more than they did five years ago Around seven in ten (71%) respondents say that security concerns restrict their organisation’s migration to the public cloud Almost nine in ten (89%) cite that there are threats to their organisation’s public cloud infrastructure and 56% have been targeted by a cyber-attack However, 99% of respondents state that their organisation has seen benefits as a result of moving to the public cloud On average, a positive ROI of 29.26% has been seen Furthermore, of respondents whose organisation uses more than one public cloud provider, 93% believe that they would see benefits from using fewer service providers Barracuda Networks - research results

Unlocking the benefits of public cloud IaaS Barracuda Networks Research results May 2017 Barracuda Networks - research results