The Quiet Security Bill in a Cloud Migration

The migration business case is done: compute, storage, a licensing comparison, and a tidy savings curve. It was built by people who know infrastructure pricing well. It is missing the security bill.

Cloud does not remove security cost; it re-itemizes it. Identity and access design, logging that actually helps during an incident, key management, network controls, and the parallel run where you pay for two environments at once - these lines arrive after the migration is approved, wearing the costume of surprise.

Pricing them before you sign does not make the migration more expensive. It makes the decision honest.

TLDR

• The migration quote covers the platform; the security work is priced separately or not at all.

• Identity, logging and key management are the three lines most often missing.

• The parallel-run period doubles some costs; schedule it and end it deliberately.

• Skills are a real line: the team needs cloud security fluency, not just cloud fluency.

• Ask for the security bill as its own line item in every migration proposal.

The three lines that go missing

Identity is the first. Cloud security is mostly identity: who and what can touch each resource. Getting that right - roles, service accounts, joiners and leavers - is real design work, and it is in almost no migration quote.

Logging is the second. Turning on logs is cheap; having logs you can use in an incident - retained, centralized, searchable - is an ongoing line item that scales with volume. Key management is the third: someone must decide who holds the keys to encrypted data, and 'the cloud provider, by default' is a decision worth making on purpose.

The parallel run is a security window, not just a cost

Migrations include a stretch where old and new environments both run. The bill shows it as duplicated infrastructure. Security experiences it as doubled surface: two sets of firewall rules, two identity systems, and configuration drift between them.

Keep the parallel run short and scheduled, with a named end date. This fictional example shows the pattern to avoid. It is an illustration, not a real plan.

Phase	Duration	Security work that must finish in it
Parallel run	8 weeks	Identity cutover, logging parity, rule review
Old environment retirement	2 weeks	Access revoked, data verified, logs archived

'We will turn the old one off eventually' is how companies end up defending an environment nobody owns.

Budget the people cost

Your team's security habits were built for the old environment. Cloud misconfigurations - an open storage bucket, an over-broad role - are the dominant self-inflicted exposure, and they come from ordinary engineers using unfamiliar defaults, not from carelessness.

Training, a security review of the landing-zone design, and someone accountable for cloud configuration standards belong in the project budget. They are cheaper than the first public misconfiguration.

Make the provider show the full picture

Ask whoever proposes the migration - the cloud partner, the integrator, the internal team - for a single page that includes the security lines: identity design, logging and retention, key management, network controls, the parallel run, and skills. Competent providers can produce it immediately; they have seen the movie.

Zero trust guidance from NIST starts from exactly this premise: security is designed into the environment, not added after the migration team has left. The business case should reflect the design cost, so the savings curve you approve is the one you actually get.

The related discussion of a 90-day technology strategy is worth your time alongside this one.

Frequently asked questions

Does cloud make security cheaper overall?

Often, over time - the provider's baseline physical and platform controls are strong. But the savings show up after the design work, not instead of it. The transition years usually cost more, and planning for that avoids the worst kind of surprise.

What is the single most common mistake?

Treating identity as a detail. Most damaging cloud incidents trace to an over-broad role or a leaked key, not an exotic attack. Get identity design right first and many other lines shrink.

Who should own the security lines in the budget?

The migration owner, not a separate security budget where they can be trimmed without touching the project. If security is inside the migration's own numbers, it gets defended with them.

A Defensible Next Step

Take your current or next migration proposal and ask for the one-page security bill: identity, logging, keys, network, parallel run, skills. If it cannot be produced in a week, the proposal is not finished. Book a Decision-Clarity Call if you want a review of the numbers.