David Davis

  • OpenShift vs. EKS vs. GKE: The 2026 Platform Decision

    OpenShift vs. EKS vs. GKE: The 2026 Platform Decision

    Price out three years of Kubernetes for a 200-node estate and the control-plane fees are a rounding error — EKS charges $0.10 per cluster per hour, about $876 a year per cluster, and GKE matches it. What actually moves the number is people. The teams I see win this decision stopped comparing feature checklists and started comparing headcount: how many platform engineers does each option require you to hire, and what does the vendor’s subscription let you not build?

    That framing changes the answer. This brief compares Red Hat OpenShift, Amazon EKS, and Google Kubernetes Engine as they stand in mid-2026 — list-price shape, operating burden, the edge and VM tiebreakers — and gives you thresholds you can defend in a budget meeting.

    The verdict

    If you are all-in on AWS with a lean platform team and no VM estate, EKS is the cheapest credible answer — likely by millions over three years at scale. If you run multi-cloud or on-prem, carry FedRAMP High or PCI obligations, have edge sites, or are migrating VMs off VMware, OpenShift’s subscription premium buys you a bundled platform and a single support throat that would otherwise cost you a team. GKE sits between them: the strongest managed Kubernetes engineering in the market, and the best default if Google Cloud is already your center of gravity — especially for data and AI workloads. None of these is a wrong answer. Buying the wrong one for your team’s size is.

    Side-by-side comparison

    Red Hat OpenShiftAmazon EKSGoogle GKE
    Pricing shapeSubscription per core/socket; list pricing varies by tier and term$0.10/cluster/hr; $0.60/hr on extended support; Auto Mode adds a % fee on instances$0.10/cluster/hr all modes; Enterprise tier bills ~$0.008/vCPU/hr instead
    Where it runsAnywhere — on-prem, bare metal, edge, all major clouds (ROSA, ARO)AWS (plus EKS Anywhere/Hybrid for on-prem)Google Cloud (plus GDC for on-prem/edge)
    Operating modelYou (or Red Hat managed) run an opinionated integrated platformAWS runs control plane; you assemble the rest, or lean on Auto ModeGoogle runs control plane; Autopilot runs nodes too
    VM workloadsOpenShift Virtualization, GA and mature — the VMware-exit playNo native VM story; separate EC2 estateNo native VM story; separate Compute Engine estate
    EdgeSingle-node OpenShift and MicroShift; proven at telco scaleOutposts/Local Zones/Hybrid — thinner storyGoogle Distributed Cloud — improving, narrower install base
    Best fitRegulated, multi-cloud, VM-heavy, edge-heavy enterprisesAWS-native shops with lean platform teamsGCP-first shops, data/AI-heavy workloads

    The headcount equation

    Here is the math that matters. EKS control-plane fees on twenty clusters run roughly $17,500 a year. A fully loaded platform engineer costs $200,000 or more. The Kubernetes bill was never the bill — the team is the bill.

    EKS hands you a conformant control plane and expects you to assemble the rest: ingress, observability, policy, registry hygiene, GitOps, cluster lifecycle. AWS-native shops that standardize hard on managed services — and increasingly on EKS Auto Mode, which manages nodes for a percentage surcharge on instance costs — can run large estates with three to five platform engineers. That is where the “millions cheaper over three years” claim is real, and I have watched CFOs approve it on exactly that arithmetic.

    OpenShift inverts the trade. The subscription is a genuine premium — per-core pricing on a few hundred cores lands in six figures annually, and list pricing varies enough that you should never sign without negotiating. But Platform Plus bundles cluster management (ACM), security scanning (ACS), a registry (Quay), pipelines, and one support contract across all of it. The rule of thumb I give clients: if declining OpenShift means hiring eight or more platform engineers to assemble and operate the equivalent stack — common once you cross roughly 30 clusters, multiple environments, or serious compliance scope — the subscription is the cheaper option. Below that, it usually is not.

    The takeaway for the meeting: price the platform team, not the platform. Then optimize the workload spend separately — our Kubernetes cost optimization guide covers where the real waste hides.

    Honest downsides, all three

    OpenShift

    The premium is real and recurring, and it scales with cores whether or not you use the bundle. Upgrades of the integrated stack demand discipline — you are operating a distribution, not consuming a service, unless you pay more for ROSA or ARO. Teams that buy Platform Plus and use ten percent of it are Red Hat’s best customers and their own worst enemies.

    EKS

    The assembly tax is paid in engineering time, and the extended-support fee is a quiet trap: fall more than 14 months behind on Kubernetes versions and the cluster fee jumps sixfold to $0.60 an hour. Multiply by dozens of neglected clusters and you have bought a platform engineer’s salary in penalty fees. EKS is also the deepest lock-in of the three — everything you assemble around it is AWS-shaped.

    GKE

    Autopilot’s per-pod resource billing punishes lazy resource requests — over-provisioned pods are billed as requested, not as used. Google Cloud’s enterprise sales and support motion still trails AWS and Red Hat in regulated accounts, and if your estate is not on Google Cloud, GKE’s excellence is mostly academic.

    GKE Autopilot and the ops-cost angle

    Autopilot deserves its own section because it attacks the same headcount problem from the opposite direction. Instead of bundling tooling like Red Hat, Google removes the node layer entirely: you pay for pod-level CPU and memory requests, Google patches and scales the nodes, and your team never SSHes into anything. For general-purpose services with well-tuned requests, that converts two or three node-wrangling engineers into zero. GKE’s $74 monthly free-tier credit even covers one small cluster’s management fee outright.

    The catch is discipline. Autopilot is priced on what you request, so sloppy requests inflate the bill faster than on node-based billing, and workloads needing exotic node configs still push you back to Standard mode. GKE Enterprise, billed around $0.008 per vCPU per hour, adds fleet management and policy across clusters — worth modeling only above roughly ten clusters. Verdict: Autopilot is the lowest-ops managed Kubernetes you can buy in 2026, and AWS’s EKS Auto Mode is a direct acknowledgment of that.

    Edge and VMs: OpenShift’s tiebreakers

    Two workload classes break the managed-cloud logic entirely, and both favor Red Hat.

    Edge first. Single-node OpenShift runs a full cluster on one bare-metal box, and MicroShift squeezes an OpenShift-compatible runtime into a single service for devices smaller still. This is not slideware — Verizon runs its 5G RAN on single-node OpenShift deployed across thousands of bare-metal edge locations, managed centrally through Advanced Cluster Management. If your roadmap includes hundreds of retail sites, factories, or cell towers, neither EKS nor GKE has a comparably proven answer.

    Second, VMs. OpenShift Virtualization runs virtual machines alongside containers on the same cluster, and as of the 4.19-era releases it added live storage migration and reached the major public clouds in preview or GA form. For enterprises pushed off VMware by renewal pricing, it turns the Kubernetes decision and the hypervisor decision into one purchase — we scored that matchup in our VMware-exit comparison. One operational caution: converged VM-plus-container clusters concentrate risk, so treat data protection as a first-class requirement — see our Kubernetes backup teardown before you migrate the first VM.

    What to do about it

    • Single-cloud AWS, fewer than five platform engineers, no VM estate: pick EKS, evaluate Auto Mode, and put a version-currency SLO in place so extended-support fees never appear on an invoice.
    • GCP-first or data/AI-heavy: pick GKE, default new workloads to Autopilot, and enforce resource-request hygiene from day one.
    • Multi-cloud, regulated, edge sites, or a VMware exit in flight: shortlist OpenShift, price Platform Plus against the eight-engineer alternative, and negotiate — nobody pays list.
    • Whichever you choose: re-run the headcount math annually. The platforms reprice quietly; your team costs do not.

    Frequently asked questions

    Is OpenShift cheaper than EKS?

    On list price, no — EKS’s $0.10 per cluster-hour is far below OpenShift’s per-core subscription. OpenShift becomes cheaper when its bundled tooling and support replace platform engineers you would otherwise hire, typically at larger, regulated, or multi-cloud scale.

    What is the difference between OpenShift and Kubernetes?

    Kubernetes is the open-source orchestrator; OpenShift is Red Hat’s distribution of it with an integrated registry, CI/CD, security tooling, a hardened OS, and commercial support. EKS and GKE are managed Kubernetes services, while OpenShift is a full platform you can run anywhere.

    Is GKE Autopilot cheaper than Standard GKE?

    For spiky or modest workloads with well-tuned resource requests, usually yes, because you stop paying for idle node capacity. For dense, steady workloads on committed-use discounts, Standard mode with good bin-packing often wins on raw cost.

    Can OpenShift run virtual machines?

    Yes. OpenShift Virtualization runs VMs alongside containers on the same clusters, with live migration and, as of recent releases, live storage migration. It is the feature that makes OpenShift a serious VMware alternative rather than only a container platform.

    Which Kubernetes platform is best for regulated industries?

    OpenShift generally has the strongest compliance posture — FedRAMP High paths via ROSA on AWS GovCloud, mature FIPS support, and a single vendor accountable for the whole stack. EKS and GKE both offer government regions and compliance programs, but you assemble and attest more of the stack yourself.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

  • Data Breach Costs in 2026: The Benchmarks That Matter

    Data Breach Costs in 2026: The Benchmarks That Matter

    The number every CISO will paste into a budget deck this year: $4.44 million — the global average cost of a data breach, down 9% and the first decline in five years. The number that should worry US-based boards: $10.22 million, a record high for American organizations, moving the wrong way while the rest of the world improves. Both figures come from IBM’s most recent Cost of a Data Breach report, and both get re-baselined when the next edition lands this summer.

    This brief gives you the benchmarks worth quoting, explains why the averages moved in opposite directions, and maps the numbers to the security line items — KnowBe4, Zscaler, CrowdStrike, Microsoft — that IT directors actually use them to justify.

    The benchmark numbers

    BenchmarkDirection
    Global average breach cost$4.44MDown 9% — first decline in five years
    US average breach cost$10.22MUp — an all-time record
    Healthcare average$7.42MHighest industry for the 14th straight year
    Mean time to identify and contain241 daysA nine-year low
    High shadow AI usage premium+$670KNew cost amplifier in the latest edition

    One methodology caveat before you quote any of this to a board. The IBM/Ponemon study is activity-based costing across roughly 600 breached organizations — it is the best public benchmark we have, but it is a survey-derived average, not an actuarial table. Mega-breaches are excluded from the headline number, and averages hide enormous variance by geography and sector. Use it to frame budget conversations, not to price cyber insurance.

    What changed

    The global decline is a detection story, not a threat story. Attack volume did not fall — organizations got faster. Mean time to identify and contain a breach dropped to 241 days, the lowest in nine years, and the report attributes much of that to AI-assisted security operations finally paying off in the SOC. Shorter dwell time is the single most reliable cost suppressor in every edition of this study, and it finally moved the headline number.

    The US moved the other way. At $10.22 million, American breach costs are now more than double the global average, driven by regulatory penalties, higher detection and escalation spend, and litigation exposure that other jurisdictions simply do not generate at the same scale. Healthcare led all industries again at $7.42 million — the 14th consecutive year at the top — for the familiar reasons: regulated data, legacy clinical systems, and downtime that gets measured in patient outcomes rather than lost transactions.

    The takeaway a VP can repeat: breach costs are falling for organizations that detect fast, and rising for everyone operating under US regulatory exposure. The averages are diverging, not converging.

    Why it matters

    Benchmarks like these do two jobs in an enterprise. First, they anchor the risk register — your finance team wants a defensible loss figure, and “$10.22M if we are US-based, $7.42M if we are healthcare” is defensible in a way an internal guess is not. Second, they justify spend. A security awareness renewal, a zero trust migration, an XDR consolidation — each of these gets approved faster when the cost of doing nothing has a citation behind it.

    The diagnostic framing matters more than the averages. If your own mean time to identify and contain is above 241 days, you are now below the global median performance and your expected breach cost skews above the average for your sector. If you are a multinational budgeting off the $4.44M global figure while holding significant US data, you are underestimating — budget off the US number for any incident that touches American residents. And if you have no measured MTTI/MTTC at all, that is the first gap to close, because you cannot claim the fast-containment discount without evidence.

    The shadow AI tax

    The freshest number in the report is the one most likely to shape 2026 budgets: organizations with high levels of shadow AI — employees using unapproved AI tools with corporate data — paid an extra $670,000 per breach on average. That is a concrete, citable price on an exposure most enterprises have been treating as a policy memo problem.

    The mechanism is unglamorous: ungoverned AI tools expand the data footprint, copies of sensitive data end up in places the IR team does not know to look, and discovery and notification costs climb. The fix is governance plus visibility, not prohibition — we covered the policy side in our shadow AI risk and policy analysis, and the $670K figure is the number that turns that policy work from optional to funded.

    Where the vendor stack fits

    Each headline number maps to a category of spend, which is exactly how these benchmarks get used in procurement. Four vendors come up constantly in those conversations — here is the honest read on each.

    KnowBe4 — the human-element line item

    Phishing and social engineering remain the dominant initial access vectors, which is the argument for KnowBe4’s human risk management platform (HRM+). Its strengths are breadth — the largest simulation and training content library in the category — and momentum on AI-era threats, including deepfake simulation agents that train staff against AI-generated impersonation of their own executives. The honest caveat: training reduces click rates, but proving behavior change beyond that metric is hard, and awareness spend does not shorten containment time. It fits organizations where the phishing numbers are the problem — compare yours against our phishing click-rate benchmarks before renewing.

    Zscaler — the attack-surface line item

    Zscaler’s Zero Trust Exchange pitch maps to the cost-avoidance side of the benchmark: fewer exposed entry points, less lateral movement, smaller blast radius. Its own ThreatLabz research claims 51% of organizations had a VPN-related incident in the past year — treat vendor-funded numbers with the usual discount, but the architectural argument for retiring inbound VPN is sound regardless. Zscaler’s inline inspection also gives it a credible shadow-AI angle, since it can see and control which AI tools traffic actually flows to. Downsides: you are inserting a proxy dependency into everything, and migrations off legacy VPN realistically take quarters, not weeks. Best fit: distributed enterprises with large remote workforces.

    CrowdStrike — the containment-speed line item

    The 241-day figure is CrowdStrike’s sales deck, effectively. Falcon’s case rests on detection and response speed, and Charlotte AI extends that into agentic triage — the category we compared in our AI SOC platforms comparison. Strengths: consistently top-tier detection efficacy and a single-agent architecture that operations teams like. Weaknesses: premium pricing that climbs fast as modules stack, and the 2024 outage remains the standing lesson on single-vendor concentration risk in the endpoint layer. It fits organizations whose gap is dwell time — if your MTTI is north of the benchmark, this category is where the money goes first.

    Microsoft — the consolidation line item

    Microsoft’s argument is economic: Defender XDR, Sentinel, and Purview arrive effectively bundled for E5 shops, and Purview is the most direct tooling answer to the shadow-AI data governance gap — classifying and tracing the sensitive data that unapproved AI tools put at risk. Security Copilot adds AI-assisted investigation across the stack. The trade-offs are real: module quality varies, licensing is genuinely hard to price, and standardizing your security stack on the same vendor you run identity and productivity on concentrates risk in one attack surface. It fits M365-standardized enterprises that value consolidation over best-of-breed.

    What to do about it

    • Re-baseline your loss estimate. Use $10.22M for US exposure, your industry average otherwise, and stop quoting the global figure if you hold US data.
    • Measure MTTI/MTTC this quarter. 241 days is the line. Above it, prioritize detection and response spend before anything else.
    • Put the $670K shadow-AI premium in the risk register. Then fund AI-use visibility and governance against it — a discovery tool plus an approved-tool catalog beats a prohibition memo.
    • Time renewals to the report cycle. The next edition lands mid-2026; expect every vendor above to reframe its pitch around the new numbers within weeks. Have your own baseline ready first.

    Frequently asked questions

    What is the average cost of a data breach in 2026?

    The most recent IBM Cost of a Data Breach report puts the global average at $4.44 million — a 9% decline and the first drop in five years. The US average is $10.22 million, a record high. The 2026 edition, due mid-year, will update both figures.

    Why did breach costs fall globally but rise in the US?

    Faster identification and containment — 241 days on average, a nine-year low — pulled the global number down. US costs rose on regulatory penalties, higher detection and escalation spend, and litigation exposure that other regions do not face at the same scale.

    How much does shadow AI add to the cost of a breach?

    Organizations with high levels of unapproved employee AI use saw breach costs roughly $670,000 above the average. Ungoverned AI tools spread sensitive data into unmonitored places, which raises discovery, containment, and notification costs.

    Which industry has the highest data breach costs?

    Healthcare, at $7.42 million per breach — the highest of any industry for the 14th consecutive year, driven by regulated patient data, legacy clinical systems, and the operational cost of downtime.

    How is the average cost of a data breach calculated?

    IBM’s study, run with Ponemon Institute, uses activity-based costing across roughly 600 breached organizations: detection and escalation, notification, response, and lost business. It excludes mega-breaches from the headline average, so treat it as a planning benchmark rather than a worst-case estimate.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

  • Cloud Repatriation in 2026: Which Workloads Actually Leave

    Cloud Repatriation in 2026: Which Workloads Actually Leave

    Barclays’ CIO survey put a number on the mood: 83% of enterprise CIOs plan to repatriate at least some workloads. That figure launched a hundred “the cloud is over” headlines. Here is the number the headlines skip — only about 8% of companies move entire workloads back, and Flexera’s State of the Cloud data suggests roughly a fifth of migrated workloads have returned on-prem in some form. Repatriation is real. It is also selective, and the interesting question is not whether to leave the cloud — it’s which workloads clear the bar.

    This brief gives you the actual math: the two workload profiles that consistently win on-prem, the thresholds that decide it, and where AWS, Google Cloud, Broadcom/VMware, and Red Hat sit as the traffic starts to move.

    What changed

    Three forces converged between 2024 and 2026. First, the FinOps easy wins ran out — after rightsizing, reserved capacity, and spot, steady-state cloud bills stopped shrinking, and finance started asking why a workload with flat utilization needs elastic pricing. Second, GPU economics got loud: with on-demand GPU pricing running roughly $2–8 per hour as of mid-2026, an owned inference cluster starts beating rented capacity once sustained utilization crosses the 60–70% range. Third, the exit tax fell. Under pressure from the EU Data Act, both Google Cloud and AWS now waive egress fees for customers moving data off their platforms — which removed the single largest one-time cost of leaving.

    The takeaway for the meeting: the barriers to selective repatriation dropped at the same time the savings case matured. That’s why the survey numbers spiked — not because the cloud stopped working.

    The numbers, minus the hype

    Most repatriation coverage is either hyperscaler damage control or hosting-vendor cheerleading. Here is what the data actually supports, with the hype version alongside it.

    The headline versionWhat the data says
    CIO intent“86% of CIOs are leaving the cloud”Barclays found 83% plan to repatriate some workloads — intent, not exodus
    Full exits“Enterprises are abandoning AWS”Only ~8% of companies move entire workloads; the rest rebalance
    Volume moved“The great cloud reversal”Flexera data points to roughly one-fifth of migrated workloads coming back in some form
    Savings“Cut your bill 80% overnight”Steady-state workloads average ~32% savings over a 3–5 year horizon — real, not miraculous
    GPU math“Never rent a GPU again”Owned clusters win above ~60–70% sustained utilization at $2–8/hr on-demand rates; below that, keep renting

    Read the table as a diagnostic. If your estate is mostly variable, the honest savings number for you is near zero. If 40% of your compute runs flat around the clock, the 32% figure is worth a business case.

    The workloads that actually leave

    Two profiles dominate real repatriation projects, and they share one trait: predictability.

    Profile 1: steady-state compute and storage

    Databases with stable IOPS, internal line-of-business applications, batch processing, and archive-heavy storage. The pattern that qualifies: utilization that varies less than roughly ±20% month over month, a demand forecast you trust for three years, and a 3–5 year amortization window. These workloads pay cloud’s elasticity premium and never use the elasticity. Moved to owned or hosted infrastructure, they are the source of that ~32% average saving — sometimes more when storage egress was a recurring line item, a pattern we quantified in our egress fee benchmark.

    Profile 2: sustained-utilization GPU inference

    Training bursts belong in the cloud. Inference that hums along at high utilization does not. At $2–8 per GPU-hour on demand, a cluster you keep above 60–70% utilization typically pays for itself well inside its useful life — as of mid-2026 hardware pricing, commonly within two years. The break-even is sensitive to power costs and your ability to actually keep the cluster busy, so run the model before you buy; our on-prem GPU cluster cost guide walks through the full TCO stack, including the parts vendors leave out.

    The workloads that stay

    Be equally honest about what doesn’t move, because failed repatriations are expensive twice.

    • Spiky and seasonal demand. Retail peaks, tax season, campaign traffic — elasticity is what you’re paying for, and it’s worth it.
    • Anything welded to higher-order managed services. If the workload leans on BigQuery, DynamoDB, or a managed streaming stack, the replatforming labor usually eats the infrastructure savings. Count the engineering hours before you count the server savings.
    • Globally distributed, latency-sensitive front ends. Replicating a hyperscaler’s edge footprint on your own is not a savings project.
    • Anything owned by a team with no ops bench. Repatriation converts an invoice into an operational responsibility. If you don’t have the staff, you don’t have the option.

    The verdict a VP can repeat: repatriate the base load, rent the spike.

    How AWS and Google Cloud are playing defense

    AWS’s response has been pragmatic rather than panicked. It waives egress for customers moving off the platform — conditional, and coordinated through support rather than automatic — and it is leaning on the two levers that keep steady-state workloads in place: deeper commitment discounts and hybrid hardware. Outposts is effectively AWS’s “repatriate without leaving” play, and its European Sovereign Cloud targets the compliance-driven slice of repatriation demand. AWS’s real strength is gravity — the breadth of managed services makes full exits genuinely painful. Its weakness is the flip side: on raw, predictable compute, list pricing loses to owned hardware, and AWS knows it.

    Google Cloud moved first on exit fees, announcing free egress for departing customers back in January 2024 — but read the terms: the waiver applies when you close the account and move everything within a 60-day window, which is stricter than the press release implied. Google’s retention story is stickiness of the productive kind: BigQuery and Vertex AI are hard to replicate on-prem, and GKE Enterprise gives it a credible hybrid answer for Kubernetes estates. Where Google is thinner is the on-prem hardware story — there is no Outposts equivalent with real traction, so its repatriation-prone customers tend to leave rather than hybridize.

    The landing zone problem: Broadcom/VMware vs Red Hat

    Here’s the twist most repatriation math ignores: the default landing zone got expensive at exactly the wrong moment. Broadcom’s overhaul of VMware — subscription-only licensing, the product catalog consolidated down to a handful of bundles around VMware Cloud Foundation — has produced widely reported renewal increases in the 2–5x range for estates pushed from bare vSphere into the full VCF stack, with some customers reporting far worse. The April 2025 announcement of a 72-core license minimum was reversed back to 16 cores after customer pushback, but the episode did lasting damage to renewal psychology. If you repatriate onto VMware without negotiating hard, you can hand your cloud savings straight to Broadcom.

    That said, dismiss VCF at your peril. It remains the most complete private-cloud stack on the market, your operations team already knows it, and the ecosystem — backup, DR, monitoring — is unmatched in depth. It fits large estates that consolidate onto dense hosts (fewer phantom cores under the minimums) and treat the renewal as a procurement event, not a formality.

    Red Hat is the beneficiary of the moment. OpenShift Virtualization runs VMs on KVM alongside containers on one platform, the migration toolkit for virtualization automates vSphere imports at scale, and OpenShift Virtualization Engine is the VM-only edition aimed squarely at the “I just want a hypervisor without the drama” buyer. Its strengths: one platform for VMs and containers, and no hypervisor renewal shock. Its honest weaknesses: the operational model is Kubernetes-first — vSphere admins face a real learning curve — and the third-party tooling ecosystem around backup and DR, while growing fast, is younger than VMware’s. Fit: organizations already invested in OpenShift or containers, and mid-size estates willing to retrain.

    The move: get both quotes. Even if you intend to stay on VMware, a credible OpenShift Virtualization quote is the best negotiating instrument Broadcom has ever given its customers.

    What to do about it

    • Inventory by utilization curve, not application age. Flat curves are repatriation candidates; volatile curves are not. This one query reframes the whole conversation.
    • Price the full exit. Egress waivers help, but the real costs are replatforming labor and landing-zone licensing. A business case without a VMware or Red Hat quote attached is not a business case.
    • Set thresholds and hold them. Utilization variance under ±20%, a three-year forecast you believe, GPU utilization above 60–70% — below the bar, stay in the cloud without guilt.
    • Rebalance, don’t exit. The 8% doing full exits are mostly special cases. The defensible posture for 2026 is cloud for the spike, owned infrastructure for the base.
    • Re-run the math annually. Hardware prices, GPU rates, and hyperscaler discounts all moved in the last eighteen months. A 2024 analysis is already stale.

    Frequently asked questions

    What is cloud repatriation?

    Cloud repatriation is moving workloads from public cloud providers back to on-premises data centers, colocation, or private cloud. In practice it is almost always selective — specific workloads move while the rest of the estate stays in the cloud.

    Are companies really leaving the cloud in 2026?

    Mostly no — they are rebalancing. Barclays found 83% of CIOs plan to repatriate some workloads, but only around 8% of companies move entire workloads off the cloud. The dominant pattern is moving steady-state workloads back while keeping variable ones in the cloud.

    Which workloads should move back on-premises?

    Workloads with flat, predictable utilization over a 3–5 year horizon — stable databases, internal apps, batch, and archives — plus GPU inference running above roughly 60–70% sustained utilization. Spiky demand and workloads built on managed services should generally stay.

    Does AWS charge egress fees when you leave?

    As of mid-2026, AWS waives data transfer fees for customers migrating off the platform, following Google Cloud’s January 2024 move. The waivers are conditional — AWS coordinates them through support, and Google’s requires a full account closure within a 60-day window — so plan the exit before you start it.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

  • AI Agent Identity: Governing Non-Human Access in 2026

    AI Agent Identity: Governing Non-Human Access in 2026

    Gartner projects that 40% of enterprise applications will embed task-specific AI agents by the end of 2026 — up from under 5% in 2025. NIST stood up an AI Agent Standards Initiative in February 2026 with agent identity as a core pillar. Vendors shipped accordingly: Microsoft took Entra Agent ID to general availability this spring, and CrowdStrike unveiled Continuous Identity for AI Agents. Yet in most shops I talk to, nobody can answer the first audit question: how many AI agents hold credentials right now, and who owns each one?

    That gap is the subject of this guide. Agents are not service accounts and they are not users — they are a third identity class that needs its own lifecycle, its own least-privilege model, and its own promotion path from assisted to autonomous. Here is how to build that before your auditors, or your attackers, find the hole first.

    What changed

    Three things landed inside twelve months. First, scale: agent adoption crossed from pilot to default, and every major SaaS suite now ships agents that request credentials on day one. Second, standards: NIST’s February 2026 initiative put agent identity on the formal standards track, while SPIFFE workload identity and the Shared Signals Framework moved from niche to vendor-adopted, and OAuth-based authorization in the Model Context Protocol became the de facto pattern for agent-to-tool access. Third, products: Entra Agent ID hit GA, CrowdStrike and Zscaler previewed risk-adaptive access for agents across the Zero Trust Exchange, and Google pushed its Agent2Agent protocol into open governance.

    The takeaway a VP can repeat: the “there’s no tooling yet” excuse expired in 2026. What remains scarce is an operating model.

    Why it matters

    Your IAM stack assumes two identity classes. Humans get joiner-mover-leaver workflows, MFA, and a manager. Machines get service accounts and API keys — static, predictable, narrowly scoped, and (in theory) inventoried. Agents break both models. They behave dynamically like humans, vary their access patterns by task, spawn and retire in hours like containers, and — the hard part — act on behalf of specific users, which creates delegation chains your directory was never asked to represent.

    The risk math is ugly. An over-scoped agent credential doesn’t get tired, doesn’t trip lockout thresholds, and generates activity that looks plausible at machine speed. Prompt injection turns any autonomous agent into a confused deputy: the attacker doesn’t steal the credential, they borrow the agent that already holds it. My verdict is blunt: an agent with standing broad privileges is a breach waiting for a well-crafted input. If your organization is formalizing AI oversight more broadly, this is the identity chapter of the story we covered in our enterprise AI governance frameworks guide — governance without identity enforcement is a policy PDF.

    Treat agents as first-class identities

    The fix is conceptually simple: give agents the same lifecycle rigor you give employees, adapted for machine tempo. In practice that means:

    • Provision from a template. Every agent identity is stamped from an approved blueprint that pre-defines scopes, owner, and expiry — Microsoft’s Agent Identity Blueprint construct is the clearest productization of this idea so far.
    • Named human owner. No owner in the directory, no credential. Orphaned agents are the new orphaned service accounts, at ten times the volume.
    • Least-privilege scopes with expiry. Rule of thumb: no agent credential should live longer than 90 days, and high-privilege scopes should be granted per task, not per agent.
    • Separate delegated and autonomous permission sets. An agent acting for a user should carry that user’s constraints; an agent acting alone should carry far fewer rights and far more logging.
    • Behavioral baselining. If you can’t attribute an API call to a specific agent and its human sponsor within one hop, don’t grant the scope.
    • Deprovisioning tied to the workflow. When the automation retires, the identity retires the same day — automatically.

    The vendor field: who does what

    No single vendor covers the whole problem. Broadly, you’re assembling three layers: a directory of record for agent identities, a runtime authorization and risk layer, and the agent platforms themselves, which decide how identity is expressed in the first place.

    Role in the stackStrongest atWatch out for
    MicrosoftDirectory of record (Entra Agent ID, GA 2026)Blueprints, Conditional Access, and ID Governance extended natively to agentsLicensing tied to Agent 365 / E7 tiers; strongest inside the Microsoft estate
    CrowdStrikeRuntime identity risk (Continuous Identity for AI Agents)Per-action authorization, SPIFFE + Shared Signals, no standing privilegesAn overlay, not an IdP — you still need a directory of record
    ZscalerInline zero-trust enforcement for agent trafficRisk-adaptive access via the Zero Trust Exchange and CrowdStrike integrationNot an identity provider; agent-to-agent east-west policy still maturing
    Google CloudAgent platform + IAM service identitiesOpen Agent2Agent protocol; per-agent identities via Cloud IAMGovernance tooling spread across IAM, Agentspace, and Vertex
    AnthropicAgent platform (Claude, MCP)OAuth-based MCP authorization as a de facto tool-access standardLifecycle governance deliberately left to your IdP; MCP server auth quality varies
    OpenAIAgent platform (Agents SDK, enterprise admin controls)Fastest build path; SSO and SCIM on the enterprise tierTool credentials default to long-lived API keys unless you engineer otherwise

    A few sharper notes. Microsoft is the only vendor treating agents as directory citizens — agent identities, agent user accounts for on-behalf-of scenarios, and governance reviews that work like employee access reviews. If you’re an Entra shop, start there; just model the Agent 365 licensing cost before you scale, because per-user pricing on a per-agent problem deserves scrutiny. CrowdStrike is attacking the runtime layer: every agent action re-authorized in real time against identity, human sponsor, and context, which is the correct architecture for high-privilege agents — but it presumes you’ve already got clean identity data to reason over. Zscaler’s bet is that agent traffic is still traffic, and its CrowdStrike integration makes access decisions respond to live identity risk; if you’ve already retired your VPN estate along the lines of our ZTNA migration guide, extending those policies to agents is an increment, not a project.

    The platform vendors matter just as much, because they set defaults. Google Cloud’s Agent2Agent protocol and IAM-backed agent identities give multicloud shops an open pattern, though you’ll assemble the governance story yourself. Anthropic’s MCP authorization spec pushed OAuth scoping into the agent-tool boundary, which quietly did more for least privilege than most products — but Anthropic leaves identity lifecycle to your IdP by design. OpenAI gives enterprises SSO, SCIM, and admin controls on the ChatGPT Enterprise side and a fast Agents SDK on the build side; the gap to watch is tool credentials, which drift toward long-lived keys unless your platform team enforces short-lived issuance.

    Adaptive autonomy: promote on evidence

    The most useful governance idea of this cycle is adaptive autonomy: agents earn independence the way junior admins do. Start every agent in assisted mode — human approves each consequential action. Promote to supervised mode after a defined evidence bar: I use 100 logged runs, an error rate under 2%, and zero attempted out-of-scope calls. Promote to autonomous only for the specific tasks with that track record, with an automatic demotion trigger on any anomaly. The promotion log is your audit artifact.

    Wire the demotion trigger to your detection stack, not to a quarterly review. Agent anomalies unfold in minutes, and this is exactly the telemetry the current generation of AI-driven SOC tooling ingests well — we compared the contenders in our AI SOC platforms analysis.

    What to do about it

    • Inventory first. Discover every credential an agent holds today, including shadow agents inside SaaS suites. Expect the count to be 3–5x what anyone estimates.
    • Assign ownership. Every agent gets a named human owner and a business justification, or it gets disabled.
    • Pick your control plane deliberately. Directory of record (Entra Agent ID or your IdP’s equivalent) plus a runtime risk layer for high-privilege agents. Don’t let six teams pick six patterns.
    • Enforce short-lived credentials. 90-day maximum, per-task issuance for privileged scopes, automated rotation.
    • Stand up autonomy gates. Assisted, supervised, autonomous — promotion on logged evidence only, demotion on anomaly automatically.
    • Extend access reviews to agents. Same quarterly cadence as privileged human accounts. If your review tooling can’t see agents, that’s a selection criterion now.

    The bar to clear before end of year is modest: complete inventory, named owners, and expiring credentials. Do those three and you’re ahead of most of the Fortune 500.

    Frequently asked questions

    What is AI agent identity management?

    It’s the discipline of giving each AI agent a unique, governed identity — provisioned from a template, scoped to least privilege, owned by a named human, monitored behaviorally, and deprovisioned when the workflow ends. It extends IAM’s joiner-mover-leaver model to non-human actors that behave dynamically.

    How is an AI agent different from a service account?

    A service account does one predictable thing with static permissions. An agent varies its behavior by task, acts on behalf of different users, can invoke other agents, and may be created and retired in hours. Static credentials and annual reviews — tolerable for service accounts — fail outright for agents.

    What is the biggest security risk of agentic AI?

    Over-scoped standing privileges combined with prompt injection. An attacker doesn’t need to steal a credential — they manipulate an agent that already holds one. Per-action authorization and least-privilege scoping are the primary controls.

    Do AI agents need their own identities in Entra ID?

    If you run a Microsoft estate, yes — Entra Agent ID (GA in 2026) exists precisely so agents stop borrowing user accounts or generic service principals. Elsewhere, the same principle applies: one agent, one identity, one owner, whatever your directory of record is.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

  • From Awareness Training to Human Risk Management

    From Awareness Training to Human Risk Management

    Somewhere on your desk is a renewal quote for security awareness training, and the line item has quietly changed its name. The vendor now sells a “human risk management platform.” That rename is not marketing noise — it marks a genuine category transition, one that Forrester formalized with its first Wave for Human Risk Management Solutions in Q3 2024 and that Gartner has been circling with its human-centric security research. The annual-training-plus-quarterly-phishing-test model that most enterprises have run since roughly 2015 is being replaced by continuous behavioral scoring, real-time intervention, and — increasingly — autonomous AI agents that decide who gets trained, on what, and when.

    This brief maps the transition: what actually changed, why the old model stalled, where KnowBe4 — the category’s incumbent — now sits, and the checklist that separates a rebadged awareness tool from a genuine behavioral platform. If you buy or renew in the next twelve months, this is the decision you are actually making.

    What changed

    Three things converged. First, the analysts drew a new map. Forrester’s inaugural Wave for Human Risk Management Solutions (Q3 2024) evaluated vendors on behavioral data, risk quantification, and intervention — not on the size of their training-content libraries. Leaders in that first cut included behavioral-science specialists CybSafe and Living Security, a signal that the evaluation criteria had moved past where the legacy suites were strongest. Gartner, meanwhile, has pushed the same direction under its human-centric security banner, arguing that awareness alone does not change behavior.

    Second, the incumbent re-platformed. KnowBe4 — taken private by Vista Equity Partners in early 2023 in a $4.6 billion deal — spent the following three years rebuilding around an AI-agent architecture it calls AIDA (Artificial Intelligence Defense Agents), culminating in the March 2026 launch of AIDA Orchestration, an autonomous agent that creates and schedules per-user phishing tests and training without an admin building campaigns. When the vendor with the largest customer base in the category stops selling seat-licensed training modules and starts selling autonomous risk agents, the category has moved.

    Third, attackers automated first. AI-generated phishing collapsed the cost of producing convincing, personalized lures. A quarterly template-based simulation program is now testing employees against a threat that no longer exists in that form. The gap shows up directly in the numbers — see our companion analysis of phishing click-rate benchmarks for 2026 for where healthy programs actually land.

    Why it matters

    The old model produced a compliance artifact, not a risk reduction. Completion rates near 100 percent and click rates that plateau after year two are the signature of a program that has stopped changing behavior. Every breach report of the last decade says the same thing: the human element sits in the causal chain of a large majority of incidents. Spending stayed flat against that number because the tooling could only measure exposure to training, not propensity to fail.

    Human risk management platforms change the unit of measurement. Instead of “percent trained,” you get a per-user, per-group risk score built from real signals — simulated and real phishing responses, credential hygiene, data-handling events, unsanctioned tool usage. That last one matters more every quarter: employees pasting source code and customer data into consumer AI tools is now a top-three human-risk vector, and it is invisible to an LMS. Our shadow AI risk and policy analysis covers why policy documents alone fail there, too. The takeaway for the boardroom: HRM turns the human layer into something you can score, trend, and defend in front of an audit committee. Awareness training never did that.

    KnowBe4: the incumbent rebuilds in place

    KnowBe4 is the reference point for this transition because it built the old category and is now trying to own the new one. Its strengths are real: the largest installed base in the segment, a deep and frequently refreshed content library, mature phishing simulation at enterprise scale, and — since the Vista take-private — an aggressive product cadence. The HRM+ platform bundles awareness training, cloud email security, real-time coaching, crowdsourced anti-phishing, and the AIDA agent suite into a single risk-scoring fabric. AIDA Orchestration is the most consequential piece: it moves campaign design from the admin console to an autonomous agent that adapts to each user’s risk profile. For a lean security team running a 20,000-seat program, that is a genuine operational shift, not a feature bullet.

    The honest caveats. KnowBe4’s behavioral-science depth has historically trailed the specialists — CybSafe and Living Security led Forrester’s first HRM Wave on exactly that axis. Its risk scoring is strongest inside its own telemetry; organizations wanting scores fed by their EDR, IAM, and DLP stack should scrutinize integration depth rather than accept the dashboard at face value. Private-equity ownership cuts both ways: faster roadmap, but also bundle-heavy packaging and renewal pricing that rewards buyers who negotiate hard. And some long-time customers describe the culture of the product as phishing-first — if your risk model says your exposure is data handling or shadow AI rather than email, test that the platform measures what you actually care about. KnowBe4 fits enterprises that want one throat to choke and a fast path from legacy SAT to HRM. It fits less well where behavioral-science rigor or stack-wide risk aggregation is the buying criterion.

    SAT vs HRM — the real differences

    Strip the branding and the two models differ on six axes. The verdict: if a product cannot score individual risk from multiple live signals and intervene in the moment of risky behavior, it is SAT — whatever the datasheet says.

    Security awareness training (legacy)Human risk management (current)
    CadenceAnnual modules, quarterly phishing testsContinuous scoring, always-on micro-interventions
    Data inputsCourse completions, simulation clicksEmail, identity, DLP, SaaS and browsing signals, real incidents
    Core metricCompletion rate, click ratePer-user and per-group risk score, trended over time
    InterventionAssign more training after failureReal-time nudge at the moment of risky action
    AI roleContent generation, if anyAutonomous agents targeting, scheduling, adapting per user
    Audit story“Everyone completed training”“Human risk decreased X percent in these cohorts”

    The buyer checklist: rebadged SAT or real HRM

    Every SAT vendor now uses the HRM label. Category transitions always produce this — buyers search the old term, vendors relabel, and the datasheets converge while the products do not. Ask these five questions in the demo and make the vendor show, not tell:

    • Signal breadth. How many non-simulation data sources feed the risk score today — identity provider, EDR, DLP, SaaS usage? Fewer than three live integrations means the “score” is a phishing-click average wearing a costume.
    • Real-time intervention. Can the platform nudge a user at the moment they forward a sensitive file or paste data into an unsanctioned AI tool — or does it only assign a course afterward?
    • Agent autonomy with guardrails. If AI schedules training and simulations (as KnowBe4’s AIDA Orchestration does), what does the approval workflow look like, and can you audit every decision the agent made?
    • Outcome reporting. Demand a live report showing risk-score change over 12 months for a real (anonymized) customer cohort — not a mock-up.
    • Pricing model. Per-user-per-year is standard; watch for agent features gated behind top-tier bundles. As of mid-2026, list pricing varies widely and discounts of 20–40 percent off list are routine at enterprise volume — treat the first quote as an opening position.

    What to do about it

    If your renewal is more than nine months out: instrument now. Get baseline per-user risk data from the signals you already own — secure email gateway, identity logs, DLP — so you can evaluate HRM platforms against your real behavior profile instead of a vendor demo. If renewal is imminent: sign short. A one-year term with an HRM pilot rider beats a three-year SAT commitment at a discount, because the category will look different again by 2028. Incumbents like KnowBe4 will argue the migration path is easiest inside their platform, and for their installed base that is often true — but make them price the agent tier against the specialists’ quotes, and benchmark your program against real numbers like the 2026 click-rate data before accepting any vendor’s definition of “improved.” The one-sentence version for your next steering meeting: stop buying training completions, start buying measured risk reduction, and make every vendor prove the difference with your data.

    Frequently asked questions

    What is the difference between security awareness training and human risk management?

    Security awareness training delivers scheduled educational content and periodic phishing simulations, measured by completion and click rates. Human risk management continuously scores each user’s actual risk from multiple live data sources and intervenes in real time — training becomes one intervention among several rather than the whole product.

    Is KnowBe4 a human risk management platform?

    KnowBe4 positions its HRM+ platform squarely in the category, combining training, cloud email security, real-time coaching, and its AIDA suite of AI agents. It is the segment’s market-share incumbent; buyers should still verify integration depth and behavioral-science capability against specialists such as CybSafe or Living Security, which led Forrester’s first HRM Wave.

    What are the main KnowBe4 alternatives in 2026?

    The vendors most often shortlisted against KnowBe4 include CybSafe, Living Security, Hoxhunt, SoSafe, and Mimecast’s engagement offering — each with a different center of gravity, from behavioral science to adaptive phishing to email-security bundling. Shortlist on which risk signals matter most in your environment, not on brand familiarity.

    Does human risk management replace phishing simulations?

    No — simulations remain a core signal, but they become one input to a risk score rather than the program’s headline metric. Modern platforms increasingly generate and schedule simulations autonomously, adapting difficulty per user instead of blasting one template to everyone.

    How do I justify the cost of an HRM platform to the board?

    Anchor on measured risk-score reduction across cohorts, tied to incident categories the board already tracks — credential compromise, data mishandling, shadow AI usage. A trended risk metric survives audit-committee scrutiny; a training completion percentage does not.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

  • What an On-Prem AI Cluster Really Costs in 2026

    What an On-Prem AI Cluster Really Costs in 2026

    The quote for the GPUs is the easiest number in your entire on-prem AI budget. An NVIDIA DGX B300 lists in the $300,000–$350,000 range as of mid-2026 — a figure your VAR will happily put in writing. The number nobody volunteers is the $2–5 million per rack row it can take to retrofit a legacy data center for the direct liquid cooling that system requires. After twenty-plus years of watching infrastructure purchases get approved, I can tell you which number kills more projects.

    This guide consolidates the 2026 price anchors that are surprisingly hard to find in one neutral place — GPU modules, full systems, cooling retrofits, lead times, and the software stack from Broadcom/VMware or Red Hat that turns racks into a platform. Numbers are market ranges, not quotes; list pricing varies by channel and volume.

    The 2026 price anchors

    Start with the table. These are the consolidated market ranges as of mid-2026 — the numbers I’d use for a first-pass budget before any vendor conversation.

    Price anchor (mid-2026)Notes
    NVIDIA B200 module~$30K–$50K+ per GPUOEM board pricing near the bottom; spot and low-volume near the top
    DGX B200 (8 GPUs)$280K–$320KAir-coolable in most configurations
    DGX B300 (8 GPUs)$300K–$350KShipping since January 2026; 288GB HBM3e per GPU; direct liquid cooling required
    Liquid cooling retrofit$2M–$5M per rack rowCDUs, plumbing, facility water, floor loading — legacy data centers
    Lead times6–12 monthsSystems, switching, and facility work; order the facility first

    The verdict up front: GPU list price is not your gating decision. Facility readiness is. Everything below unpacks why.

    NVIDIA Blackwell pricing in practice

    NVIDIA sells you compute three ways, and the per-GPU math differs meaningfully. Bare B200 modules run anywhere from roughly $30K to $50K-plus each depending on channel and volume — hyperscaler-adjacent OEM deals sit near the bottom, one-off enterprise purchases near the top. An 8-GPU DGX B200 at $280K–$320K works out to $35K–$40K per GPU with the chassis, NVLink fabric, CPUs, and support contract included, which is why buying integrated systems usually beats assembling HGX-based servers unless you’re ordering at real scale.

    The DGX B300 — shipping since January 2026 — is the more interesting buy. At $300K–$350K it carries 288GB of HBM3e per GPU, double the B200’s capacity, which matters more than raw FLOPS for the large-context inference and fine-tuning work most enterprises actually run. The catch: at roughly 1,400W per GPU, air cooling is off the table. Direct liquid cooling is mandatory, and that single spec sheet line is what drags your facilities team into the purchase. NVIDIA’s strength here is an integrated, predictable stack; its weakness is that the reference designs assume a data center most enterprises don’t have yet — I’ve broken that down in our analysis of NVIDIA’s AI factory reference architecture.

    Takeaway for the meeting: budget $35K–$44K per GPU at the system level, and treat anything quoted materially below that as a signal to check what’s missing — support, networking, or delivery date.

    Facility readiness is the real gate

    Here’s the line item that doesn’t appear on any GPU quote: retrofitting an existing data center row for direct liquid cooling runs $2–5 million. That covers coolant distribution units, secondary loop plumbing, facility water hookups, leak detection, and often structural work — a loaded liquid-cooled rack can exceed the floor loading assumptions of buildings designed for 8kW racks. A DGX B300 row wants 100kW-plus per rack. Most enterprise data centers were built for a tenth of that.

    Lead times compound the problem. Systems, InfiniBand or Spectrum-X switching, and CDU hardware are each quoting 6–12 months as of mid-2026, and facility construction runs on its own schedule. The practical sequencing rule: start the facility assessment before you commit to silicon. I’ve watched teams take delivery of seven-figure hardware that sat crated for two quarters because the cooling loop wasn’t done. If your building can’t get there, your realistic options are colocation with liquid-cooled capacity — increasingly available, at a premium — or staying air-cooled on DGX B200-class systems and accepting the memory ceiling.

    Takeaway: if you haven’t priced the retrofit, you don’t have a budget yet — you have a hardware quote.

    The software layer: Broadcom/VMware vs. Red Hat

    Bare racks don’t serve models. Two platform stacks dominate serious enterprise on-prem AI in 2026, and both add real money.

    Broadcom/VMware positions VMware Cloud Foundation as the private AI platform — VCF 9.1, announced in May 2026, leans hard into that message, with Private AI Services (the evolution of VMware Private AI Foundation with NVIDIA) layering model runtime, vector database, and GPU virtualization on top of vSphere. The strength is operational: if your team already runs VCF, GPUs become another resource pool under a familiar control plane, with vMotion-class operations and mature multi-tenancy. The weakness is cost structure — Broadcom’s per-core subscription licensing means the platform bill scales with your whole estate, and post-acquisition pricing has pushed some shops to re-evaluate. It fits VCF-committed enterprises consolidating AI into an existing private cloud.

    Red Hat comes at it Kubernetes-first. OpenShift AI (self-managed) adds model serving, pipelines, and workbenches on top of OpenShift, with NVIDIA’s GPU Operator handling device plumbing. The strength is alignment with how ML engineers actually work — containers, GitOps, open-source tooling like vLLM — and subscription pricing tied to worker cores rather than the full estate. The weakness: you’re operating Kubernetes as the foundation, which is a heavier lift for virtualization-centric teams, and vGPU licensing still applies per worker node. It fits organizations with platform engineering muscle and container-native workloads. The full head-to-head is in our VMware vs. OpenShift AI comparison.

    Either way, add NVIDIA AI Enterprise — licensed per GPU on subscription — plus the platform itself. For a 32-GPU cluster, plan low-to-mid six figures over three years for the software layer. Not decisive against a seven-figure hardware bill, but not rounding error either.

    A worked budget: 32 GPUs, all-in

    Here’s what a first serious cluster — four 8-GPU B300-class systems — actually totals over three years, using mid-2026 ranges.

    RangeShare of total
    4× DGX B300 systems$1.2M–$1.4M~25–35%
    Networking (fabric, NICs, cabling)$200K–$350K~5%
    High-throughput storage$150K–$400K~5%
    Facility (liquid cooling row retrofit, power)$2M–$5M~45–55%
    Software (NVIDIA AI Enterprise + VCF or OpenShift AI, 3yr)$300K–$700K~7–10%
    Three-year total~$4M–$8M

    Read the shares, not just the totals. For a first deployment, the facility line is bigger than the GPUs. That inverts on your second and third rows — the retrofit amortizes, and marginal cluster cost drops toward the hardware number. Which is exactly why the buy decision should be evaluated as a multi-year program, not a single purchase.

    When the on-prem math works

    Rules of thumb I’d defend in front of a CFO. On-prem wins when utilization is sustained — if you can keep the cluster above roughly 60% busy with training, fine-tuning, or steady inference, ownership beats renting within two to three years. It wins on data gravity and compliance: regulated workloads that can’t leave your walls make the cloud comparison moot. And it wins at program scale, where row two and row three ride on row one’s facility spend.

    It loses when demand is spiky or experimental, when you need capacity in weeks rather than the 6–12 months hardware and construction actually take, and when your building needs the full retrofit for a single row you might never expand. The detailed crossover math — utilization thresholds, cloud GPU pricing, residual value — is in our buy-vs-rent break-even analysis. Short version: below sustained 40% utilization, rent; above 60%, buy; in between, the facility question decides it.

    Frequently asked questions

    How much does an NVIDIA B200 cost in 2026?

    Individual B200 modules trade in a wide band — roughly $30K at the OEM/volume end to $50K-plus for low-volume purchases as of mid-2026. Most enterprises buy them inside integrated systems: an 8-GPU DGX B200 runs $280K–$320K, or about $35K–$40K per GPU including chassis, fabric, and support.

    Does the DGX B300 require liquid cooling?

    Yes. At roughly 1,400W per GPU, the DGX B300 requires direct liquid cooling — there is no air-cooled configuration. Budget $2–5M per rack row if your data center needs the retrofit, or plan for colocation with liquid-cooled capacity.

    Is it cheaper to build an on-prem GPU cluster or rent cloud GPUs?

    It depends on utilization. Sustained utilization above roughly 60% favors ownership within two to three years; below 40%, cloud rental usually wins. Facility readiness shifts the math — if you need a multi-million-dollar cooling retrofit for one row, the break-even pushes out considerably.

    How long are lead times for GPU servers in 2026?

    Plan on 6–12 months for B300-class systems, high-speed switching, and cooling infrastructure as of mid-2026 — and facility construction runs in parallel on its own timeline. Start the facility assessment before ordering silicon.

    What software do you need to run an on-prem AI cluster?

    At minimum: NVIDIA AI Enterprise (licensed per GPU) plus a platform layer — VMware Cloud Foundation with Private AI Services for virtualization-centric shops, or Red Hat OpenShift AI for Kubernetes-native teams. Expect low-to-mid six figures over three years for a 32-GPU cluster’s software stack.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

  • Copilot vs. Gemini Enterprise: The 2026 Rollout Decision

    Copilot vs. Gemini Enterprise: The 2026 Rollout Decision

    Run the numbers at 1,000 seats and these two AI rollouts are no longer in the same budget conversation. An all-in Microsoft 365 Copilot deployment lands somewhere between $66 and $87 per user per month once you count the base-license uplift, governance tooling, and rollout overhead. A Gemini deployment on Google Workspace typically settles in the $48–60 range. That is a $216,000–$324,000 annual gap — enough to fund the governance program most rollouts skip.

    And the math just moved again. On July 1, 2026, Microsoft restructured its licensing, folding Copilot into higher-priced bundles instead of selling it purely as a $30 standalone add-on. Every Microsoft shop re-prices its AI rollout this year whether it planned to or not. Here is the side-by-side, the honest downsides on both sides, and the decision rules I would carry into a renewal negotiation.

    The verdict

    If your estate is Microsoft 365 E3 or E5, your power users live in Excel, Outlook, and Teams, and you have real agent ambitions, Copilot is the defensible pick — but only at negotiated pricing, and only for the personas that will actually use it. If per-seat cost is the deciding variable and Workspace is already your suite, Gemini wins the TCO fight by roughly $18–27 per user per month and the licensing math is simpler. Mixed estates should pilot both and decide per persona, not per company. Nobody should be signing a 100% rollout at list price in 2026. That era is over.

    What changed

    Microsoft’s July 1, 2026 packaging reset is the forcing event. New bundled SKUs arrived — Business Standard with Copilot at $23.50 per user per month, Business Premium with Copilot at $32, and the E7 “Frontier Suite” at $99, which packages Microsoft 365 E5, Copilot, Agent 365, and the Entra Suite into a single SKU (it went generally available May 1, 2026). Base prices rose at the same time: E3 moved from $36 to $39 and E5 from $57 to $60. The enterprise Copilot add-on holds at $30, while the small-business Copilot add-on was repriced to $21. Existing customers keep current pricing until renewal — which means your renewal date is now a pricing event, and Microsoft’s account teams know it.

    Google went the opposite direction. In January 2025 it killed the standalone Gemini Business and Gemini Enterprise add-ons ($20 and $30 respectively) and folded Gemini into Workspace plan pricing, raising list prices roughly 17–22% across tiers. As of mid-2026, Business Standard lists in the $14–18 range and Business Plus in the $22–28 range depending on term and region — list pricing varies. Then, in October 2025, Google muddied its own story by launching a separate agent platform also named Gemini Enterprise, priced from roughly $21 per user per month with a Standard tier around $30. Two products, one name, and — critically — they do not share memory or context. More on that below.

    Sticker price vs. real cost

    Microsoft 365 CopilotGoogle Gemini (Workspace)
    Licensing model$30/user/mo add-on, or bundled SKUs from July 2026 (E7 at $99 all-in)Included in Workspace plan pricing since Jan 2025; no standalone add-on
    List price signalE3 $39 or E5 $60 base + $30 add-onBusiness Standard ~$14–18; Business Plus ~$22–28 (varies by term)
    Real TCO, as of mid-2026~$66–87/user/mo all-in~$48–60/user/mo all-in
    Annual cost, 1,000 seats~$792K–$1.04M~$576K–$720K
    Where hidden costs liveSharePoint permission remediation, Purview governance, training, bundle pressureGemini Enterprise (agents) is a second line item; change management for Office-habituated users

    The TCO ranges are what matter, not the list prices. Copilot’s $30 sticker has barely moved since launch — what moved is everything around it: the base-license increases, the security and governance work you must fund before rollout, and the bundle architecture nudging you toward E7. Gemini’s costs are more honest at the sticker but hide a fork: the moment you want serious agent workloads, you are buying a second product.

    Where Copilot wins — and where it doesn’t

    Copilot’s strength is that it lives where your data already lives. If a decade of institutional knowledge sits in Exchange, SharePoint, and Teams, Copilot’s grounding in that graph is something Gemini cannot replicate from outside. The agent story is also further along: Copilot Studio plus the new Agent 365 layer gives Microsoft the most coherent path from “chat assistant” to “governed fleet of agents” of any suite vendor, and E7 bundles the identity and security controls that agent sprawl will eventually demand. For Excel-heavy finance and ops teams, the productivity delta is real and measurable.

    The downsides are equally concrete. Price is the obvious one — a $30 add-on stacked on a base license that just got more expensive. Less obvious is the pre-work: Copilot surfaces whatever the user can technically access, so years of SharePoint oversharing become day-one data-leak exposure, and remediation is rarely budgeted. Value is also uneven across personas — frontline and light-usage staff often generate single-digit weekly prompts, which is shelfware at $30 a seat. And the July 2026 packaging is deliberate bundle pressure: the standalone add-on path still exists, but every incentive now points toward bigger SKUs.

    Where Gemini wins — and Google’s naming problem

    Gemini’s case starts with the money. Because Google folded AI into Workspace plan pricing, there is no per-seat add-on decision to litigate — every user on Business Standard and above gets Gemini in Gmail, Docs, and Meet as part of the plan. For large-document and long-context work, Gemini’s models are genuinely strong, and Workspace-native shops report far less deployment friction because there is no separate license to assign, meter, and justify. The budgeting conversation is one line instead of three.

    Now the honest downsides. Google is running two products under one name: Gemini in Workspace (the bundled assistant) and Gemini Enterprise (the October 2025 agent platform, priced separately from roughly $21–30+ per user per month). They do not share memory or context — a conversation in one is invisible to the other — so an enterprise that wants both the assistant and the agent platform is paying twice and stitching the experience together itself. Desktop Office parity remains a weakness for Excel power users. And Gemini’s enterprise admin and DLP controls, while improving, are younger than Microsoft’s — worth pressure-testing against your AI governance framework before you commit regulated workloads.

    What to do about it

    • Re-price before your renewal, not at it. If your Microsoft renewal lands after July 1, 2026, model three scenarios now: E3/E5 plus the $30 add-on, E7 at $99, and a reduced-seat Copilot footprint. Walking in without your own math means accepting Microsoft’s.
    • Set a break-even bar per persona. At $87 all-in TCO, Copilot needs to return roughly two saved hours per user per month at loaded cost to break even; Gemini’s bar is closer to 75 minutes. License the personas that clear the bar. Cut the ones that don’t at the first true-up.
    • Workspace shops: decide the Gemini Enterprise question separately. The bundled assistant is effectively free once you are on current Workspace pricing. The agent platform is a second purchase with its own business case — treat it like one.
    • Fund governance before seats go live. Permission remediation, usage policy, and a shadow-AI policy cost less than the incident they prevent — and unmanaged personal-account AI use is exactly what a delayed rollout breeds.
    • Keep the build-side decision separate. Suite assistants and developer platforms are different purchases; if you are also choosing where custom agents get built, that is the Bedrock vs. Vertex AI vs. Azure AI Foundry decision, and it does not have to match your suite vendor.

    The takeaway for the meeting: Copilot is the deeper product on a Microsoft estate, Gemini is the cheaper product on any estate, and the July 2026 licensing reset means doing nothing is itself a pricing decision.

    Frequently asked questions

    Is Copilot or Gemini better for business?

    It depends on your estate. Microsoft-centric organizations with heavy Excel, Outlook, and Teams usage get more from Copilot’s grounding in their existing data. Workspace organizations, and anyone optimizing cost per seat, get better value from Gemini — roughly $18–27 per user per month less all-in as of mid-2026.

    How much does Microsoft 365 Copilot really cost per user?

    List price is $30 per user per month as an add-on, but realistic all-in cost runs $66–87 once you include the E3/E5 base license increases, permission remediation, governance tooling, and training. At 1,000 seats that is roughly $792K–$1.04M per year.

    Is Gemini included in Google Workspace?

    Yes. Since January 2025, Google has bundled Gemini into Workspace Business and Enterprise plans rather than selling it as an add-on, raising plan prices roughly 17–22% in the process. Note that Gemini Enterprise — the agent platform launched in October 2025 — is a separate product with separate pricing, and it does not share context with Gemini in Workspace.

    What changes with Microsoft Copilot licensing in July 2026?

    From July 1, 2026, Microsoft sells new Copilot-inclusive bundles — Business Standard with Copilot at $23.50, Business Premium with Copilot at $32, and Microsoft 365 E7 at $99 per user per month — alongside base price increases for E3 and E5. Existing customers keep current pricing until their next renewal.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

  • AI SOC Platforms in 2026: Charlotte AI vs. Security Copilot

    AI SOC Platforms in 2026: Charlotte AI vs. Security Copilot

    Every major security vendor now ships a named AI SOC analyst. CrowdStrike says Charlotte AI autonomously handles a reported 40–60% of Tier 1 alert volume for teams that let it. Microsoft has pushed Security Copilot’s autonomous triage beyond phishing into identity and cloud alerts. Google rolled out threat-hunting and detection-engineering agents at Cloud Next. If your SOC contract or your headcount plan comes up for review this year, you are going to be asked which of these to bet on — and whether Tier 1 hiring can stop.

    This brief compares the two front-runners — Charlotte AI and Security Copilot — head to head, positions Google Cloud, Palo Alto Networks, and Zscaler around them, and gives you the contract language and measurement gates you need before you cut a single analyst seat.

    The verdict

    If you are a Falcon shop, buy Charlotte AI. If you are an E5 shop living in Defender and Sentinel, buy Security Copilot. Neither is worth ripping out your existing platform to get. The real decision in 2026 is not which agent is smarter — it is how much autonomy you grant, in writing, and how you verify the false-negative rate before anyone touches the org chart. Cross-platform buyers who want AI triage without committing to one ecosystem should look at Google or the service-led route Zscaler is building — covered below.

    What changed

    Twelve months ago “AI in the SOC” meant a chat sidebar that summarized alerts. In 2026 it means named agents with delegated authority. CrowdStrike shipped Charlotte AI Detection Triage — which classifies each new detection as true or false positive, assigns priority, and recommends action — and then launched Charlotte AI AgentWorks at RSAC 2026, a no-code environment where security teams build, test, and deploy their own agents in natural language. Microsoft took its Phishing Triage Agent, the first Security Copilot agent to run genuinely hands-off, and extended the same autonomous triage pattern to identity and cloud alerts through its Security Alert Triage Agent in Defender. Google used Cloud Next to add threat-hunting and detection-engineering agents to its Unified Security stack, moving past the alert-triage and malware-analysis agents it previewed earlier.

    The takeaway for a VP: the category label “AI SOC platform” is new, but the buying pattern is old. Every vendor is selling headcount arbitrage — Tier 1 triage is roughly repetitive, expensive to staff at 24/7 coverage, and the first thing agents can plausibly absorb. The question is whether the absorption is real or just re-routed risk.

    Charlotte AI vs. Security Copilot, side by side

    CrowdStrike Charlotte AIMicrosoft Security Copilot
    Platform homeFalcon platform; endpoint-first telemetryDefender XDR, Sentinel, Entra, Intune, Purview
    Autonomous triage scopeEndpoint detections; vendor-reported 98% triage agreement with human analysts, trained on Falcon Complete decisionsPhishing triage first, now expanding to identity and cloud alerts; verdicts come with natural-language rationale
    Agent buildingAgentWorks — no-code, natural-language agent creation, launched RSAC 2026Prebuilt Microsoft and partner agents; custom agents via Copilot tooling and plugins
    Pricing modelModule licensing on Falcon; list pricing varies by tier and volumeConsumption-based Security Compute Units — costs scale with usage, as of mid-2026
    Best fitFalcon-standardized SOCs that want triage depth on endpoint and identity detectionsMicrosoft E5 estates that want agents across email, identity, cloud, and compliance surfaces

    The philosophical split matters more than the feature list. CrowdStrike trains its triage agent on the decisions of its own Falcon Complete MDR analysts — a continuous human-expert feedback loop — and sells accuracy as the headline. Microsoft sells breadth: its agents live inside the tools your team already opens every morning, and the consumption pricing means you can start at a few hundred dollars a month instead of a platform commitment. Depth versus surface area. Pick based on where your alerts actually originate.

    Where each one falls short

    Charlotte AI’s honest weaknesses

    Charlotte AI’s accuracy claims are vendor-measured, scoped to endpoint detections where Falcon’s telemetry is richest. Your email, SaaS, and network alert quality will not match the demo. AgentWorks is weeks-to-months old as an ecosystem — the third-party agent catalog is thin, and no-code agent building by junior staff creates its own governance problem. And everything assumes Falcon: if CrowdStrike is not your endpoint standard, the value collapses.

    Security Copilot’s honest weaknesses

    SCU consumption pricing is genuinely hard to forecast — teams routinely discover that an always-on triage agent burns compute units faster than the pilot suggested. Budget a 2–3x buffer over your pilot burn rate for year one. Agent quality is also uneven across the portfolio: phishing triage is mature, while the newer identity and cloud triage agents still route a meaningful share of verdicts back to humans. And Copilot’s usefulness degrades quickly outside the Microsoft estate — it is an E5 amplifier, not a neutral platform.

    Google, Palo Alto, and Zscaler

    Google Cloud is running third but closing. Its Unified Security agents now cover alert triage, malware analysis, threat hunting, and detection engineering, with Mandiant expertise informing the training loop. The detection-engineering agent is the sleeper — writing and tuning detections is Tier 3 work, and Google is the first to aim an agent above Tier 1. Fit: SecOps (Chronicle) customers and multicloud shops that resist single-vendor security stacks.

    Palo Alto Networks sells the agentic SOC as a platform-consolidation story. Cortex XSIAM was pitched as the SIEM replacement before “AI SOC” was a category, and its agentic layer extends that: automated triage and investigation embedded in a stack designed to swallow your SIEM, SOAR, and EDR budgets at once. Strong for teams already committed to consolidation; heavy for anyone who only wants triage help.

    Zscaler is the wildcard. Its Red Canary acquisition bought a decade of MDR triage judgment — exactly the training data autonomous triage needs — and points to an agentic SOC delivered as a service rather than as software you operate. We unpacked that play in our Zscaler–Red Canary agentic SOC analysis. Fit: leaner teams that would rather buy outcomes than build an agent fleet.

    What to do about it

    First, get “autonomous” defined contractually. Vendors use the word to mean anything from “drafts a verdict for human review” to “closes the alert unassisted.” Your MSA or order form should state which alert classes the agent may close without human sign-off, what the rollback path is, and who owns liability for a missed true positive. If the vendor will not commit to a false-negative measurement methodology in writing, treat the accuracy claims as marketing.

    Second, gate autonomy by blast radius. A sane 2026 policy: agents may auto-close informational and low-severity alerts, may auto-contain a single endpoint, but require human approval for identity disablement, production cloud changes, and anything touching executive or service accounts. Agent identities themselves need governance — scoped credentials, audit trails, and expiry — a problem we covered in our AI agent identity governance guide.

    Third, measure before you cut. Run the agent in shadow mode against your human queue for at least 90 days and compare verdicts. Track the disagreement rate on true positives specifically — that is your false-negative exposure, and it is the number that turns into breach cost if you get it wrong. Our 2026 data breach cost benchmarks give you the dollar figures to weigh against the loaded cost of the Tier 1 seats you are tempted to eliminate. If the agent disagrees with your analysts on more than 2–3% of confirmed true positives, it is not ready to own that alert class. Reassign Tier 1 staff toward validation and hunting before you reduce them.

    Frequently asked questions

    What is an AI SOC platform?

    An AI SOC platform embeds autonomous or semi-autonomous agents into security operations to triage alerts, investigate incidents, and in some configurations contain threats without step-by-step human direction. Leading examples in 2026 include CrowdStrike Charlotte AI, Microsoft Security Copilot agents, and Google’s Unified Security agents.

    Can AI replace Tier 1 SOC analysts?

    It can absorb a large share of Tier 1 alert volume — vendors report 40–60% in favorable conditions — but replacement is premature until you have measured false-negative rates in shadow mode on your own alert mix. The safer 2026 move is redeploying Tier 1 staff to agent validation and threat hunting.

    What is the difference between Charlotte AI and Security Copilot?

    Charlotte AI is CrowdStrike’s agentic analyst built into the Falcon platform, strongest on endpoint detection triage. Security Copilot is Microsoft’s agent framework spanning Defender, Sentinel, Entra, and Purview, priced by consumption. The right choice usually follows whichever platform already anchors your SOC.

    How much does Microsoft Security Copilot cost?

    Security Copilot is billed through Security Compute Units on a consumption model, so monthly cost depends on how many agents run and how often. As of mid-2026, expect pilots to start small but budget a significant buffer — always-on triage agents consume SCUs faster than most teams forecast.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

  • Cloud Egress Fees in 2026: What AWS, Azure, GCP Charge

    Cloud Egress Fees in 2026: What AWS, Azure, GCP Charge

    Move 10 TB out to the internet this month and the bandwidth line alone runs roughly $913 on AWS, $882 on Azure, and $1,137 on Google Cloud’s Premium Tier. The same transfer out of Cloudflare R2 or Backblaze B2 costs approximately zero. That spread — nearly four figures a month on a single line item — is why egress pricing keeps showing up in every multicloud architecture review I sit in on, and why the 2024 “free exit” announcements from Google and AWS confused so many budget owners.

    This brief gives you the current per-GB numbers in one table, explains what the exit-fee waivers actually cover (much less than the headlines implied), and closes with thresholds for when egress should change your architecture rather than just your invoice.

    The 2026 egress benchmark

    These are internet egress rates as of mid-2026, standard list pricing, US regions. Committed-use discounts, CDN offload, and private interconnects all change the math — but this is the baseline every negotiation starts from.

    Free monthly allowanceFirst-tier rateAbove 150 TB10 TB/month bill (approx.)
    AWS100 GB$0.09/GB (first 10 TB)$0.05/GB$913
    Microsoft Azure100 GB$0.087/GB (first 10 TB)$0.05/GB$882
    Google Cloud (Premium Tier)Minimal (~1 GiB)$0.12/GB (first 1 TB)~$0.05/GB$1,137
    Google Cloud (Standard Tier)Minimal~$0.085/GBTiered lower~$850
    Cloudflare R2Unlimited egress$0$0$0
    Backblaze B23× stored data$0 within allowance$0.01/GB beyond$0 for most profiles

    Two footnotes that matter more than the table. First, these are internet egress rates only — cross-availability-zone traffic still bills at about $0.01/GB each way on all three hyperscalers, and NAT gateway processing adds roughly $0.045/GB on AWS. Chatty microservices generate egress-class charges without a single byte leaving the cloud. Second, list pricing varies by region and moves; treat anything beyond two decimal places as negotiable at enterprise scale.

    What changed

    In early 2024, Google Cloud announced free data transfer for customers leaving its platform, and AWS followed within weeks. Microsoft made a similar commitment for Azure. The driver was regulatory: the EU Data Act, which began applying in September 2025 and requires switching charges to be phased down, with a full ban on profit-bearing switching fees taking effect in January 2027.

    Here is the nuance the pricing calculators miss: the waivers cover exit, not operations. AWS’s program, for example, requires that you be moving essentially all your data off the platform, requests go through support, and the credits carry a limited migration window — around 60 days. Google’s works similarly. If you are running a steady-state multicloud architecture — analytics in BigQuery, serving from AWS, backups to a third provider — every gigabyte of that ongoing traffic still bills at the full rates in the table above. The waivers are a one-way door for leavers, not a discount for hybrid operators. That distinction is what actually drives architecture decisions, and it’s why the repatriation math we walked through in our cloud repatriation analysis now excludes exit bandwidth as a blocker: the toll to leave is gone, but the toll to straddle remains.

    AWS: predictable tiers, expensive middle

    AWS charges $0.09/GB for the first 10 TB of monthly internet egress after a 100 GB free allowance, stepping down through published tiers to $0.05/GB above 150 TB. The strength of the AWS model is predictability and negotiability — the tiers are documented, CloudFront offload is priced aggressively for content-heavy workloads, and at commitment levels egress is a standard line in every Enterprise Discount Program conversation. AWS also deserves credit for making its exit waiver unconditional on destination: you can move to any provider, not just on-premises.

    The weakness is the middle of the curve. A workload pushing 20–50 TB/month is too small for meaningful EDP leverage and too large to ignore a $1,700–$4,300 monthly bandwidth line. That band — common for SaaS companies serving media or model artifacts — is exactly where the zero-egress alternatives poach AWS storage workloads. AWS fits teams that value ecosystem depth and can either negotiate scale discounts or push static egress to CloudFront.

    Microsoft Azure: cheapest hyperscaler under 50 TB

    Azure’s $0.087/GB first tier makes Microsoft the cheapest of the big three below roughly 50 TB/month; above that its tiers converge with AWS at $0.07/GB and then $0.05/GB past 150 TB. For the Microsoft-standardized enterprise the practical advantage is bigger than the headline three-tenths of a cent, because so much traffic that would be billable egress elsewhere stays inside the Microsoft estate — ExpressRoute to on-premises, Microsoft 365 integration, Azure Front Door offload.

    Where Azure is weaker is transparency. Its bandwidth pricing page spreads charges across zones and services in a way that makes forecasting harder than on AWS, and inter-region rates vary by geography pairings that surprise teams expanding into Asia-Pacific. Azure fits organizations already committed to Microsoft licensing that can route most traffic over private paths; it is not obviously the value play for a greenfield, internet-facing workload.

    Google Cloud: priciest Premium Tier, with an escape hatch

    Google Cloud’s default Premium Tier — traffic rides Google’s backbone to the edge — is the most expensive first tier of the three at $0.12/GB for the first 1 TB, stepping down through tiers to roughly $0.05/GB at very high volumes, and its free allowance is negligible. Google was first to waive exit fees, a genuinely pro-customer move that AWS and Microsoft then matched, and its Standard Tier (public-internet routing at around $0.085/GB) is an escape hatch the other two don’t offer as cleanly.

    The catch is that Standard Tier trades performance for price — no global backbone, regional-only routing — so latency-sensitive products generally stay on Premium and pay for it. Google Cloud fits data-platform-centric shops where the gravity is BigQuery and Vertex AI and serving egress is modest; it fits poorly as a high-volume content origin unless you deliberately architect around Media CDN or Standard Tier.

    The zero-egress challengers

    Cloudflare R2 charges nothing for egress, ever — you pay for storage and per-operation fees. Backblaze B2 gives free egress up to three times your average monthly stored data, then about $0.01/GB. Neither is a hyperscaler replacement: you don’t get VPCs, managed databases, or an IAM estate. What they are is a pressure valve for the specific workload class where egress dominates cost — media origins, model weights and artifact distribution, backup restore paths, public datasets.

    The rule of thumb I give teams: when annual egress spend on an object-storage workload exceeds the storage spend itself, moving that bucket to R2 or B2 usually pays for the migration inside two quarters. S3-compatible APIs keep the switching cost low, which is precisely why AWS, Microsoft, and Google have not matched the model — zero egress is the challengers’ entire wedge.

    What to do about it

    Benchmarks are only useful with thresholds attached. Here are the diagnostics I use:

    • Egress under 5% of cloud spend: ignore it. Optimize compute and licensing first.
    • Egress at 5–15% of spend: tactical fixes — CDN offload for anything static, compress or dedupe transfer paths, kill cross-AZ chatter. Kubernetes clusters are chronic offenders here; topology-aware routing is one of the highest-leverage items in our Kubernetes cost optimization guide.
    • Egress above 15% of spend, storage-driven: re-architect. Move the heavy buckets to zero-egress object storage and keep compute where it is.
    • Considering a full exit: the waivers mean bandwidth is no longer the blocker — model the migration on labor and refactoring cost instead, and file the waiver request before you start moving data.

    The takeaway for the meeting: egress is now a design decision, not a tax. Leaving is free; staying multicloud is not.

    Frequently asked questions

    Which cloud provider has the cheapest egress fees?

    Among hyperscalers, Azure is cheapest below 50 TB/month at $0.087/GB; AWS and Azure converge above that. Cloudflare R2 and Backblaze B2 undercut all three with zero or near-zero egress, at the cost of a much narrower service catalog.

    Are AWS egress fees really free now?

    Only if you are leaving. AWS waives data transfer charges for customers migrating all their data off the platform, via a support request with a limited migration window. Ordinary operational egress still bills at standard rates starting at $0.09/GB.

    Does the EU Data Act ban egress fees?

    It bans charges for switching providers, phased in from September 2025 with a full prohibition on profit-bearing switching fees in January 2027. It does not ban operational egress pricing for workloads that stay put.

    How do I reduce cloud egress costs without changing providers?

    In order of effort: put a CDN in front of static and media traffic, eliminate cross-AZ and NAT gateway paths for high-volume flows, compress data in transit, and move egress-heavy object storage to a zero-egress provider while keeping compute in place.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

  • Leaving VMware: OpenShift Virtualization vs. the Field

    Leaving VMware: OpenShift Virtualization vs. the Field

    Broadcom renewal quotes are commonly resetting annual VMware spend 100–250% before anyone negotiates — and the old catalog of 8,000-plus SKUs has collapsed into a short list of VCF-led bundles. That combination changes the nature of the renewal meeting. It is no longer a procurement exercise; it is a build-vs-leave decision, and every quarter through 2027 another wave of enterprises hits it as their bridge agreements expire.

    This brief compares the exit paths that actually come up in those meetings — Red Hat OpenShift Virtualization, Nutanix AHV, Microsoft Hyper-V, and Proxmox — with the break-even math and the negotiating leverage each one buys you, even if you never migrate a single VM.

    What changed

    Broadcom finished what it started in 2024. Perpetual licensing is gone, the per-CPU metric became per-core with minimum core counts, and the product line contracted to a handful of subscription bundles anchored on VMware Cloud Foundation. vSphere 9 ships inside VCF 9 — there is no standalone Standard edition path to the current release. Customers who took one-year bridge deals in 2024–25 are now getting their first full-freight quotes, and the reported resets range from roughly double to several multiples of prior spend depending on how discounted the old agreement was.

    The strategic read: Broadcom is optimizing for its largest few thousand accounts and is comfortable shedding the long tail. If you are in that long tail, the renewal quote is the eviction notice. If you are a strategic account, the quote is an anchor for a negotiation Broadcom fully expects. Either way, walking in without a costed alternative is the one unforced error.

    The verdict up front

    There is no drop-in VMware replacement. Pick by destination, not by nostalgia. If your three-year direction is Kubernetes and containerized workloads, OpenShift Virtualization is the strongest strategic bet — you consolidate VMs and containers on one control plane and stop paying for two platforms. If you want the closest operational feel to vSphere with a mature HCI stack, Nutanix AHV is the safest like-for-like move. If you are a heavy Microsoft shop with Windows Server Datacenter licensing already on the books, Hyper-V is close to free at the margin. Proxmox wins on cost for smaller estates and edge sites, with the trade-off of a thinner enterprise support bench. Break-even on migration cost versus the Broadcom delta typically lands 9–14 months out — which means a funded migration plan pays for itself even as a pure negotiating instrument.

    Side-by-side: the four exit paths

    OpenShift VirtualizationNutanix AHVMicrosoft Hyper-VProxmox VE
    What it really isKubeVirt-based VMs running beside containers on OpenShiftFull HCI stack with its own hypervisor and management planeWindows Server role plus System Center / Azure Arc toolingOpen-source KVM platform with subscription support tiers
    Closest to vSphere ops?No — new operating modelYes — most familiar day-2 experiencePartly — familiar to Windows adminsPartly — vSphere-like concepts, leaner tooling
    Migration toolingMigration Toolkit for Virtualization (vCenter-aware, batch plans)Nutanix Move (mature, agentless)Azure Migrate / SCVMM conversionBuilt-in ESXi import tooling
    Best fitContainer-forward enterprises, app-modernization roadmapsVMware-like private cloud, HCI refresh cyclesMicrosoft-standardized estatesSMB, edge, labs, cost-driven segments of larger estates
    Main riskKubernetes skills gap; platform re-architectureYou trade one commercial vendor dependency for anotherRoadmap gravity pulls toward AzureEnterprise ecosystem depth (backup, GPU, certifications)

    OpenShift Virtualization: a platform shift, not a hypervisor swap

    Red Hat’s positioning is unambiguous. RHV — its old standalone hypervisor — was sunset, and OpenShift Virtualization is the designated successor. Built on the upstream KubeVirt project, it runs VMs as first-class Kubernetes objects next to containers, managed by the same operators, RBAC, and GitOps pipelines. The Migration Toolkit for Virtualization connects to vCenter, discovers inventory, and executes batched cutovers, and Red Hat has been aggressively courting Broadcom refugees with migration assessments and funded pilots.

    Be clear-eyed about what you are buying. This is an architectural shift, not a hypervisor swap. vMotion, DRS, and vSAN have functional equivalents — live migration, descheduler-driven rebalancing, ODF or third-party CSI storage — but they are configured differently, and some are less turnkey than the VMware features your team has run for fifteen years. Teams that already operate OpenShift absorb this quickly. Teams with zero Kubernetes muscle should budget six months of enablement before the first production wave, or the migration stalls in pilot. The upside is real: one platform, one skills investment, and a direct on-ramp to the same infrastructure conversation covered in our private AI platform comparison, where OpenShift’s container-native footing pays a second dividend.

    The pragmatic paths: AHV, Hyper-V, Proxmox

    Nutanix AHV is the path of least operational disruption. The hypervisor is bundled into the Nutanix Cloud Platform licensing, Move handles agentless migrations from ESXi well, and the day-2 experience — one console, integrated DR, one throat to choke — is the closest thing to what vSphere admins already know. The caveats: it is strongest on Nutanix’s HCI model, so estates committed to external SAN arrays need to validate the fit, and you are consciously trading one commercial vendor dependency for another. Nutanix knows why you are shopping and prices accordingly, but multi-year list pricing has been the more predictable of the two — as of mid-2026, that predictability is itself a selling point.

    Microsoft Hyper-V is the option most enterprises underrate. If you already license Windows Server Datacenter, the hypervisor rights are effectively paid for, and Azure Arc has quietly become a credible multi-site management layer. Windows-heavy estates can cut the VMware line item to near zero. The honest counterweight: Microsoft’s energy goes where Azure goes, standalone SCVMM tooling feels dated next to vCenter, and Linux-heavy or KVM-ecosystem shops will feel the friction.

    Proxmox VE has graduated from lab curiosity to legitimate line item, with built-in ESXi import tooling and subscription support that costs a rounding error next to a VCF quote. For sub-500-VM estates, edge sites, and dev/test tiers it is often the rational answer. At true enterprise scale the ecosystem thins — certified backup integrations, GPU virtualization depth, and 24/7 severity-one support all require more diligence than the incumbents demand.

    The honest downsides — both sides

    Staying has a defensible case. VCF is genuinely good engineering — the integrated stack, mature HA/DRS behavior, and the deepest third-party ecosystem in the industry are not marketing fiction. If you negotiate the delta down to 30–50% and lock multi-year caps, staying can beat a disruptive migration on three-year cost, especially for estates over a few thousand VMs where migration labor dominates.

    • Leaving costs more than the license math suggests: runbooks, monitoring integrations, backup re-platforming, and staff retraining routinely add 20–40% on top of naive migration estimates.
    • Staying costs more than the quote suggests: Broadcom has shown it will re-price at every renewal, and each cycle you stay, your negotiating leverage decays as alternatives-readiness goes stale.
    • Partial exits are underrated: moving the 40–60% of workloads that are easy — dev/test, stateless tiers, Windows fleets to Hyper-V — shrinks the renewal while sidestepping the hard 10%.

    What to do about it

    Start 12 months before renewal, not three. Build a real, costed migration plan for one credible alternative — vendor quotes, migration-services estimate, pilot cluster actually running. A funded alternative, even one you never execute, is reliably worth another 10–20% off the Broadcom quote plus multi-year price caps, because Broadcom’s account teams discount against demonstrated flight risk, not against complaints. Then run the break-even: if the annual delta between your old spend and the new quote pays for the migration in 9–14 months — the common range we see — leaving is the financially conservative choice, not the adventurous one. Above 24 months, negotiate hard and stay. In between, do the partial exit. The broader market context — including who is repatriating what — is in our cloud repatriation analysis and the full VMware alternatives field guide.

    The line for your steering committee: every VMware renewal is now a build-vs-leave decision, and the cheapest option in the room is the one with a funded Plan B attached.

    Frequently asked questions

    Is OpenShift Virtualization a direct replacement for VMware vSphere?

    No. It runs VMs capably via KubeVirt, but it is a Kubernetes-native operating model, not a vSphere clone. Features like DRS and vSAN have equivalents that work differently and demand Kubernetes skills. Treat it as a platform migration with a VM-hosting outcome, and it succeeds; treat it as a hypervisor swap, and it disappoints.

    How much have VMware prices increased under Broadcom?

    It varies widely by prior discounting and bundle mapping, but 100–250% resets on renewal are common before negotiation, and outliers run far higher. The shift to per-core subscription bundles means lightly-loaded hosts and previously discounted enterprise agreements see the sharpest jumps.

    What happened to Red Hat Virtualization (RHV)?

    Red Hat sunset RHV and named OpenShift Virtualization as its successor. Existing RHV customers were given migration paths onto OpenShift, which is why Red Hat’s VMware-exit pitch centers on one converged platform rather than a standalone hypervisor.

    Is Proxmox ready for enterprise production workloads?

    For small-to-mid estates, edge sites, and non-critical tiers, yes — thousands of organizations run it in production. For large regulated enterprises, the gaps are ecosystem depth and support scale rather than core hypervisor quality, so scope it to the segments of the estate where those gaps do not bite.

    How long does a VMware migration actually take?

    Plan on 6–18 months end to end for a mid-size estate: one quarter for pilot and tooling validation, then wave-based cutovers. The long pole is rarely moving disks — it is re-platforming backup, DR, and monitoring integrations, and retraining the operations team on the new stack.

    Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.