For many enterprise leaders today, cloud strategy is no longer about commitment. It is about control over cost, risk, and data.
Over the past decade, cloud-first approaches helped organizations move quickly, scale on demand, and modernize without heavy upfront investment. That logic still holds for many workloads. What has changed is tolerance for opacity around cost behaviour, performance, security, and regulatory exposure – particularly as AI-driven workloads and data-intensive applications place new demands on infrastructure.
This reassessment is happening globally, but in Southeast Asia it is shaped by a distinctive set of conditions that raise the stakes of infrastructure decisions. Many organizations in the region adopted cloud rapidly, leapfrogging traditional on-premise build-outs. As governments formalize data sovereignty, security, and localization requirements, enterprises are going beyond data residency toward true cloud sovereignty. The result is an environment where infrastructure decisions must balance scale and speed with jurisdiction, latency, and long-term cost predictability.
From cloud enablement to cloud accountability
The core value proposition of cloud has not disappeared. Elastic capacity, rapid provisioning, and access to advanced services remain compelling. What has changed is how those benefits are evaluated. The “cloud-first” principle has now been replaced by a more deliberate and disciplined “cloud-smart” strategy.
Recent industry research shows that enterprises are moving away from defaulting all workloads to public cloud. Instead, most now take a more intentional, workload-by-workload approach- intentionally balancing public and private environments based on security, compliance, performance, and cost visibility. A significant share are actively reassessing where existing workloads run, including shifting some functions back to private or on-premise environments when the economics or risk profile no longer make sense.
The biggest driver of this shift is the economics of AI. As AI workloads scale, cost behaviour becomes harder to predict. Data egress, inter-region traffic, and infrastructure utilization patterns that were tolerable at a smaller scale now attract closer scrutiny.
Infrastructure growth meets geopolitical and regulatory reality
These strategic decisions are unfolding against a backdrop of rapid physical infrastructure expansion. Across Asia-Pacific, data-centre capacity is accelerating to meet demand from cloud services, AI computing, and digital transformation initiatives. Established hubs such as Singapore continue to grow, while emerging markets including Thailand and Malaysia are attracting significant investment.
This expansion matters because cloud strategy does not exist in abstraction. Every workload ultimately runs somewhere, subject to power constraints, latency, regulatory oversight, and local capacity. This reality is now intersecting with two powerful, parallel forces. Every workload ultimately runs somewhere, subject to power constraints, latency, regulatory oversight, and local capacity. That physical reality is now intersecting with two powerful, parallel forces.
On one hand, rising geopolitical volatility has made reliance on a single nation’s cloud providers a board-level risk, forcing a more considered diversification of infrastructure partners. On the other hand, governance requirements across the region are becoming clearer and more prescriptive. Data residency rules, sector-specific regulations, and resilience expectations increasingly shape how systems are designed.
With each conflict and regulatory option adding layers of complexity, infrastructure decisions that once optimised for scale and convenience now require more granular engineering judgement. Goals are now focused on resilience and technological autonomy, highlighting the importance of technical sovereignty controls, such as the ability to ‘keep your own key’ (KYOK) to ensure that no one can access an organization’s most valuable data. For IT leaders, this means cloud strategy increasingly resembles an optimization problem rather than a declaration of intent.
Repatriation in practice
To understand how these competing pressures play out, consider two very different organizations navigating the same regional shift.
The first is a healthcare provider operating across multiple Southeast Asian markets. For years, the organization has built its digital infrastructure on international public clouds – patient portals, imaging systems, analytics platforms. But regulatory frameworks that didn’t exist when those decisions were made are now forcing a rethink. Indonesia’s 2023 Health Law, Singapore’s Health Information Bill, and similar measures across the region are imposing new requirements around where sensitive patient data can reside.
The response won’t be a wholesale retreat from the public cloud. Core patient records, which require absolute control over data access, will likely need to move to sovereign or private infrastructure; de-identified analytics and research workloads probably won’t. But the hard part isn’t knowing what the regulations demand- it’s understanding which workloads fall into which category, what it actually costs to run them in each environment, and whether repatriation makes sense even where it isn’t mandated.
The second organization is a manufacturer with operations across the region. It faces little regulatory pressure around data localization, but it’s exquisitely sensitive to cost and latency. Factory floors now run on IoT sensor networks feeding predictive maintenance algorithms; quality control depends on AI models processing inspection data in real time. For these workloads, edge deployments close to the production line will outperform a round trip to a hyperscaler in another country.
But supplier portals, demand forecasting, and ERP systems benefit from the scale that public cloud provides. The question isn’t cloud or not-cloud – it’s which workloads belong where, and whether the organization has sufficient visibility into the true cost and performance implications to make that call confidently.
What both examples illustrate is the way in which repatriation means navigating subtle trade-offs. The organizations that emerge from this strongest will be the ones that can see clearly what they’re running, what it costs, and what it’s worth.
Clouded judgement?
Southeast Asian enterprises are contending with a global rethink of cloud strategy as they scale their digital foundations while facing tightening domestic regulations and geopolitical uncertainty.
The organizations that manage this transition well will not be those that abandon cloud, but those that treat infrastructure as a portfolio of choices, continuously assessed against cost, performance, and risk. That requires clearer insight, stronger financial discipline, and the ability to make trade-offs explicit.
Cloud-first approaches simplified decisions; what comes next demands precision. It requires a move from simply consuming cloud services to architecting infrastructure where every choice is deliberate and justified.
Matt Pinter is APAC Field CTO of IBM Apptio.
TNGlobal INSIDER publishes contributions relevant to entrepreneurship and innovation. You may submit your own original or published contributions subject to editorial discretion.
Featured image: Growtika on Unsplash
74% of GBS leaders have an AI vision; only 20% can prove it worked