Public vs Private vs Hybrid Cloud: Choosing a Deployment Model

Most businesses do not choose a deployment model. They end up with one. A file server nobody dares move, a Microsoft 365 tenant, two applications in a public cloud and a backup appliance in the comms cupboard adds up to a hybrid estate whether anyone planned it or not. That is worth saying plainly because the useful decision is not public versus private; it is which workloads belong where, and who is accountable for the seams between them.

The four models, as NIST defines them

The reference definition is NIST Special Publication 800-145, published in September 2011. It is two pages long and still the clearest thing written on the subject. It lists five essential characteristics of cloud computing, on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service, and then four deployment models. The fourth, community cloud, gets forgotten, which is a shame because it describes what healthcare consortia and sector regulators actually build.

One nuance in the NIST text is frequently misread. A private cloud does not have to be in your building, and it does not have to be run by your staff. A dedicated, single-tenant environment operated by a provider in their facility is still a private cloud under the definition. That matters commercially: you can get single-tenancy and residency guarantees without buying hardware, which is how a lot of regulated workloads are actually hosted.

Why hybrid became the default

Hybrid won because migrations are never finished. There is always a workload with a licence that does not transfer, a vendor who will not support virtualisation, a data set too large to move economically, or an application whose original author left in 2016. Flexera’s 2026 State of the Cloud Report found 73% of its 753 respondents operating hybrid estates, up three points on the previous year. That is not a strategy statement. It is a description of unfinished work, and it is the normal condition.

The surrounding numbers from that report are worth holding onto. Sixty-eight percent of respondents still rank optimising cloud costs as their top priority. Estimated wasted spend on infrastructure and platform services rose to 29%, the first increase in five years, with cloud-based AI workloads named as the cause. Use of unit economics, measuring cost per customer or per transaction rather than per server, climbed from 40% to 49%.

Read together, those figures say something uncomfortable. The complexity of running two environments is being paid for in waste rather than solved. Hybrid is the right answer often enough, but it is not a free answer, and the cost shows up in the 29% nobody can account for.

What the repatriation numbers really say

Repatriation became a headline in 2026, and the headlines are mostly louder than the data. Broadcom’s 2026 enterprise survey found that 83% of enterprises were evaluating moving workloads from public cloud back to private infrastructure, that 50% had already repatriated some workloads, up from 35% in 2025, and that a further 33% were considering it. The same research found cost had overtaken security as the top public cloud concern, and noted that public cloud investment was still growing, just at about half the rate of private cloud investment.

A separate survey of 212 senior IT decision-makers commissioned by Cloudian and conducted by Centiment found 89% planning to expand their on-premises footprint over the following two years, and 75% reporting they had already moved at least some workloads back from public cloud in the previous 24 months.

Here is how we read it. Nobody is leaving the public cloud. A lot of organisations are moving specific workloads, usually predictable, high-volume ones with heavy storage or steady compute, onto infrastructure they control, while continuing to put new and variable work in public cloud. That is not a reversal. It is what a maturing market looks like once finance starts asking per-workload questions.

Where each model wins on cost

Cost comparisons between models collapse into one variable: utilisation. Public cloud charges you by the hour, so idle capacity is free to give up. Private infrastructure is paid for whether you use it or not, so every idle hour is wasted capital. The crossover point is simply the utilisation level at which the hourly rate exceeds the amortised capital cost.

That gives you a straightforward test. If a workload runs flat out, 24 hours a day, with predictable growth and no seasonality, private or dedicated hosting will usually be cheaper over three years. If it spikes, if it only runs in business hours, if you cannot forecast next year’s load, or if it might be switched off entirely, public cloud is cheaper even at a higher unit rate, because you stop paying the moment you stop using it.

Commitment discounts complicate the picture in public cloud’s favour. Reserved capacity and savings plans reduce compute cost substantially for steady workloads, which is exactly the category private infrastructure was supposed to win. We walk through that machinery in how AWS is priced. The honest answer is that for many mid-sized workloads a three-year commitment in public cloud now beats a three-year hardware refresh, once you price the staff time either option consumes.

Sovereignty, residency and the 2027 deadline

Residency has become the strongest non-financial argument for private and sovereign deployment, and the market reflects it. Gartner forecast worldwide sovereign cloud infrastructure-as-a-service spending to total $80 billion in 2026, a 35.6% rise on 2025. Public cloud providers have responded with geography boundaries: Microsoft documents over 70 Azure regions, each sitting inside a single geography that acts as a fixed data residency boundary.

For most businesses that is sufficient. A contract requiring data to stay in the European Union, the United Kingdom, Australia or the United Arab Emirates can be satisfied by choosing the right region and documenting the choice. Private deployment becomes necessary when the requirement goes further: no foreign operator access at all, specific personnel vetting, or an auditor who wants to walk the floor.

One date belongs in every contract discussion this year. Article 29 of the EU Data Act prohibits providers of data processing services from imposing any switching charges from 12 January 2027. Since January 2024 those charges have been capped at the costs directly incurred. After the deadline, the one-off cost of moving between providers stops being a lock-in mechanism, although cost-based charges can still apply to ongoing parallel use across two providers. If you are signing a three-year agreement now, it will outlive that change.

Choosing, in four questions

Skip the model and ask about the workload. These four questions settle the placement of almost anything we are asked to review.

1. Is the load predictable? Flat and forecastable points at private or dedicated capacity. Spiky, seasonal or unknown points at public cloud.
2. Does the data have to live somewhere specific? If a named country is enough, pick a region. If the requirement names personnel or physical access, you need private or sovereign capacity.
3. Who is going to operate it at 3am? Managed services cost more per hour and far less per incident. Be honest about the team you actually have, not the one on the org chart.
4. What does moving the data cost? Price the egress and the migration before you commit, in both directions. The answer changes after January 2027 for switching, but not for everyday traffic.

If the answers point in different directions for different workloads, you have a hybrid estate, and that is fine. Just make somebody accountable for the seams. The same logic applies one layer further out when you add site-level compute, which we cover in edge and cloud placement, and one layer back when the comparison is with keeping everything in your own building, which is the on-premises comparison.

Eudora runs this assessment remotely for clients worldwide as part of our cloud solutions work: a workload inventory, a placement recommendation with the arithmetic shown, and a migration plan that names the risks. No on-site visit required, and no obligation to move anything we cannot justify.

Want a workload-by-workload placement review with the cost arithmetic written down rather than asserted? Get in touch with Eudora Technology to talk about your project.