An organisation proposes a multi-cloud architecture for resilience. What evidence would justify it, and what does it actually cost?

What multi-cloud usually means in practice

Three different things get called multi-cloud and they have completely different economics:

• Different workloads on different clouds. Common, sensible, low cost. Analytics here, application there. It is not resilience, it is procurement.
• The same workload deployable to either cloud (portability). Moderate cost, real optionality, and it requires avoiding managed services in favour of portable equivalents you now operate yourself.
• The same workload running actively on both, failing over between them. Very expensive, and this is what people mean when they say resilience.

What the third option costs

• The lowest common denominator. You cannot use the managed services that make each cloud worth using, so you operate databases, queues and identity yourself. The operational burden you took the cloud to avoid returns.
• Data synchronisation across clouds, with the latency, cost and consistency problems of cross-region replication plus egress charges in both directions.
• Double the operational surface: two identity models, two networking models, two sets of quotas, two sets of failure modes, two on-call knowledge bases.
• Testing that is genuinely difficult, so the failover path is likely to be broken when needed. An untested failover is a more expensive way of having an outage.

The evidence that would justify it

• A regulatory or contractual requirement for provider independence, which is increasingly real in financial services and public sector and is the most common legitimate driver.
• Concentration risk that a regulator has named, where the exit plan must be demonstrable rather than theoretical.
• A genuine commercial reason — a customer who will not run on a specific provider, or negotiating leverage large enough to matter.

What usually solves the stated problem better

Most multi-cloud proposals are motivated by a provider outage. Multi-region within one provider addresses the overwhelming majority of that risk at a fraction of the cost and complexity, because most outages are regional or zonal rather than global. The residual risk — a global provider failure or an account-level event — is real but small, and the honest comparison is between its expected cost and the permanent cost of the multi-cloud architecture.

The pragmatic middle: single cloud for the running system, portable-by-default choices where they are cheap, a documented and periodically rehearsed exit plan, and backups in a second provider. That covers concentration risk without paying for active-active.