Disadvantages of cloud computing: the honest trade-offs

Cost can sprawl without governance

The pay-as-you-go model that makes the cloud flexible also makes it easy to spend without noticing. Forgotten resources keep billing quietly, usage that grows gradually can pass unremarked, and a workload that is genuinely steady and predictable can sometimes end up costing more spread across a monthly bill than it would have on owned hardware. This is not a flaw in cloud pricing so much as a discipline gap: cost has to be actively watched, tagged and reviewed, which is the whole discipline FinOps exists to formalise — see our what is FinOps explainer for how that discipline works.

Vendor lock-in

Building deeply on one provider’s proprietary services — a specific managed database, a specific serverless platform, a specific AI service — makes it harder to move to another provider later, because leaving means rewriting or re-architecting whatever depended on those services. This is a real cost, but it is also usually a reasonable trade for the productivity those services provide; the mistake is not lock-in itself, it is not knowing you have accepted it. Using more portable, open technologies where it genuinely matters is the usual mitigation, not avoiding managed services altogether.

Dependence on connectivity and on the provider

A cloud-hosted application is only as reachable as the network between the user and the provider’s data centres, and it is only as available as the provider’s own infrastructure. For most organisations this dependency is an acceptable trade for the reliability the provider brings at scale, but it is still a dependency that did not exist — in that exact form — when everything ran on servers under your own roof. Environments with unreliable connectivity, or workloads that must keep running through it, need to plan for this explicitly rather than assume it away.

Security and compliance responsibility that stays yours

Cloud providers secure the infrastructure itself, but they do not secure how you configure and use it — that split is what the shared responsibility model formalises, and it means the cloud never fully removes your security obligations, it redraws them. Configuring identity and access correctly, encrypting the right data, and meeting whatever compliance regime applies to your industry all remain work you have to do. Our shared responsibility model explained article covers exactly where the line sits.

Less control, and skills you still need

A few smaller but real trade-offs round out the picture:

• Less low-level control — managed services trade fine-grained control over the underlying hardware and configuration for convenience; sometimes that trade costs you a capability you actually wanted.
• Latency and data-residency constraints — physical distance to a data centre still matters for latency-sensitive workloads, and some data must legally stay within a particular jurisdiction, which shapes which regions you can use.
• The skills gap — running cloud infrastructure well is a different skill set from running on-premises hardware, and teams need to learn it rather than assume it transfers automatically.

Trade-offs to manage, not reasons to avoid the cloud

Every disadvantage here has a corresponding practice that keeps it in check — cost governance, deliberate architecture decisions about where lock-in is acceptable, resilient network design, disciplined identity and encryption, and ongoing training. None of them are arguments that the cloud is the wrong choice; they are the reasons “the cloud is always better” is too simple a claim, and they are exactly why our benefits of cloud computing article frames the upside as real but not automatic. Cloud certification exams test this balance directly: a scenario that only lists benefits, with no cost control or security design, is usually the wrong answer.

For certification study, expect these trade-offs to appear as scenario questions — often disguised as “which of these is the customer’s responsibility” or “why did this bill grow unexpectedly” — across the foundational exams and more deeply in security-focused ones.