Bartek: Bartek Śliwa, Euvic Talks podcast. Today, as always, we are going to talk about the intersection of business and technology, and the topic we’re bringing to the table is the cloud—or rather, our guest is bringing it—namely, Krzysztof Wilczyński. Krzysztof, tell us a few words about yourself, what connects you to business, and how the cloud entered your life.

Krzysztof: Good morning, everyone. What connects me to business? Well, what connects me to business the most is that I have been delivering technology to business for twenty years, so that’s quite a long time, and you could say several different technology waves have passed by in that time. One of those waves, which in fact is ongoing all the time, is cloud technology, whether public or private. It started with simple things like virtualization. Where we are today with the cloud is visible to everyone. So you could say that practically from the beginning I’ve had constant contact with large enterprises and the ongoing use of virtualization and cloud technologies specifically tailored for big business at scale, whether for telecoms or banks, also continuously in heavily regulated environments, so I think there are many interesting experiences here.

Bartek: OK. And professionally, who are you?

Krzysztof: Professionally, within the Euvic Group, I co-manage one of the companies that acts as an integrator for the entire group, namely Euvic Solutions. I hold the position of Vice President and Chief Technology Officer. I manage a fairly large delivery team that focuses, among other things, on technologies in the field of cloud computing, but also cybersecurity, computer networks, and technologies related to what is nicely called the modern workplace—meaning Microsoft 365 and everything around it, Google Workspace and everything around it. Altogether today there aren’t many alternatives, so that’s the technological stack.

Bartek: Exactly, I remember a dozen or so years ago, when I was still experiencing my wonderful student days, the cloud was on everyone’s lips, and it seems to me that hasn’t changed, except I always had a feeling that cloud adoption was still at some negligible level. You also mentioned some regulated environments. I remember that public institutions very often preferred to have those proverbial servers under their desks rather than necessarily moving to the cloud. So what do you think is the level of cloud adoption today? Are we rather opening up to the cloud? Or is it still a trendy topic, but not used by everyone?

Krzysztof: You know, both. Meaning it is both trendy and not used by everyone, but the market, market specifics, and dynamics require many organizations to at least consider moving to the cloud. Where is cloud adoption today? I believe it is at a fairly good level, but not at the level we might imagine. Because those, let’s call them, sprints in IT and technology are quite short; we know what the processor development cycle looked like, for example, and those were indeed quite fast and short cycles. Here, when we look at the cloud, theoretically there is a pretty big hype all the time, people talk about it a lot, everyone wants to be there, and then we come, for example, to an institution that theoretically should be highly advanced, an institution that brands itself as a modern bank, and suddenly it turns out that cloud adoption there is, you could say, zero, because it boils down solely to, for example, the Microsoft 365 platform, meaning Modern Workplace is OK, but in the area of purely business systems and how we deliver applications to our users from the perspective of that service provider, everything is served from an On-Prem Data Center. And possibly some individual, small, point elements are served from Public Cloud platforms. However, most often these are the least significant ones, most often the ones that throw the fewest logs under our feet in the form of, e.g., regulatory compliance requirements or cybersecurity rules, which all in all should consistently be at a strongly secure level, but for some reason often aren’t. So I think when it comes to cloud adoption itself, there is still a lot to be done here and everything is ahead of us.

However, as I was saying, the market verifies this. I think also, generalizing a bit, the world regulates this. Meaning what is happening with the greenhouse effect and so on, because keeping on-prem servers in data centers that are not necessarily well-utilized and energy-efficient means that on one hand, one must consider how I manage my money and how I spend it on the infrastructure I have; and on the other hand, how I look, for example, in the context of ESG principles, meaning reporting my energy efficiency, or when I will reach the carbon-neutral level. And that is a whole mass of various important aspects that, for example, potential investors will pay attention to and increasingly do pay attention to, taking ESG indicators into account.

Bartek: OK. You touched upon several threads. I wonder which one I’d like to start with. Maybe going back to cloud adoption itself: the top 3 aspects that clients are afraid of when adopting the cloud, which we could dispel right here and now?

Krzysztof: Well, everyone says the cloud is expensive. Yes, and we hear that very often. Also as the Euvic Group, we have, you could say, daily contact with a very wide base of clients whom we talk to and survey. And we also collect this data, so from our estimations, it appears that this is one of the main arguments raised against it. However, is the cloud really expensive if we calculate all costs, calculate how to effectively use the cloud, consider which systems should actually land within cloud computing, which ones maybe not necessarily, or how to approach our technology stack and remodel it to make it more appropriate for the cloud? Suddenly it may turn out that, firstly, the cost per se is not that high at all. Secondly, all that flexibility associated with juggling costs, absorbing potential spikes that sometimes happen to us (which usually stems from the specifics of the business), also outweighs those cost factors and means that thanks to that, for example, by absorbing spikes, we are simply able to make more money through technology.

So that cost is an element we can argue with a lot. However, there is one very important element from a cost perspective—meaning there is no such thing as a free lunch here. If we spin up cloud resources, we simply pay for them. There is no situation where I keep a server under my desk that has no support, runs on old, unsupported software, and is unpatched regarding security vulnerabilities. And here one must weigh this appropriately, of course, but there are no free things here. If we bring something to life, we simply pay for it. And I think that is often an element that causes us to generalize, saying “the cloud is expensive,” whereas maybe it’s simply an element of cleaning up our infrastructure, and then indeed, when those costs add up as a whole, maybe one needs to take a step back and perform some optimization. So that is, I think, the biggest myth… maybe a myth.

You mentioned regulations too. And I remember that very often when we offered the cloud to clients, they invoked limitations like the server having to be located in Poland or in Europe. Maybe we could…

Bartek: Yes, that is certainly the second very important aspect, where we speak especially on regulated markets, if these are organizations in Poland that fall under, for example, the Polish Financial Supervision Authority (KNF), cloud recommendations, D recommendations, or the cloud communication.

Krzysztof: Well, here there are indeed many dangers. You have to spend some time to understand these recommendations and regulations. You need to properly plan the infrastructure and the approach to how we build it. However, it must also be noted that cloud platform providers have done a great deal of work toward ensuring this compliance, you could say out-of-the-box. And of course, they won’t do everything for us—meaning we won’t buy a cloud that is assumed to be compliant with KNF requirements out of the box, but we have all the tools to achieve that compliance. We have a series of guidelines built by cloud platform providers that you could say lead us by the hand on this journey to the cloud.

I think this should rather be viewed in the category of a fear that does not fully materialize at the end of the day. So regulations are certainly a challenge, they definitely need to be taken into account, but there is a range of tools you can use to build the cloud in a way that is completely compliant with the regulator’s requirements, if it is a regulated market, or with some general requirements, because here we should also mention, e.g., the requirements of the Act on the National Cybersecurity System or NIS2, which is just coming in and is on everyone’s lips right now. So that is also certainly a big element.

Many of our clients also frequently raise the element—or maybe even not our clients, but it is often heard from the market—that the cloud is dangerous. Yes, because I have to release these systems right out of my data center, I have to open up, you could say, to the world, which causes me to perhaps lose a certain control. But now, what does moving to the cloud mean and is it really that dangerous? Generally, I haven’t heard of a major, as they nicely call it, cybersecurity case involving a cloud provider like Amazon, Google, or Microsoft. You don’t hear about such things.

Bartek: OK, but I still remember last year, the entire data center of one of the cloud providers—not from the big three you mentioned—burned down. That was in Poland, if I recall correctly.

Krzysztof: Yes, but those are business continuity aspects and those are also aspects of demarcation, right? Are we talking here about a large global provider of, let’s call it, computing platforms—let’s throw it all into one: say computing platforms or data centers, whether in a cloud model or a collocation model? One needs to look at this from two perspectives. And those big cloud providers put a lot of work into making sure that data centers are built primarily in a way consistent with best practices. There is no question here of, for example, a building neighboring another that has a completely different activity profile, meaning it is packed with textiles from floor to roof. There are appropriate security boundaries and safety zones, both physical and IT/cybersecurity-related. The issue of fire is also business continuity, and here… I would generalize this a bit: meaning whether my loss of business continuity related to the loss of access to data I process in an external data center occurred as a result of a fire, or occurred as a result of a ransomware attack (meaning the data center didn’t burn down, but all data was encrypted), from the perspective of me as a service consumer, that shouldn’t interest me. I should have business continuity plans prepared in such a way that practically speaking, any type of external factor that causes me to lose access to my data (because that’s what it boils down to—losing access to my data, to the ability to process it, serve it to my clients, etc.) does not affect my business. And that’s how it should be looked at.

However, returning to that first thread of cybersecurity—because this fear regarding the security of external data centers is most often thrown into a bag labeled cybersecurity. And the bag labeled cybersecurity, in my opinion, has very small chances of materializing with large public cloud computing providers. However, the closer we get to my own on-premise data center, the more I expose myself to that risk from various factors. Here we would have to go very deep into the management of processes related to business continuity and cybersecurity, and I think that is probably material for another podcast.

Moving on, grading from the top—because you could say there are these public cloud computing platforms, large global providers—we have a number of smaller providers who serve collocation services, IaaS services, sometimes PaaS, but it’s hard to talk here about the scale that large providers deliver. And here, by virtue of the fact that this is also a certain type of service… this is IaaS, where the provider delivers server infrastructure, storage infrastructure, communication infrastructure, but does not take responsibility for what happens above the operating system within the technology stack, meaning we enter this shared responsibility model. And more of that responsibility related to attacks on the data layer, application layer, operating system layer starts flowing down to me as the service consumer, and then I have to deal with it. And if I am in my own on-premise data center at all, I have to take care of the entire technology stack. And of course, if I’m a large organization or a member of a group, a global financial group for example, I can try to draw these best practices from my peers, but those will never be best practices worked out and built on such a large, structured, and strong level as global providers, providers of public cloud computing services.

So cost, regulations, cybersecurity—these are probably the biggest myths, raised objections, call them what you will—they boil down to similar things at the end of the day.

Bartek: Sure. You also touched upon ESG. In your opinion, is this simply a sexy buzzword created recently, or is it a real problem, and how does it relate to the cloud?

Krzysztof: Both. Because it’s an important buzzword. Large organizations, listed companies will have to report on this area and will be obligated to do so. Truly, practically speaking, they are already obligated to do so. And things related to energy efficiency are one of the elements that need to be taken into account. So of course you can build your own data center, you can use collocation, but of course then we enter into a debate titled, for example, the energy efficiency of my data center, how high it is. And as we know, it is greater the more heavily utilized that data center is. However, server space is often seen that is, e.g., filled halfway. There is no way to talk about this being an energy-efficient data center.

Now, if we go to a large scale, if we go to a global provider who, thanks to the scale they operate at, is also able to properly plan the process of delivering new computing power, meaning building new data centers, by design such a data center is, you could say, prepared end-to-end. Meaning it is built in one go from start to finish and filled at the same time from start, practically speaking, to finish. That means the efficiency of such a data center will be much, much greater than any collocation, for example, and we can also run into things related to reporting under the title of how I should—if I am a collocation consumer—how I should report PUE? Is it the current one, taking into account that my collocation provider may not have leased all spaces yet, so the PUE is low then? Or do we take the expected target indicator calculated for the best possible variant? And for example, one will have to get into such things; this may not be a very decisive factor, but one of those that can be raised as an element for further consideration.

And precisely, all these considerations in which we mention banks, stock-exchange-listed companies, could serve to lead to the conclusion that the cloud is only for the big players or only recommended for the big players. Is that true? Or should smaller startups, smaller companies rather stay with their servers, or use the cloud?

Krzysztof: There is no single answer here, because it depends heavily on the specifics of the business you want to enter. It depends heavily on how much funding you have behind you, for example, what that funding will be, what the cycle of its release for you will be, whether you are able to purchase the whole thing upfront or not, whether you actually have to approach this right from the beginning in a model that heavily accounts for scalability options both upwards and downwards. So it’s hard to find a single answer here.

Certainly looking from the perspective of such a modern approach, where we say: we build a data-driven business that massively utilizes machine learning and artificial intelligence, well, it all boils down to the fact that you need to provide computing power, you need to know how and be able to train computing models, you need to have something to do it on. So it may be that even for a small entity, for a small startup, cloud computing will be a very good solution. However, I wouldn’t want to disqualify collocation providers either, because they also do a lot toward tailoring services in a way appropriate for those e.g. small, medium, or already relatively large providers. And today it is nothing new that in addition to the possibility of simply orchestrating the creation of a new machine in the form of IaaS, meaning Infrastructure as a Service, we also have a range of more SaaS- or PaaS-like functionalities at our disposal. And they are delivered by a small, local provider, for example on a country scale, who was normally associated with collocation, but is also moving forward and developing these services. So there is of course a give-and-take, because by choosing such a provider, I will probably have a smaller portfolio of potential ready-made features to use, ready functionalities, ready mechanisms or technologies, but on the other hand, it will probably be much more cost-effective for me.

Bartek: OK. So to be clear, when we talk about using the cloud, we don’t only mean when our infrastructure sits in the cloud, but naturally, when I think every modern digital business touches upon these AI and machine learning elements, we also use tools that utilize the cloud, so naturally we use the cloud ourselves. Right? OK, so AI is not just Nvidia processors and breaking subsequent financial records, but also the cloud.

Well then, we mentioned the most popular cloud solution providers: we have AWS, GCP, and Azure. What about the smaller ones? Is it that smaller firms should go to the smaller ones, or perhaps to the larger ones, or do the big players only go with the big ones?

Krzysztof: I think this is heavily driven by the local preferences of the people who create a given company and who are decision-makers or in some way, for example bottom-up as experts, drive these decisions. And there is, in my opinion, a very large dose of subjective approach and certain business conditions that are heavily specific. However, whether it’s a small company or a large company, and on the other side whether there is a large collocation provider or cloud computing provider, or a small one—it is hard in my opinion to find patterns here that would define by assumption one approach or the other.

Bartek: OK, how should one approach this? Well, assuming I am a bank CEO, where should I start looking or what should I start my considerations with in order to choose the right cloud service provider?

Krzysztof: That should always be driven in a way by business. Meaning the specifics of my business, the services I deliver today and want to deliver tomorrow, must be backed by an appropriate, as it is nicely said in Polish, use case for the cloud, an appropriate business case. And later, for that to have a chance to happen, I need to perform some preparatory work: I must first of all understand my data. I need to know what data I have and what data I operate on, to be able to say that I am able to utilize them in a controlled and secure way within a cloud computing platform.

And that is also one of the elements we can connect right here with cybersecurity, or raising risks related to the fact that I have to go outside. Because if I don’t know the data classification, I don’t know which data is business-critical for me, which is, let’s call it, commodity, which is less significant, which is more significant, then maybe I prefer to adopt a conservative position and say: well, in that case, I keep everything in my own data center. At least physically I hope it’s there. Of course later that data center is connected to the internet, my employees access that data center remotely, so there are still plenty of channels for potential information leakage. So one way or another, I must understand my data to be able to later properly prepare mechanisms that I will use to—returning to the beginning—power my business process with that data, which I deliver to my clients, and do it as effectively as possible. Both from the perspective of delivering technology itself and from the perspective of the money I have to pay for that technology. So that is certainly a second point, meaning things related to data.

The next element is properly designing the architecture, because here the cloud strongly standardizes our approach to infrastructure, whereas a common trap we see is that companies decide to move to the cloud, for example, with just one provider, then they hire a specialist who is heavily focused on that single cloud computing platform provider and technology—meaning translating business, functional, and non-functional requirements into a solution that I want to deliver to my clients from the cloud computing platform—such an architect for example starts building heavily based on specific, native functions of that given cloud platform provider. And that is a bit of a dead end, because it causes heavy vendor lock-in and later causes a very difficult process of exiting that cloud if it turns out for some reason to be inappropriate for me. So the right approach to architecture and choosing an appropriate partner who is able to properly transform my business requirements into a technology stack that on one hand will be very effective in the context of the given cloud computing provider I use, but on the other hand will also ensure an appropriate level of security for me as a service consumer who doesn’t necessarily want to use just one provider—that is a critical element.

And here—making a slight self-promotion—interdisciplinary or multidisciplinary groups reveal themselves, like Euvic for example, where we gather a whole mass of various technologies, connect them with each other, and do it quite consciously.

Bartek: I’m wondering, as we’re heading to a close, what should be a trigger for me as a business owner or a person deciding on technology in an organization to decide: OK, this is probably the moment to move to the cloud.

Krzysztof: The first thing that came to my mind, I would say in one word: ambition. My ambition as a business owner, as a decision-maker. That is certainly an important element of today’s business environment. And those ambitions need to be set properly somewhere and used to drive the organization accordingly. And the fact is that a business that is doing well today won’t necessarily be doing well tomorrow, because a global player will enter who is data-driven and suddenly it turns out that the asymmetry of access to information, for example, or generating business actions based on informationoutweighs the fact that I am an old-timer in the market and things have been going well for me so far, because suddenly it turns out someone is agile enough and makes business decisions quickly and appropriately using the right technology, but based on properly gathered data, that in a relatively short period of time I am left behind.

I would sum it up with one slogan: ambitions. All organizations should approach this a bit ambitiously, set certain goals for themselves, not be afraid to validate them, meaning check them. Because that is also one of the very important elements of the cloud, where prototyping or delivering practically speaking fairly ready and complete solutions that will allow validating whether a given direction is good or not is very short. If we talk about AI and for example using something that practically every company talks about today: “I would like to have a chatbot, I would like to be able to communicate with it in natural language, I would like to get information in an understandable way,” meaning to have an abstraction layer between my complicated SAP system where all critical data resides, and at the end of the day only a few people can use that SAP. So we wonder how to do it so that this data can be utilized in a broader context. And prototyping such a solution for relatively little money is today say a 4 to 6-week sprint and we have a relatively ready solution. So we are able to easily test such things.

Bartek: Super. From what you’re saying, I think it clearly follows that the potential of using the cloud is huge and is not actually limited just to infrastructure, but also to individual business tasks that our organization is supposed to carry out or that are needed to function effectively. At the end I would like to ask you a non-technological question, characteristic of this program: I wanted to ask you about some thing, experience, event, maybe a book, maybe a movie that inspired you recently.

Krzysztof: I was a bit afraid of this question, because there isn’t just one such thing—meaning there were too many of them in recent times to choose just one adequate one. I think… I think there is one such thing that lasted practically speaking the entire last year, and in the life of a person who for the past 20 years has focused solely on technology, meaning in my life, it was quite a big event, because I decided to work on myself as a human being, not on myself as a technology expert, and I went on a fairly long… you could say on one hand a course, but on the other hand not necessarily a course. More of an academy, more of working with people in a somewhat structured form, though at the end of the day we were heavily responsible for what the overall result of that action would look like.

However, looking at oneself, looking at oneself as a human being, as an engineer, as a leader, as a person who must find themselves in this rapidly changing world—I think that was the most significant, inspiring, and in quotation marks powerful event over the past year. And behind it also a number of books, a number of thoughts, so I think that is an element worth bragging about, because I personally appreciate myself for the fact that I managed to stop at a certain point, do a bit of soul-searching, and think about what could be the next step in my multi-dimensional development.

Bartek: Was that a weekend event, longer, single-day…?

Krzysztof: No, it was year-long on weekends, so maybe not every weekend, but a lot of work. A lot of work and also a big impact on the family, because it simply means I’m not home on weekends.

Bartek: Super. So I understand that if someone wants to know the details, then…

Krzysztof: Definitely.

Bartek: Besides the cloud. You can reach out to Krzysztof for details regarding this inspiration. Thank you very much for today. A lot of knowledge, and I think we also slightly exorcised those cumulus clouds… those cumulus clouds of the IT world. Thanks, and see you in the next episode of Euvic Talks.

Krzysztof: Thank you very much.