For the KPMG Cloud Monitor 2026, a total of 503 German companies with 50 or more employees were surveyed in April and May 2026. The representative survey included executives from IT operations, DevOps, FinOps and information security, as well as members of management boards and executive boards.
The results show that the cloud transformation of German companies is entering a new phase. It is no longer solely about introducing cloud technologies. Increasingly, the focus is on optimizing existing cloud infrastructures, reducing risks, controlling costs and limiting dependencies on individual providers.
Companies are increasingly relying on flexible cloud architectures. 63% pursue a cloud-first approach, while a consistent cloud-only model is used significantly less often at 14%.
Multi-cloud architectures are particularly well established: 81% of the companies surveyed use multiple cloud environments or cloud providers.
The operating models also present a differentiated picture:
When selecting a cloud provider, performance as well as security and compliance are the primary considerations. In each case, 75% of decision-makers view these factors as indispensable minimum requirements.
Sustainability criteria, by contrast, play a lesser role in provider selection: ESG criteria are cited as a mandatory requirement by 34%.
The share of productive applications in the public cloud continues to rise. Currently, 38% of public-cloud users already run more than half of their applications there. Over the next three years, 61% of companies want to deliver more than half of their productive applications via public clouds.
However, this expansion is associated with technical and organizational challenges. The study cites the most important integration hurdles as:
This makes it clear that a successful cloud transformation does not depend solely on the chosen technology. What is also decisive is how well cloud services can be integrated into existing systems, processes and governance structures.
58% of companies cite improving the security level as the most important goal of their cloud strategy for the next five years.
Among the biggest operational challenges are:
Regulatory requirements are also influencing cloud strategies. In connection with NIS2, only 20% of the companies surveyed consider themselves fully prepared so far. By contrast, 52% have identified specific security gaps and are working to close them.
At the same time, zero-trust approaches and additional security measures are becoming more widespread. For example, 69% rely on segmented and specifically secured network structures, and 65% on enhanced data-protection measures.
In identity and access management, 58% use multi-factor authentication (MFA), 50% single sign-on (SSO), and 45% already use passwordless methods.
Preparation for security incidents is also gaining importance: 54% regularly conduct incident response exercises, and 53% rely on continuous security monitoring.
As cloud usage grows, controlling ongoing costs also becomes more important. According to KPMG, the economic effects vary:
At 84% of companies, cloud spending currently accounts for no more than 50% of the total IT budget.
The results therefore also highlight the growing importance of FinOps: the more complex cloud and multi-cloud infrastructures become, the more important transparency, governance and the continuous optimization of resources and costs become.
The Cloud Monitor is particularly clear on the topic of digital sovereignty.
78% of companies rate dependency on individual US hyperscalers as business-critical. At the same time, many companies are already looking at alternatives:
In doing so, 49% accept additional costs of up to 20%. Another 20% would even support a premium of up to 30%.
The results underline that sovereignty is increasingly taking on a tangible economic value for companies. Choosing a cloud provider thus becomes more of a strategic decision about data sovereignty, regulatory certainty and long-term technological independence.
The KPMG Cloud Monitor 2026 shows a clear shift in priorities. Cloud computing has long since ceased to be a pure transformation project for many companies. Instead, optimization, IT security, governance, cost control and digital sovereignty are moving to the forefront.
Multi- and hybrid cloud models can help combine different requirements for scalability, security and compliance. At the same time, however, infrastructure complexity increases—along with the need for clear governance structures and a long-term cloud strategy.
The growing importance of digital sovereignty is particularly relevant. The high willingness to pay for sovereign cloud offerings shows that companies increasingly view dependencies on individual hyperscalers as a strategic risk.
IT decision-makers should therefore regularly review existing cloud architectures to assess how securely, economically and independently they are positioned in the long term. Alongside public cloud offerings, German cloud infrastructures as well as hybrid and multi-cloud approaches can also play an important role.
Published: 03.09.2026
Last reviewed: 14.09.2026
Reading time: 4 Minuten Lesezeit
Boris Mayer is Head of Marketing at firstcolo and is responsible for the strategic development of the company’s marketing and communications activities. His focus is on topics relating to cloud infrastructures, digital sovereignty, data center solutions and IT services for businesses.
His focus is on topics relating to cloud infrastructures, digital sovereignty, data center solutions and IT services for businesses.
The KPMG Cloud Monitor 2026 shows how German companies are further developing their cloud strategies. Multi-cloud is increasingly becoming the standard, while IT security, cost control and digital sovereignty are gaining significant importance in strategic decisions.
firstcolo is nominated for the Datacenter-Insider Award 2026 in the "Colo-Heater" category and can additionally be proposed for the new Innovation Award.
Cloud computing has long been established in German companies. The current Bitkom Cloud Report 2026 shows which cloud strategies companies are pursuing and why topics such as IT security, digital sovereignty, and vendor lock-in are becoming increasingly important.
