Cloud Migration: The 2026 Mid-Market CIO's Playbook
A 5-axis Readiness Score, the 7Rs as a decision sequence, the agentic-AI tooling shift, and 17 consulting firms evaluated on platform depth, case-study evidence, and pricing transparency. Built for IT leaders running 50–500 application portfolios on a 9–18 month window.
Most cloud migrations don't deliver. Three numbers tell you why.
The hyperscaler "what is cloud migration" pages won't print these. We will. Read them, then keep going — the rest of this page is about how mid-market CIOs avoid being in any of these statistics.
55%
of cloud migrations failed to meet expectations; 53% didn't deliver promised benefits.
of enterprises have repatriated AI workloads, are doing so, or are evaluating it. The repatriation conversation is now table stakes for any AI-adjacent migration.
The cloud migration services market is worth roughly $330B in 2026, growing at a 23.2% CAGR (Research and Markets, Feb 2026). Inside that, the mid-market segment — 500 to 5,000 employees — is the fastest-growing slice at 17.65% annually per Auvik 2026. The Fortune 500 playbooks built for $5M–$20M migrations don't translate down. Most of the budget overruns and 55% miss-rate sit in the segment that's growing fastest — and getting the worst guidance.
The single biggest unforced error in the past three years: picking a strategy before scoring readiness. Vendor frameworks (AWS MRA, Azure Strategic Migration Assessment) push 50–100 question maturity audits that produce a red/yellow/green level. They don't tell you which R to pick. We built one that does.
Note for 2026 planning: AWS Migration Hub closed to new customers on November 7, 2025, replaced by AWS Transform (agentic AI). Azure released its Copilot Migration Agent the same month. Google's Migration Center got a Gemini-powered App Modernization Assessment in September 2025. If your prospective consulting partner is still recommending Migration Hub for new engagements, you're talking to a firm whose information is six months stale.
Framework
The 7Rs as a decision sequence (not a menu)
Hyperscaler pages list the 7Rs as equal options. They're not. They're a funnel — a series of yes/no decisions you apply in order to each application. Below: the decision flow, with portfolio percentages from a typical mid-market 100-app shop.
The shift this diagram makes: the first three Rs (Retire, Repurchase, Retain) shrink your migration scope before you migrate anything. AWS, Azure, and Google all show the 7Rs as a side-by-side menu. We treat them as a sequence — apply each filter, count what's left, and then plan capacity. A typical mid-market discovery returns ~20% of the portfolio retire-able, ~15% replaceable with a SaaS already on the market. Skipping these gates is how 50-app projects become 80-app projects.
The Migration Readiness Score: 5 axes, one strategy
AWS Migration Readiness Assessment runs roughly 70 questions and outputs a maturity color. Azure Strategic Migration Assessment is similar. Both produce a level. Neither tells you which R to pick. The Cloud Intel Migration Readiness Score is a 5-axis vector that maps directly to a primary R, a secondary R, and — when ops maturity is too low — an honest "delay" output most vendor frameworks won't print.
The five axes
Score each 1 (low) to 5 (high). Each axis controls a different dimension of the strategy decision.
Axis
1 (low)
3 (mid)
5 (high)
What it controls
Data sensitivity
Public / marketing
PII, SOC 2
PHI, payment, classified, EU-regulated
Filters out pure public cloud at high scores; pushes toward private region or sovereign cloud
Vendor lock-in tolerance
Greenfield, hyperscaler PaaS OK
Mixed; managed DBs OK
Multi-cloud mandate, OSS-only, exit clauses
High → portable runtimes (containers, OSS DBs), Replatform > Repurchase
Ops maturity
No CI/CD, manual change mgmt
Some IaC, basic monitoring
Full IaC, SRE, DORA-elite
Low → Rehost (don't refactor what you can't operate); high → Refactor viable
Regulatory load
B2C SaaS, none
One framework (SOC 2, ISO 27001)
HIPAA + PCI + GDPR + sector (DORA, FedRAMP)
High → wave plan with compliance gates, possibly Retain or repatriate
Time-to-cutover budget
24+ months acceptable
9–18 months
<6 months (lease, M&A)
High pressure forces Rehost first; low pressure makes Refactor cost-effective
Mapping your score to a strategy
Read the score as a vector, not a sum. The combination of axes maps to a primary R, a secondary R, and — for low ops maturity with high regulatory load — an honest delay output.
Score pattern
Primary R
Secondary R
Why
Sensitivity ≤ 2, Lock-in ≤ 2, Ops 3–5, Time 1–2
Refactor
Replatform
Greenfield-ish posture, room to do it right
Sensitivity 4–5, Lock-in 4–5, Ops 4–5, Reg 4–5
Replatform (private/sovereign)
Retain (regulated subset)
Portability + control mandate; private region or sovereign cloud
Time = 5 (hard deadline), Ops ≤ 2
Rehost
Retire (kill 25%+)
Speed forces lift-and-shift; aggressive retire to shrink scope
Sensitivity 4–5, Reg 4–5, Time 1–3
Hybrid (Replatform + Retain)
Selective Refactor
Compliance-led — keep regulated workloads private
AI-heavy + Sensitivity 4–5
Repatriation-aware Hybrid
Replatform burst tier
Cloudian 2026: 91% of regulated AI workloads landing on-prem or private
Lock-in = 5, Ops = 5
Repurchase + Refactor
Retire
Mature team, lock-in averse — split portfolio: SaaS for commodity, OSS containers for differentiator
All axes ≤ 2
Rehost
Retire
Not ready for more — get to cloud, optimize later
Ops ≤ 2 + Reg ≥ 4
DELAY
Address ops gap first
Migrating regulated workloads with low ops maturity is how breaches happen — see Risk Assessment spoke
The "DELAY" output is the differentiator. Vendor frameworks always recommend "yes, migrate now" — that's how the SOWs get signed. We tell you when to wait. If you scored Ops ≤ 2 with high regulatory load, read Cloud Migration Risk Assessment and Cloud Migration Best Practices before signing any SOW.
Worked Examples
Three mid-market profiles, three different strategies
Each profile is composite — built from the engagement patterns we see most often in our directory's discovery interviews. The score values reflect what discovery typically returns, not what teams self-report.
Strategy: Hybrid Replatform + selective Retain. Containerize non-PHI services on AWS or GCP; keep PHI database on dedicated tenancy with BAA-eligible services only. Refactor the patient-portal stack post-migration, not during.
Common mistake: Picking AWS GovCloud "to be safe" — overkill and expensive for non-Federal HIPAA. Standard AWS or GCP HIPAA-eligible regions are the right answer.
Partner type: Healthcare-vertical specialist with proven BAA scope on the target hyperscaler.
Strategy: Rehost first, retire aggressively. Lift-and-shift the 60% of apps that are still in real use; retire the rest. Replatform critical billing systems in wave 2 (post-cutover). Refactor nothing in this window.
Common mistake: Trying to refactor under a 5-month deadline. Mid-market teams burn the budget on the first 5 services and miss the lease.
Strategy: Hybrid Replatform with sovereign-region wave plan. Retain the core banking ledger on-prem in year 1; replatform peripheral services to EU sovereign region first, US workloads in wave 2. Refactor zero in this window.
Common mistake: Lifting the ledger onto a hyperscaler "to look modern." Regulators care about residency and audit trails, not how containerized your stack is.
Partner type: Financial-services SI with prior DORA work and explicit sovereign-region capacity. Not a generalist factory.
2026 Tooling Shift
Agentic AI changed migration economics in the last six months
From late 2025 through Q1 2026, all three hyperscalers shipped agentic-AI migration tooling. McKinsey estimates these tools compress migration timelines 30–40% (cited by AWS Transform team, Mar 2026). Most consulting firms haven't repriced. That's a negotiating lever.
AWS
AWS Transform
Agentic AI for VMware migrations went GA December 2025. Partners report 50% faster discovery, 80× faster network-config conversion. Replaces AWS Migration Hub, which closed to new customers November 7, 2025.
GA November 2025. Integrated with GitHub Copilot for code-level modernization (Java, .NET legacy stacks). Strongest in lift-and-modernize for VM-heavy estates already running Microsoft tooling.
App Modernization Assessment GA September 2025. Gemini-powered codebase analysis flags refactor candidates in days, not weeks. Particularly strong for Java, Python, Go monoliths.
Negotiating lever: Ask every prospective partner whether they're using AWS Transform, Copilot Migration Agent, or Migration Center as part of discovery. If yes, ask whether their pricing has been adjusted for the McKinsey-cited 30–40% time compression. Most firms still quote 2024 discovery rates against 2026 tooling. That gap is your discount.
Counterpoint
When not to migrate (or when to repatriate)
Vendor pages don't print this section. We will. Three signals tell you a workload should stay on-prem or come back from the cloud:
1.
Steady-state high utilization. AWS enterprise-strategy research cited by iternal.ai places the cloud-vs-on-prem break-even at roughly 20% sustained utilization over three years. AI training, batch ETL, and steady-state databases over that line are the workloads quietly going home.
2.
Sensitive AI workloads. The Cloudian 2026 survey reports 91% of regulated AI workloads end up on-prem or in private cloud. It's no longer a contrarian position — it's the median path.
3.
Predictable storage growth. Egress fees and per-GB storage scale linearly with growth. If your storage is doubling annually and the workload doesn't need cloud elasticity, you're paying a 30–60% premium for flexibility you don't use. Read Vendor Lock-in in Cloud Computing for the dollars.
Roughly 21% of cloud workloads are estimated to have been repatriated globally per Shopify's 2026 cloud-reset analysis; Gartner expects 90% of organizations to operate hybrid by 2027. The honest output of any readiness assessment includes "stay" as a valid result.
Hiring Guide
Match your readiness score to the right type of partner
Different score patterns need different shops. Hiring a global SI for a 50-app rehost is a budget grenade; hiring a boutique for a 7-month DORA migration is an ops grenade. Match the partner to the score.
Score sum 5–9
Assessment partner
You're early. Hire a discovery and assessment specialist before any execution SOW. 4–8 week engagement, $25K–$75K. They produce the dependency map, the risk register, and the strategy recommendation. They do not execute.
Look for: automated discovery tooling (AWS Transform, Azure Migrate, ADDM, CAST), published methodology, no MSP upsell pressure.
Score sum 10–17
Migration factory
Most mid-market shops live here. Pick a firm with a documented "factory" — repeatable wave templates, automated cutover patterns, blue/green tooling, post-migration MSP. 3–6 month execution, $200K–$500K.
Look for: 50+ comparable migrations, hyperscaler Premier/Expert tier, signed BAAs/DPAs ready to go on day 1, repatriation playbook (not just a migration playbook).
Score sum 18–25
Modernization specialist
Heavy lock-in tolerance, mature ops, and time pressure together usually mean you need refactor expertise on a tight clock. Boutique modernization or a hyperscaler-aligned specialist (AWS Premier modernization, Google Cloud refactor specialists). 6–12 months, $500K–$1.5M.
Look for: reference customers in your industry at comparable refactor scale, framework-specific experience (Spring, .NET Core, Django), opinionated architectural point of view.
What are the 7 types of cloud migration (the 7Rs)?
The 7Rs are: Retire (decommission unused workloads), Repurchase (replace with SaaS), Retain (keep on-premises), Rehost (lift-and-shift to cloud VMs), Replatform (move with targeted optimizations like managed databases), Refactor (rebuild using cloud-native patterns), and Relocate (move between cloud regions or providers). They're not a menu of equal options — they're a decision sequence. A typical mid-market 100-app portfolio resolves to ~20% retire, ~15% repurchase, ~10% retain, ~30% rehost, ~20% replatform, ~5% refactor.
What are the 4 R's of cloud migration?
The original 4Rs (Gartner, 2011) were Rehost, Refactor, Revise, and Replace. AWS expanded these to the 6Rs in 2016 (adding Retain and Retire), and the 7Rs in 2021 (adding Relocate). The 4R framework is now considered legacy — most modern migrations need the full 7Rs to handle SaaS replacements, regulated retain decisions, and multi-region relocation. If a vendor is still selling you a 4R framework, that's a tell.
How much does cloud migration consulting cost in 2026?
Discovery and assessment: $25K–$75K over 4–8 weeks. Mid-market migrations (50–500 servers): $200K–$500K over 3–6 months. Enterprise migrations (500+ workloads): $500K–$2M+ over 6–18 months. Managed services post-migration: $5K–$50K/month. Hourly rates range from $150–$300/hour; global SIs charge at the high end, mid-market specialists charge competitively. Agentic-AI tooling (AWS Transform, Azure Copilot Migration Agent, Google Migration Center + Gemini) is compressing timelines 30–40% per McKinsey, but most firms haven't repriced yet.
How long does cloud migration take for a mid-market portfolio?
A mid-market migration (50–500 applications) typically runs 6–18 months end-to-end. Discovery and dependency mapping: 4–8 weeks (compressed to 1–2 weeks with agentic-AI discovery tools). Pilot wave: 2–3 months. Production waves: 4–12 months depending on dependencies. Post-migration optimization: ongoing. The single biggest timeline driver is application dependency mapping — Flexera 2026 lists it as the #1 challenge for the second year running.
Should I hire a single-cloud specialist or a multi-cloud firm?
Single-cloud specialists (AWS Premier Partners, Google Cloud Partners, Azure Expert MSPs) deliver deeper platform expertise, tighter access to hyperscaler engineering support, and faster ramp for target-platform deployments. Multi-cloud generalists (Accenture, Deloitte, Capgemini, IBM) are better for organizations running mixed workloads or those who haven't finalized a platform decision. If you've scored your readiness on our framework and the recommendation is Refactor or Rearchitect, lean toward a specialist. If it's Rehost or hybrid Replatform-Retain, a multi-cloud firm reduces vendor fragmentation.
What is the Migration Readiness Score and how does it differ from AWS MRA or Azure SMA?
Cloud Intel's Migration Readiness Score is a 5-axis vector — data sensitivity, vendor lock-in tolerance, ops maturity, regulatory load, and time-to-cutover budget — each scored 1 to 5. Unlike AWS MRA (~70 questions) or Azure Strategic Migration Assessment, our framework is read as a vector, not a sum. The combination of axes maps directly to a recommended primary R and secondary R, plus a 'delay' output when ops maturity is too low to migrate safely. It produces a strategy in five minutes rather than a maturity level after a 70-question questionnaire.
Should we be repatriating workloads from cloud to on-premises in 2026?
Possibly, for AI workloads. The Cloudian Enterprise AI Infrastructure Survey 2026 (n=203) found 93% of enterprises have repatriated AI workloads, are doing so, or are evaluating it. The break-even is roughly 20% sustained utilization over three years per AWS enterprise strategy research cited by iternal.ai. For traditional workloads — web apps, batch processing, microservices — repatriation is rarely worth the operational cost. The repatriation question matters most when you have steady-state high-utilization workloads and predictable storage growth.
What questions should I ask a cloud migration firm before hiring them?
Ask: (1) Show me a reference customer at comparable scale and complexity in my industry. (2) Walk me through your dependency mapping tooling — manual or automated? (3) What's your rollback plan if cutover fails? (4) Are you using agentic-AI migration tools (AWS Transform, Azure Copilot Migration Agent, Migration Center + Gemini)? If yes, has your pricing been adjusted to reflect the 30–40% time savings McKinsey reports? (5) What does your post-migration support model look like — SLA, on-call, drift detection? (6) Show me your repatriation playbook — when do you advise clients NOT to migrate? Firms that can answer all six with specifics and references are the ones worth shortlisting.