Cloud-first applications are designed to exploit features and services of clouds like Azure or AWS to the hilt, and often won’t work on normal on-premise servers in conventional data centres. They will use features which are available on a pay-per-use basis on clouds, features which are either hard or impossible to replicate on-premise.

“Running on the cloud” is not the same as “designed cloud-first”. It is very easy to lift-and-shift an on-premise application, with its 20th century thinking and architecture, to the cloud as is. A cloud-first application is totally different. They will use message buses, analytics engines, queues, non-SQL database services, for instance.

There are exactly three large cloud hosting services today: AWS, Azure, and GCP, and we can keep a degree of neutrality in our design and architecture such that only minimal (< 5%) code change will let you migrate among them. If your cloud strategy strives to be cloud-agnostic, then we can design your application with a cloud-first approach and still keep it largely cloud-agnostic.

There are unique security challenges of cloud-based systems, which no on-premise system needs to face. That said, by no means is it less secure than on-premise security. For instance, if your root account with AWS or Azure is broken into, servers or services can be deleted with a click of a button. But the flip-side is compelling too. No on-premise server farm with general-purpose firewalls or switches has the kind of secure networking and Layer 3/4 access control which cloud data centres can deliver. Firewall rules in cloud DC are often implemented in special purpose ASIC chips on netwoirk fabrics and motherboards which are impossible to circumvent over the network by an intruder.