Skip to main content
VSI Technologies

Technology Services

Workloads that run where the data is allowed to be.

Migration, modernisation and hybrid operations, with the cost control attached.

The problem

Why this comes up

Most cloud estates were migrated once and never revisited. The bill grows, nobody can say which workload is responsible, and the parts that were supposed to modernise are still the lifted-and-shifted originals. Meanwhile the workloads with a residency constraint sit wherever they landed, which is a compliance question nobody has asked out loud yet.

The pattern is consistent enough to be predictable. A migration programme gets funded, the easy workloads move, the hard ones get deferred to a second phase, and the second phase never gets its own budget because the first one already declared success. What is left is a hybrid estate nobody designed, half in a data centre, half in a cloud tenancy, and the integration between them held together by whatever was quickest at the time.

The cost problem is a symptom rather than the disease. Cloud spend grows because nothing in the estate makes an owner feel the consequence of a decision: the instance sized for a launch that happened two years ago is still running at that size, the non-production environment nobody turns off costs the same as production, and the storage tier is whatever the default was. None of that is visible until somebody maps spend to the team that caused it, at which point the conversation stops being about the platform and starts being about accountability.

The residency question is the one that turns into a genuine problem rather than an expensive habit. A workload holding regulated data sits in whichever region the migration wave happened to target, and the constraint was never written into the platform, it exists in a policy document and in the memory of whoever wrote it. That is fine until an audit, a customer questionnaire or a public-sector bid asks where the data physically is, and the honest answer takes three weeks to assemble.

The part that makes all of this harder to fix than it should be: the dependency map does not exist. Not because nobody tried, but because the estate has changed since the last attempt and the document was never a living thing. Which means every remediation proposal is a guess about blast radius, and guesses about blast radius are how migrations stall in the middle of a wave.

Recognise any of these

What it looks like from inside

If three or more of these are true, this page is about your estate.

  • Nobody can tell you which team owns the largest line on the cloud bill
  • There is a second phase of the migration that has never had a budget
  • A workload was lifted and shifted and is still running exactly as it was
  • The answer to "where is that data stored" takes more than a day to produce
  • Non-production environments run around the clock because turning them off is somebody’s side project
  • The last dependency map was produced for a programme that has since finished

What we build

Specifically

  • Migration waves planned against dependency, not against convenience
  • Landing zones with identity, network and logging established before the first workload moves
  • Cost allocation that maps spend to the team that caused it
  • Residency and sovereignty constraints enforced at the platform, not in a policy document
  • Hybrid operations for the workloads that are not going anywhere

What it integrates with

Named platforms, not categories. If you run one of these, this is the conversation.

  • Microsoft Azure
  • Google Cloud
  • VMware
  • Microsoft Entra ID
  • Terraform

Dependency-first wave planning

Waves get planned from what talks to what, not from which application team answered the email first. That ordering is the single biggest determinant of whether a migration finishes: move a database before the three services that read it and you have created an outage you will discover in production. Discovery produces a dependency graph from network flow data and configuration rather than from interviews, because interviews reliably miss the integration somebody built on a Friday four years ago.

Landing zone before workload

Identity, network segmentation, logging, tagging and guardrails go in before the first workload moves. This is unglamorous and it is where migrations are won: retrofitting identity onto forty workloads already running costs several times what establishing it first costs, and retrofitting tagging means the cost allocation you wanted is not available for the estate you already moved.

Cost allocation that names an owner

Spend gets mapped to the team, product or programme that caused it, and that mapping is enforced by tagging policy rather than reconstructed in a spreadsheet each month. The mechanism matters less than the consequence: a monthly figure with a name against it changes behaviour, and a monthly figure attributed to "shared" does not.

Residency as a platform constraint

Where a workload may run gets expressed as policy the platform enforces, region restrictions, service allow-lists, encryption key custody, so a deployment that would breach it fails rather than succeeds quietly. A residency rule that lives only in a document is a rule that will be broken by someone acting in good faith, and discovered by an auditor.

Hybrid operations, deliberately

Some workloads are not moving: licensing makes it uneconomic, latency makes it unwise, or the application is a decade from a rewrite. Those get operated properly where they are rather than left as the residue of a programme that lost interest. That means monitoring, patching and capacity planning on the same cadence as the cloud estate, and connectivity designed rather than improvised.

How the engagement runs

The estate loop, and what runs against it

Your estate todayWhat VSI runs against it
01

Assess

Dependencies, utilisation and residency constraints, mapped from flow data.

VSI delivers

Discovery tooling builds the dependency graph and the cost baseline every later claim is measured against.

02

Migrate

Waves move in dependency order with rollback per wave.

VSI delivers

Landing zone, identity and tagging enforced before the first workload, so allocation exists from day one.

03

Operate

Hybrid estate run on one monitoring and patching cadence.

VSI delivers

Cost allocation, residency policy and guardrails run as platform controls, not as documents.

04

Optimise

The bill reviewed monthly against the owner-level baseline.

VSI delivers

Right-sizing, commitment coverage and teardown recommendations land as tickets with the saving attached.

Assess, migrate, operate, optimise, the loop a cloud estate should run continuously and usually ran once. The navy rail is what VSI operates at each stage; the measurement discipline is what turns it into a return your CFO can audit.

How it deploys

The shape of the engagement

And what we need from you at each step. A timeline with no client obligations in it is a timeline that slips.

  1. 01Weeks 1-2

    Estate discovery, dependency mapping and a costed wave plan

    Estate discovery, dependency mapping and a costed wave plan.

  2. 02Weeks 3-6

    Landing zone, identity and network established and tested

    Landing zone, identity and network established and tested.

  3. 03Wave by wave

    Migration with rollback, then decommission of the source

    Migration with rollback, then decommission of the source.

  4. 04Ongoing

    Cost review and modernisation of what the estate proved was worth it

    Cost review and modernisation of what the estate proved was worth it.

What you provide

  • Read access to the current estate and the billing account
  • One person who knows what the legacy systems actually do
  • A decision on residency constraints before wave one

How this goes wrong

The four ways it fails

Published because it is only writable by somebody who has had the failure. Each of these has happened on this kind of work, and each has a specific thing that prevents it.

A wave stalls halfway and the estate is left split

Why it happens
An undiscovered dependency. Almost always an integration built outside the change process, often by someone who has since left.
What prevents it
Dependency mapping from flow data rather than from interviews, and a rollback path per wave rather than per programme. A wave that can be reversed is a wave that can be attempted.

The bill goes up after migration and nobody expected it

Why it happens
Lift-and-shift sizing. On-premises capacity was bought for peak and amortised; cloud capacity sized the same way is rented for peak, permanently.
What prevents it
Right-sizing as part of the wave rather than as a later optimisation phase, and cost allocation live before the first workload moves so the increase has an owner from day one.

Decommissioning never happens, so you pay for both

Why it happens
The source system stays up "just in case" and the case never gets closed, because nobody owns closing it.
What prevents it
Decommission is a task in the wave with a date and an owner, not a follow-up. The wave is not complete until the source is off.

A residency breach surfaces in an audit

Why it happens
The constraint was documented but not enforced, and a deployment in good faith put regulated data in the wrong region.
What prevents it
Platform-level policy that fails the deployment. The only reliable enforcement is the kind that stops the action rather than reporting it.

Return on investment

Where the return comes from

Every lever names the mechanism and how it is measured against your own baseline, captured before the work starts. That is how the return stays a number your finance team can audit rather than a promise on a slide.

  1. 01

    Right-sizing and reserved capacity

    Lift-and-shift estates carry on-premises sizing into rented capacity, the single largest recoverable cost in most cloud bills. We baseline utilisation per workload before wave one, size to observed demand, and commit reserved capacity only where the usage history earns it. The measurement is the same bill, line by line, before and after.

  2. 02

    Unit economics with an owner

    FinOps only changes behaviour when spend has a name on it. Tagging policy is enforced at the platform so every dollar maps to a team, product or environment, and the monthly review compares each owner’s trend against their own baseline, not against a blended average nobody answers for.

  3. 03

    Non-production discipline

    Development and test environments running around the clock are pure waste with no service impact when removed. Scheduling and auto-teardown are policies, not requests, measured as the ratio of non-production to production spend, tracked monthly.

  4. 04

    Decommission completion

    The return of a migration is only realised when the source system turns off. Every wave carries decommission as a dated, owned task, and the programme reports paid-for-twice workloads as a number that is supposed to reach zero, visibly.

Run your own numbers in the ROI calculator

The long windowless facade of a modern industrial data facility.

Timing

Now, soon, or not yet

Most of the value in this decision is in when, not whether. Find the row that matches your situation.

When to start cloud & infrastructure work
CriterionVerdictWhy
A hardware refresh or support renewal falls due in the next two quartersNowThe decision gets made either way at that renewal. Making it with a costed plan beats making it under a procurement deadline.
Cloud spend is growing faster than the workload it supportsNowThis compounds. Every month without allocation is a month of decisions made by people who cannot see the consequence.
A regulated or public-sector contract is in the pipelineNowResidency and evidence requirements are cheap to design in and expensive to retrofit. Doing it during a bid is doing it at the worst possible moment.
A major application is being replaced within the yearSoonMigrating a system that is about to be retired is waste. Sequence the migration around the replacement, but start the discovery now so the sequencing is informed.
The estate is stable, costs are flat and nothing is renewingIt can waitThere is no forcing function, and a migration without one tends to lose its sponsor halfway. Revisit at the next renewal.

Buying for a public-sector body

For a public-sector buyer the sequencing changes rather than the work. The authorisation boundary has to be defined before the landing zone, not after it, because a boundary drawn around an estate that already exists is a boundary somebody will argue about for a year. Continuous monitoring evidence has to be a design output rather than a reporting exercise, and the region and key-custody decisions are made against the agency’s own requirements rather than against a default. We will also say plainly which workloads should not move at all, that answer is more common in government than in commercial work, and a supplier who never gives it is a supplier who has not read the constraints.

The federal profile

Objections

What you are probably thinking

We tried a migration and it stalled.
Most stall at the same place: a dependency nobody mapped, discovered halfway through a wave. The first two weeks here exist to find those before anything moves, and the wave plan is costed so a stall is visible in the budget rather than in the schedule.
Our data cannot leave the country.
Then it does not. Residency is a landing-zone constraint, set before the first workload moves rather than audited afterwards, and the workloads that cannot move stay put and get operated where they are.
We do not have the people to run it afterwards.
That is what the managed services capability is for, and it is worth scoping at the same time rather than after handover. A migration that lands on a team without capacity is a migration that regresses.

Questions

Asked often enough to answer here

Can we stop after the discovery phase?
Yes, and it is priced so you can. Discovery produces a dependency map, a costed wave plan and a residency position. Those are yours whether or not you continue, and they are useful to another supplier if you take the work elsewhere. A discovery you cannot walk away from is a sales process wearing an engagement’s clothes.
Do you have a preferred cloud, and will you tell us to move to it?
The platform decision follows your licensing position, your existing identity provider, your residency constraints and what your team can already operate, in roughly that order. Those four inputs usually determine the answer before anyone’s preference gets a vote, and where the answer is "stay where you are", we will say so.
What happens to the workloads that cannot move?
They get designed for rather than ignored. That means monitoring, patching, capacity planning and a connectivity design on the same footing as the cloud estate. The residue of a cloud programme is usually the part of the estate that cannot fail, so treating it as leftover is exactly backwards.
How do you handle the cost increase everyone warns about?
By making it visible before it happens rather than explaining it afterwards. Right-sizing is part of each wave rather than a later optimisation project, and cost allocation is live before the first workload moves, so an increase has a name against it from the first invoice. We also model the run cost during discovery, including the months where you are paying for both source and target.
Who owns the infrastructure-as-code when the engagement ends?
You do, in your repository, from the first commit. It is written to be read by your team rather than by ours, and handover documentation is a deliverable in the plan rather than a task after it. A migration you cannot maintain is a migration you will pay to have done again.
Can you work alongside an incumbent supplier?
Usually, and it is worth agreeing the split in writing before the work starts rather than discovering it in a status meeting. The most common workable division is that we do the platform and wave execution while the incumbent keeps application-level responsibility, because that keeps accountability where the knowledge is.

Stay current on our services

Occasional updates across every VSI service, new capabilities, new offerings, and what changed. No sales sequence; leaving is one reply.

Used only for these updates, see the privacy statement.

What it costs

Pricing

Scoped per engagement and modelled before you commit. The discovery phase is priced separately so you can stop after it with a plan and no obligation.

Book a 20-minute assessment