1/ Another thread on cloud risk. Years ago, my colleague @JayHeiser1 divided cloud providers into three "tiers". Tier 1 - the largest leaders, generally cloud-native. Tier 2A - significant usually cloud-native providers. Tier 2B - large vendors cloudifying. Tier 3 - Everyone else 2/ We used this hierarchy, for instance, in the cloud IaaS MQ, as a shortcut for relative risk. Tier 1 can probably be assumed to be investing very deeply in risk reduction, with a presumption of competence. They are also gold mines for attackers, so *need* that competence.

1/ Following up on my earlier outage comment, the thread I'd meant to start: Cloud risk and resilience is a topic of significant enterprise interest now. Lots of reasons for that, not the least of which is the normalization of mission-critical cloud workloads. 2/ High-profile outages this year haven't helped: Azure AD (bit.ly/3nRSREF). Akamai (bit.ly/3CAjSk8 - often taken for granted as bulletproof). The recent recurring IBM issues (bit.ly/2VYfxY6).