4. May | Security

SaaS or your own platform? A decision for operators of critical infrastructure—beyond vendor pressure

Software vendors are making SaaS the default option—and containers a prerequisite for anyone who wants to remain on-premises. For operators of critical infrastructure, the question is therefore not “whether”, but “on what basis” the decision is made.

What this specifically means for operators of critical infrastructure

For KRITIS operators—such as municipal utilities, public transport operators, or energy providers—this shift has particular significance.

This is not just about technology decisions, but about:

Security of supply and availability

Regulatory controllability

Long-term data sovereignty

Many of these organizations have established, stable operating structures. This is not a disadvantage—on the contrary: it is often the foundation for reliable operations and resilient systems.

However, introducing SaaS does not only change the technical architecture. It also shifts:

Control mechanisms

Responsibilities

Influence over operations and further development

This means that what appears to be a purely technical decision can quickly become a strategic turning point.

The real question is not “SaaS: yes or no”

The discussion is often overly simplified: as a choice between SaaS and on-premises.

In reality, this comparison falls short.

The decisive question is:
On what basis are we making this decision?

Because anyone who acts without a clear decision basis effectively adopts the vendor’s architecture and operating logic—often without consciously choosing to.

The difference between being “pushed” and “deciding deliberately” lies precisely in that basis.

Five building blocks for a sound decision basis

To establish this basis, operators of critical infrastructure should assess their situation across five key dimensions:

Operational sovereignty

Who makes medium- and long-term architecture decisions?

With SaaS models, part of this decision-making authority shifts to the vendor. An in-house platform, by contrast, requires more responsibility—but also enables targeted control.

Compliance and data controllability

Where is sensitive data stored?
Who has operational access?
Which audit trails remain entirely within your own area of responsibility?

Especially in the KRITIS environment, these questions are not optional—they are business-critical.

Vendor lock-in beyond the individual product

Lock-in rarely arises only at the product level.
What matters is the overall landscape:
- Interface logic
- Update dependencies
- Roadmap decisions
The more these are dictated by the vendor, the harder it becomes to switch later.

Roadmap control and release cadence

Who decides when updates are deployed?

SaaS often brings faster innovation—but also less influence over the timing of changes. For KRITIS operators, that can become a risk if adjustments are not aligned with operational requirements.

Total cost over 5–7 years

The cost question cannot be answered in the short term.
What matters is how it develops over several years:
- How do SaaS costs change as usage grows?
- What investments and operating costs arise when building your own platform?
- How flexible does the cost structure remain when requirements change?
Only from this perspective is a well-founded assessment possible.