Capital One was the first US bank to announce going all in on the cloud, closing eight data centers by 2020 and rebuilding 80% of about 2,000 applications as cloud native. What changed in delivery speed and reliability, and the security lesson from 2019 that changed EC2 for every customer.
An eight-year program, completed in 2020, that exited eight data centers.
About 2,000 applications moved, and 80% were rebuilt as cloud native (microservices and APIs) rather than lifted and shifted.
The technology organization grew to about 11,000 people during the migration. This was a hiring and skills program as much as an infrastructure one.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
In 2019 an attacker exploited a misconfigured web application firewall to make requests from inside Capital One's environment to the EC2 instance metadata service, obtained the instance role's credentials and used them to read data from S3. That November AWS released IMDSv2, which requires a session token and blocks this class of server-side request forgery. Today IMDSv2 can be required across an organization by declarative policy.
Rebuilding most applications instead of rehosting them is why delivery speed changed. A rehosted application keeps its release process.
It took eight years and thousands of engineers. Smaller companies get the same outcome faster by modernizing the few applications that change most and rehosting or retiring the rest.
The breach was not a cloud failure; it was a configuration and permissions failure that the cloud made reachable. Least-privilege roles, IMDSv2 and data perimeters exist because of incidents like it. Build them in from the first account.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
What Ten Enterprise Modernizations Have in Common: Home Depot, Lowe's, Capital One, Netflix, Amazon and More
Ten public modernization stories, side by side: where each started, how long it took, how much was rebuilt rather than moved, and what changed. Six patterns repeat in almost all of them, and each one applies to a company far smaller than these.
Read
How FINRA Built Market Surveillance on an AWS Data Lake: Separate Storage From Compute
FINRA processes about 37 billion market records on an average day and more than 75 billion on busy ones. It moved surveillance to AWS because fixed capacity was getting in the way of analysis, put S3 at the center, and separated storage from compute. The architecture, the outcomes and what it means for smaller data platforms.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.