UK & US firms shift cloud traffic to private links

DE-CIX has published research showing that enterprises in the UK and US are moving critical cloud traffic to private connectivity. The survey found that 61% of organisations already use private direct connections to cloud providers.

The findings suggest security is becoming a more prominent factor in cloud networking decisions, alongside performance and reliability. Among IT and infrastructure decision-makers surveyed, 27% said security vulnerabilities and DDoS attacks would be among their biggest cloud connectivity challenges over the next 12 months. That compares with 28% who cited latency or slow performance and 26% who pointed to downtime or reliability issues.

The study was commissioned by DE-CIX and carried out by Censuswide among more than 400 respondents, split evenly between the UK and the US. All participants worked in IT, cloud or infrastructure roles at organisations with at least 100 employees.

Private connectivity is also under consideration at many companies that have not yet deployed it. Another 31% of respondents said they were actively considering direct private links to cloud providers rather than relying solely on the public internet.

The shift reflects a broader reassessment of how sensitive business traffic moves between users, applications and cloud environments. Companies are seeking more control over routing, resilience and data-flow exposure as cyber threats grow more complex and cloud estates become more distributed.

The research also highlighted concern about data sovereignty and geopolitical issues. Some 23% of respondents named those factors among their leading cloud connectivity challenges, suggesting that regulatory and jurisdictional questions are shaping network design as much as technical performance.

Readiness gap

Even so, the survey suggests a disconnect between confidence and day-to-day operations. While 96% of respondents said they were confident their networks were ready to support future cloud and AI initiatives, those same organisations reported spending an average of 11.5 staff hours each week resolving cloud connectivity issues.

That points to a continuing operational burden for IT teams managing multi-cloud and hybrid environments. Time spent troubleshooting can limit the resources available for security work, infrastructure upgrades and wider AI adoption.

DE-CIX linked the findings to a rise in large-scale disruption attempts on internet-facing services. It cited industry data from Cloudflare showing that 47.1 million DDoS attacks were blocked during 2025, more than double the previous year, including an attack that reached 31.4 terabits per second.

Against that backdrop, network architecture is becoming a more central part of security planning. Rather than treating cyber defence solely as a matter of filtering and blocking threats, more businesses are asking whether critical traffic should traverse the public internet at all.

DE-CIX operates internet exchange and interconnection services in 60 locations across Europe, Africa, the Americas, the Middle East and Asia. It said its position in cloud and interconnection markets gave it visibility into rising enterprise demand for dedicated routes between corporate networks and cloud platforms.

One focus of the research is reducing what security teams often call the attack surface. In practical terms, that means limiting unnecessary internet hops, tightening visibility over traffic paths and reducing the number of points at which data could be delayed, intercepted or disrupted.

"The public internet was never designed to carry every mission-critical enterprise workload," said Ivo Ivanov, Chief Executive Officer at DE-CIX.

"Every additional hop across a public network ultimately creates another point where traffic can be delayed, intercepted or disrupted. Interest in private interconnection has been growing steadily as businesses prepare for the low-latency, high-performance demands of real-time AI, but this research tells us that security is also very much front of mind. While interconnection isn't a replacement for existing security technologies, it does allow for greater visibility and control over data, and significantly reduces unnecessary exposure before those technologies come into play."

Operational strain

DE-CIX also used the findings to question how organisations define network readiness. Strong confidence scores can sit alongside recurring operational friction, particularly when engineering teams spend hours each week fixing connectivity issues across multiple providers and environments.

"Confidence is important, but confidence isn't the same as operational readiness," Ivanov said.

"If IT teams are still spending more than a full working day every week resolving connectivity issues, that's time they can't spend improving security, modernising infrastructure or helping the business deploy AI. Organisations need networks that are simple enough to operate efficiently every day."

DE-CIX said enterprises are increasingly treating interconnection as part of their broader security architecture, not just as a network performance choice. That approach becomes more relevant as businesses spread workloads across several cloud providers and face tighter governance requirements over where data moves.

Brandon Ross, Senior Interconnection Consultant for the Americas at DE-CIX, framed the issue as one of design rather than perimeter defence alone.

"Cybersecurity has to be about more than simply building stronger defenses around every connection," Ross said.

"Organisations know this, which is why they're questioning whether traffic should have been travelling across the public internet in the first place. As enterprises adopt AI and distribute workloads across multiple clouds, interconnection becomes a strategic part of security architecture, reducing complexity, improving visibility and giving organizations greater control over where their data travels."