IBM Cloud VPC, Bare Metal and Controls for Regulated Workloads

IBM Cloud is not trying to win developer mindshare, and reading it as a hyperscaler competitor on those terms misses what it is for. It competes on enterprise controls: encryption where the customer holds the keys, confidential computing, hardware security modules, and the compliance paperwork that regulated industries require.

Two infrastructure generations

IBM Cloud carries two infrastructure models, and knowing which one an environment uses matters:

Classic infrastructure is the older estate, inherited from SoftLayer. VLAN-based networking, a large bare-metal catalogue, and a different console and API surface.

VPC infrastructure is the modern, software-defined generation: subnets, security groups, network ACLs, public gateways and floating IPs, with higher network throughput and a cleaner API.

New work belongs on VPC. Classic persists because large estates still run there. If you are evaluating an environment, establish which generation it is on, because the tooling and networking models are not interchangeable.

Profile families

VPC instance profiles follow a readable naming pattern — family, generation, then vCPU and memory:

Bare metal remains available on both generations for workloads needing physical isolation, specific hardware, or licensing tied to physical cores.

The controls that distinguish it

This is the substance of IBM Cloud's proposition:

• Key Protect — managed key management backed by FIPS-validated hardware.
• Hyper Protect Crypto Services — a dedicated hardware security module where IBM has no access to the key material. This is the "keep your own key" model, and it is a stronger guarantee than "bring your own key" on most platforms.
• Confidential computing — memory encrypted while in use, so data is protected during processing rather than only at rest and in transit.
• Financial Services Validated workload profiles, built for regulated financial institutions.

If none of those requirements apply to you, IBM Cloud's case is weaker and you are likely better served elsewhere. If any of them are contractual obligations, the shortlist of providers that satisfy them is short, and IBM is on it.

watsonx and AI services

IBM's AI platform sits alongside infrastructure: watsonx.ai for model development and deployment, watsonx.data for a lakehouse, and watsonx.governance for model lifecycle documentation.

The governance component is the one with a genuine differentiator behind it, because the ability to evidence how a model was trained, evaluated and monitored is becoming a regulatory requirement in several sectors rather than a nice-to-have.

Account structure and access

An IBM Cloud account holds resource groups, IAM policies, service IDs and API keys. Access groups bundle policies for teams. Service IDs are the non-human identities — the equivalent of service accounts elsewhere, and the credentials most often left behind in a hand-over.

A proper audit covers: the account owner, every user and their access groups, every service ID and its API keys, and any classic infrastructure users, which are a separate population from IAM users on older estates.

An IBM Cloud account that has been upgraded from a trial to a billable relationship behaves differently from a trial-state account — as on every platform, trial state brings service restrictions and an expiry.

Where it fits

Regulated industries with specific encryption or residency obligations. Organisations already running IBM software with licensing that transfers cleanly. Workloads needing confidential computing. Hybrid estates where part of the system stays on-premises.

It fits less well for a general-purpose web application with no special controls, where the platform's complexity buys you nothing. The Oracle and IBM comparison places the two enterprise-oriented options side by side.

Frequently asked questions

Is classic infrastructure deprecated? It remains supported, but VPC is where investment goes. Start new work on VPC.

What is the practical difference between BYOK and KYOK? With bring-your-own-key the provider still handles key material in its service. With keep-your-own-key, in a dedicated HSM, the provider has no technical means of access. For some regulatory positions only the latter is acceptable.

Are there free resources? There is a Lite tier covering a set of services at no cost, useful for evaluation rather than production.

Does IBM Cloud support standard tooling? Yes — Terraform providers, a full CLI and standard Kubernetes tooling for IBM Cloud Kubernetes Service and Red Hat OpenShift.

Current account states and configurations are listed on the Buy IBM Cloud Account page.