Frequently asked questions

General

Yes. Since 1997, SUE has been managing mission-critical Linux environments—and now also Kubernetes and cloud environments—for organizations in the Netherlands, using its own team of engineers. You choose which services SUE will handle for each platform: Managed Cloud, Managed Kubernetes, Managed Linux, or Managed Infrastructure.
The biggest advantage is 24/7 coverage without having to maintain your own on-call schedule. Organizing your own 24/7 staff requires five to six people per area of expertise. Additionally, your knowledge of Linux, Kubernetes, or your cloud platform no longer depends on just one or two colleagues. There are also drawbacks. Your in-house team is further removed from the technical side of things, and the handover process takes up your staff’s time during the first few months. Furthermore, without an exit plan, you become dependent on your management partner. Outsourcing is less cost-effective if your management is tightly tied to your own processes, or if you already have a large team with broad expertise. Therefore, retain control over architecture, budget, and priorities yourself, and outsource day-to-day management. You can read about how to do this in the guide “Outsourcing IT Management.”
Yes. Under DORA, you remain responsible for IT risk, even if a partner handles the management. You assess that partner in advance, establish agreements regarding security, business continuity, and access, and maintain an exit strategy that you can implement. With Managed Services SUE takes over the management of Linux, Kubernetes, and the cloud. You can read about what should be included in such a contract in the guide “Outsourcing IT Management.”
The analysis takes four weeks, from start to conclusion. If you need to choose between platforms, we’ll conduct a more in-depth architectural assessment that takes about eight weeks.
SUE examines the situation from six perspectives: IP and compliance, cybersecurity and risk, software architecture and technical debt, cloud and COGS, product and AI, and team and velocity. Under “team and velocity,” we assess, among other things, the organization’s reliance on key personnel.
No, there is no legal requirement. Sellers have this done to speed up the sales process and avoid surprises during negotiations.
A technical due diligence is an assessment of a company’s technology in the context of an acquisition: software, architecture, cloud environment, security, intellectual property, and the engineering organization. SUE links the findings to financial and operational implications and provides a roadmap for value creation after closing.
By running every change through automated deployments, using Zero Trust and short-lived credentials. SUE configures the platform so that every change can be traced back to a specific person and time.
Cloud native banking means that banking applications run as containers and services on a cloud platform that scales automatically. Instant payments and open banking require such platforms, because they must be available at all times. SUE builds and manages them within the frameworks of DORA and the ECB.
First, you map out the business rules, dependencies, and data flows in the code before changing a single line of code. SUE does this using the “ Application Modernization ” Assessment. Then, we modernize the system step by step: building APIs around the core, breaking functionality down into separate services, or rebuilding specific components.
The ECB expects an exit plan before a critical service goes live. SUE defines landing zones as Infrastructure as Code on AWS, Azure, or a European cloud, with backups outside the primary provider. Kubernetes keeps workloads portable, so you can practice a migration rather than just describing it.
Under DORA, you must evaluate your IT service providers, document agreements regarding security and business continuity, and have an exit strategy in place. SUE is ISO 27001- and ISO 9001-certified and makes the certificate and scope available for your supplier evaluation.
Your team will take over the project, with the code and documentation in your own repositories. If you don't want to manage it yourself, SUE will take over management through Managed Services, with fixed response times and reports.
The deliverables, the requirements they must meet, the schedule, who will be involved on your end, and how the handover will take place. SUE sets all of this out before the work begins, so it’s clear from the start when the project will be completed.
Choose a project if the outcome can be defined in advance, such as a migration, a landing zone, or a Kubernetes platform. In that case, SUE will provide fixed deliverables within an agreed-upon timeline. Choose consultancy if you’re in charge and primarily need expertise or capacity within your team.
SUE operates according to the principle “Show. Do together. Do yourself.” The consultant demonstrates how it works, then does it together with your engineers, and hands it over as soon as your team can do it on its own. The configuration and code are stored in your repositories, along with updated documentation.
SUE has more than 150 engineers and consultants specializing in areas such as Kubernetes and containers, cloud- Cloud Migration s to AWS, Azure, or Google Cloud, CI/CD and DevOps, Infrastructure as Code with Ansible or Terraform, security and observability, Linux infrastructure, and FinOps. Together, they hold more than 1,150 certifications.
With “ consultancy ,” a SUE specialist works alongside your team; you remain in charge, and the service is billed on an hourly basis. With “Professional Services,” SUE carries out a well-defined project with fixed deliverables. With Managed Services, SUE takes over the day-to-day management of your platform for a fixed monthly fee. You can start with one option and switch to another later.
Usually not for everything. A lot of data can remain with a hyperscaler, provided the right region, encryption, and contractual agreements are in place. For the most sensitive data, you should opt for a sovereign cloud offering, a European provider, or your own infrastructure. SUE works with AWS, Azure, and Google Cloud, as well as European alternatives, and provides advice tailored to each data domain.
Not automatically. The CLOUD Act can require U.S. providers to disclose data, even if it is stored in Europe. Encryption where you control the keys reduces that risk. A sovereign cloud solution or a European provider reduces it even further. The appropriate measure depends on the sensitivity of the data. Have your legal counsel or privacy officer review the legal considerations.
A data sovereignty assessment identifies where your data is located, which jurisdiction it falls under, and who has access to it, and evaluates this against regulations such as the GDPR, NIS2, and DORA. SUE conducts the assessment in one week and provides a roadmap with quick wins and long-term options.
A penetration test attempts to gain access through vulnerabilities in an application or network. The Cloud Security Health Check assesses the setup of your entire cloud environment: configurations, permissions, pipelines, and runtime. They complement each other. Many cloud risks—such as overly broad permissions or a publicly accessible storage bucket—are identified more quickly through a configuration review than through a penetration test.
Yes. The Health Check works for public, private, and hybrid clouds: AWS, Azure, and Google Cloud, as well as Kubernetes clusters in your own data center. The three pillars remain the same. We adapt the tools and checks to the platform.
SUE checks three areas: the security of your code and pipelines, the security of your applications in production, and the configuration of your cloud infrastructure, such as identities, permissions, networking, encryption, and logging. Each finding is assigned a score based on likelihood and impact, so you know where to start.
Yes, and a well-managed environment makes that transition easier. For Textkernel, SUE migrated an on-premises Proxmox platform to Kubernetes on AWS, achieving 99.99% uptime and reducing infrastructure management time by 25%.
By testing it. SUE establishes a documented recovery strategy and schedules recovery tests for critical databases. At SIDN, SUE helped formalize and schedule backup and recovery tests, and implement a test-driven approach to system recovery.
Outsourcing pays off if your in-house engineers are working on the cloud or the product and the existing environment is falling behind as a result, or if the expertise is concentrated in just a few people. In that case, SUE takes over day-to-day management: patching, monitoring, backups, and change requests. Your team retains control over the architecture and roadmap, and SUE transfers its expertise to you.
Managed Linux and Managed Kubernetes focus on a single layer: the operating system or the container platform. Managed Infrastructure covers the entire on-premises or hybrid environment: servers, virtualization, storage, networking, and databases. You can purchase the services individually or combine them.

With Managed Infrastructure Services, SUE takes over the day-to-day management of your servers, virtualization, storage, network, and databases—whether on-premises, hosted, or hybrid. With traditional system administration, you resolve issues as they arise, often on a per-server basis and manually. SUE manages your environment according to fixed agreements, including monitoring, scheduled patching, configuration as code using Ansible and Terraform, and tested backups. Every change is repeatable, and you know in advance how the recovery process will proceed.

Yes. SUE helped SIDN, the organization behind the .nl domain, strengthen the security baseline of its on-premises infrastructure. Passwords throughout the infrastructure have been replaced, credential hygiene is actively monitored, and backup and restore tests for critical databases have been formalized.
Yes. SUE scans container images—for example, using Trivy—detects anomalous behavior in running containers using Falco, and enforces network policies in the cluster using Cilium. If your cluster is already running on SUE’s Managed Kubernetes, Managed Cloud Security integrates seamlessly with it.
The alert is received by the same team that is familiar with your environment. At the start, we’ll work with you to determine in which cases SUE will intervene directly, when we’ll involve your own team, and within what timeframe. Monitoring is available 24/7.
If your cloud environment is changing faster than a small team can keep up with, or if security is currently the responsibility of just one or two people, SUE continuously monitors the environment and follows up on findings; your own team keeps track of the risks and helps make decisions. At Buckaroo, development and platform teams identify the risks in their own environments and resolve them themselves, with SUE providing support in assessing and prioritizing them.
The Cloud Security Health Check is a one-time, one-week assessment conducted by two consultants. You’ll receive a roadmap outlining the most urgent areas for improvement. Managed Cloud Security is an ongoing service: SUE monitors your environment and follows up on findings. The Health Check is therefore a logical first step.
Managed Cloud Security is the ongoing management of your cloud environment’s security by a third party. At SUE, this means: setting up tools such as Wiz and Cloudflare, monitoring your environment, prioritizing risks, and resolving them—either on our own or in collaboration with your team. SUE provides these services for AWS, Microsoft Azure, Google Cloud, and on-premises environments.
This follows from the analysis in Step 1: the public cloud, your own data center, or a sovereign European environment—on virtual machines or on Kubernetes. SUE is a partner of AWS, Microsoft Azure, and Google Cloud and recommends the platform that best suits your applications and requirements. When deploying Kubernetes in your own data center or at the edge, we often build it on Talos Linux: every server is identical, and we upgrade both the operating system and Kubernetes in a single step.
SUE builds and manages its own systems, with over 150 in-house engineers and consultants. The same people who create the roadmap also implement it and can then manage the platform. We are partners with AWS, Microsoft Azure, and Google Cloud. Licenses are, at most, just one part of the job.
We decide on a per-application basis, based on business value and technical condition. A one-to-one migration (lift-and-shift) is fast and suits a data center or VMware exit with a strict deadline. It doesn’t resolve technical debt, and as a result, the cost in the cloud may end up being higher than planned. Rebuilding or restructuring pays off when the business logic is valuable and the code is holding back modernization. In most projects, we combine both approaches: first, we migrate what needs to be moved quickly, and then we modernize on the new platform.
In small, reversible steps. The old and new systems run side by side temporarily, and we switch over only once tests confirm that the new component functions the same way. Migrations occur in waves, starting with the simplest applications first, with a fallback option for each wave. We specify which applications will be migrated first and which later in the roadmap from Step 1. This ensures that the rest of the landscape continues to run as usual.
Whenever possible, we agree on specific results: cost savings, a migrated application, or availability. Management services are billed at a fixed monthly rate. For consulting and specialized work, we also charge by the hour.
Configuration, code, and documentation are stored in repositories that belong to you. We follow the principle “Show. Do together. Do yourself,” so that your team builds up its knowledge. In every management contract, we specify how a handover will take place—whether to your own team or to another party.
An analysis with a roadmap takes one to two weeks. Optimization often yields initial savings within a few weeks. Modernization and migration are carried out in phases ranging from a few weeks to a few months per application. A large application landscape takes one to two years, with the first results visible after the first phase.
No. You start right where you are and take what you need. Each step yields a result you can use to move forward, such as a cost-saving overview, a documented architecture, or a roadmap.
Yes. In addition to software, financial services, high-tech, research, and private equity, SUE works for the government and the healthcare sector—for example, for the NFI. Our approach is the same in every sector: we modernize applications, migrate them to the appropriate cloud, and manage the platform.
Yes. CarWise is using SUE to modernize its desktop application for car dealers and leasing companies and transition it to SaaS. The process of decoupling the core system and building the new web UI are happening in parallel, so the turnaround time is a maximum of 12 months instead of several years. Stormin and Textkernel also worked with SUE to develop a scalable cloud platform.
Yes. SUE serves financial institutions, the healthcare sector, and government agencies, where regulations such as DORA, the Dutch Cybersecurity Act (the Dutch implementation of NIS2), BIO2, and NEN 7510 apply. For example, Buckaroo used SUE to strengthen its cloud security and simplify PCI DSS compliance. On each sector page, you can read about the applicable requirements and how we address them.
No. SUE (sue.nl) is an independent Dutch IT company based in Geldermalsen and in business since 1997. We are an official SUSE partner and provide SUSE licenses, implementation, migration, support, and management. We are also partners with AWS, Cloudflare, Wiz, and others.

Application Modernization

If an application still has years of life left, but the current platform requires too much manual work or doesn’t scale, replatforming is the solution. Typical reasons include an expiring VMware contract, a database that requires manual management, or an application that cannot scale automatically. Replatforming solves these issues without rewriting the code. If the problem lies in the code itself, replatforming won’t help much, and refactoring is the way to go.
First, get an overview of the application: modules, business rules, dependencies, and the connections to the database and interface. Then, your developers ask questions about the code, as they do at Deltares. During the modernization phase, a “ Re:App ” assists with refactoring, rebuilding, and replatforming; a “ engineer ” reviews each change.
Re:App Among other things, I have analyzed Fortran at Deltares, C# at CarWise, and Java at a large organization in the transportation sector. Re:App also supports COBOL, .NET, and PL/SQL. If your language isn't listed here, please contact me.
That's up to you. Re:App runs offline in your own environment—so the code stays there—or in a secure SUE environment. Your code isn't sent to an external AI service, and we don't use it to train AI models.
Nothing—the assessment is free. You’re under no obligation afterward: the Modernization Plan is yours, and you choose who will implement it.
Five business days, starting from the moment we have read-only access to the code. Your team will spend about 4 hours on this, spread over two or three meetings. After that, we’ll discuss the Modernization Plan in a 2-hour session. If more than one application is involved, we’ll agree on the scope in advance.
First, you map out the business rules, dependencies, and data flows in the code before changing a single line of code. SUE does this using the “ Application Modernization ” Assessment. Then, we modernize the system step by step: building APIs around the core, breaking functionality down into separate services, or rebuilding specific components.

A well-defined application often takes a few months, while a large application landscape takes one to two years, in phases, carried out in phases. The preliminary analysis determines how reliable that estimate is.

For administrative applications with many forms and workflows, sometimes yes. For complex, computationally intensive, or tightly integrated systems, usually not. Also consider vendor lock-in and licensing costs.

No. A modern application can run just as well on-premises or in a sovereign European cloud. With containers and Kubernetes, you keep that option open.

Technical debt is the extra effort you end up paying for later as a result of hasty or outdated software decisions. It is measured using indicators such as code complexity, outdated dependencies, test coverage, the time it takes to implement changes, and the number of incidents per release.

An application that is moved to the cloud without modification brings its problems along with it: outdated frameworks, hidden dependencies, and an architecture that doesn’t scale. You end up paying cloud rates for the same limitations. “Lift-and-shift” is appropriate if an application is soon to be phased out or if a data center needs to close in the near future. In other cases, we determine on a per-application basis whether containerization, refactoring, or replacement will yield better results.
Yes. Our Managed Services team can manage the platform and the application 24/7, including monitoring, security, and cost monitoring. You can also choose to have your own team manage it, with knowledge transfer from SUE.

No. SUE is modernizing in stages, with the old and new systems running side by side temporarily. We’ll switch over only after tests show that the new component works the same way. Each step can be reversed.

The free application analysis provides an initial overview of your application: scope, technology, risks, and promising paths forward. The Application Modernization Assessment goes into greater depth, offering a documented architecture, recommendations for each component, and a budgeted roadmap.

Yes, and that’s exactly when it pays off. Re:App reconstructs architecture, dependencies, and business logic directly from the source code. Your own staff—or anyone else with the necessary expertise—can verify that the reconstruction is accurate. At Deltares, Re:App was used to map out 6 million lines of code spanning 40 years of history.

Every change is reviewed by a SUE engineer and tested against the behavior of the old application. A component is only released to production once that behavior matches. AI speeds up the process; the quality requirements remain the same.

Yes. Re:App can run entirely offline and within your own environment. Your source code is not sent to a public AI service and is not used to train models. This allows you to maintain control over where your code and data are stored, even when NIS2, BIO, or confidentiality agreements impose strict requirements.

SUE supports migrations to Red Hat OpenShift Virtualization, SUSE Virtualization, Apache CloudStack, Proxmox VE, and KVM with libvirt, as well as to the public cloud or containers on Kubernetes. Nutanix, Hyper-V, and Azure Local are also options. The best approach depends on the specific application and factors such as licensing, management expertise, and how cloud native the application already is.

AI applications need access to data and functions, usually via APIs. In a monolith, that logic is locked into screens and batch jobs. If you decouple the business logic and make it accessible via APIs, AI applications can access it securely, with the same permissions and logging as other users. You don’t have to break everything down into microservices to do this.
Setting up Kubernetes is one thing, but 'Day 2 operations' (upgrades, security patching, storage management, and monitoring) require scarce and expensive specialized knowledge. With Managed Kubernetes from SUE, our 24/7 team completely takes the operational complexity off your hands. This allows your developers to focus 100% on building software instead of keeping the infrastructure running.
Cluster sprawl occurs when teams deploy clusters independently of one another, both on-premises and across different clouds. This results in a loss of visibility, and each cluster ends up with its own security settings. SUSE manages clusters centrally using a management platform such as SUSE Rancher Prime, applying the same policies to every cluster.

FinOps is an approach in which engineering, finance, and business share responsibility for cloud costs. Costs are allocated by team or product, so that every decision has a visible price tag. To this end, SUE sets up dashboards that show development teams the costs associated with their architectural choices.

Cloud environments scale up easily, but rarely scale down automatically. High bills often arise from idle resources, overprovisioned servers, and a lack of insight into who is consuming what. With our Cloud Cost Control Check , we analyze your environment, eliminate waste, and apply rightsizing. This often results in immediate cost savings of 20% to 40%.
Although the terms are often used interchangeably, there is an important difference. Data sovereignty is purely about control over your information: you guarantee that your business data is stored and processed exclusively within the EU (and under European legislation such as the GDPR). Digital sovereignty goes a big step further. This means that you have full control and independence over your entire IT infrastructure, software, and cloud environment. You avoid vendor lock-in with foreign Big Tech parties and retain the autonomy (IT independence) to decide for yourself which technology to use. SUE helps organizations become digitally sovereign by building robust, cloud-agnostic platforms based on open-source enterprise technology (such as Linux and SUSE).
AI acts as a catalyst in two areas: the transformation process itself and the functionality of the end application. With AI-Driven Application Modernization, SUE uses smart tools for automated code analysis, identifying technical debt, and restructuring legacy codebases. At the same time, we design the new architecture so that your application is immediately ready for the secure integration of AI models and data-driven functionality.
Technical debt makes every change more expensive. Developers are spending more and more time dealing with bugs and unexpected side effects instead of working on new features, and expertise in older languages and frameworks is becoming scarcer. As a result, each release takes longer, and the security risk increases. The Application Modernization Assessment identifies where the technical debt lies and which components would benefit most from refactoring.
Rebuilding often takes years, and the old system must continue to run throughout that time. When modernizing, you preserve the business logic—which is often documented nowhere else—and make changes in steps that can be reversed. Rebuilding is worthwhile when the technology is obsolete and the logic isn’t unique.
Rehost migrates an application as-is. Replatform migrates it with minor adjustments, such as containers or a managed database, without changing the business logic. Refactor restructures the code itself, usually in stages. The analysis of the code determines which approach is best for each application.
Application Modernization is the renewal of existing mission-critical software while preserving the business logic it contains. It can be small, such as moving an application into containers, or large, such as breaking up a monolith. SUE first uses Re:App to map out what is in the code and then modernizes in steps that can be rolled back.

Application Modernization and Migration

No. The assessment phase shows, for each workload, whether migration is worthwhile. You leave workloads that are better off remaining on-premises or with another provider as they are. MAP funding is tied to the workloads that you do migrate.
An overview of your servers, applications, and databases; usage data such as CPU, memory, and storage; your current costs and licenses; and the people who are familiar with the applications. If any information is missing, we’ll gather it using discovery tools. The more complete the data, the more reliable the business case.
AWS MAP is designed for large-scale migrations to AWS, such as a data center, an application portfolio, or a large set of virtual machines. AWS determines your eligibility and the available funding based on the scope, workloads, and business case. SUE will work with AWS to assess this for you during the exploratory phase.
Because the Landing Zone is written in code, every change goes through version control and a review. Cloud providers regularly add services and security settings. You incorporate those into the same code. Your team can do this on its own, or you can have SUE manage it as part of Managed Cloud.
Yes. We'll build the landing zone alongside your current environment and then migrate accounts and workloads step by step. For each step, we'll agree on when it will happen and how we'll handle any issues if something doesn't work. The more that's already up and running, the more important that order becomes.
A cloud landing zone is a pre-configured cloud environment with a multi-account structure, identities and roles, networking, centralized logging, and security settings. Teams build their workloads within these parameters. SUE sets up Landing Zones for AWS, Azure, and Google Cloud and defines them as Infrastructure as Code.
Compare the total costs, not just the hosting costs. On the on-premises side, these include hardware, the data center, licenses, and management hours. On the cloud side, they include compute, storage, network traffic, licenses, the migration itself, and subsequent management. SUE makes that comparison on a per-workload basis, based on your actual usage data. With AWS, the Migration Acceleration Program can cover a portion of the migration costs.
Applications that should remain on-premises include those with a constant, predictable workload that are already running efficiently on-premises; software for which cloud licensing is more expensive; systems with strict latency requirements for local hardware; and applications that will be replaced soon. The assessment will determine whether this applies to your applications.
A cloud readiness assessment is an evaluation of how prepared your organization and your applications are for a migration to the cloud. For each application, you’ll receive recommendations on the migration path, the risks, and the costs, as well as a roadmap for the migration. SUE typically completes the assessment in two weeks for AWS, Azure, and Google Cloud.
The AWS Well-Architected Review evaluates AWS workloads across six pillars, ranging from cost to reliability. The Cloud Security Health Check focuses solely on security—but in greater depth—and also works for other clouds as well as private or hybrid environments. If you’re running on AWS and want the big picture, start with the Well-Architected Review.
Conduct a review before a major change, such as a migration, a product launch, or an audit, and also on a regular basis. How often depends on how quickly your environment changes: a team that deploys daily is more likely to encounter anomalies than a stable environment. Between reviews, continuous monitoring of your security posture—for example, using Wiz—helps identify the biggest risks.
The AWS Well-Architected Framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability. Each pillar includes design principles and questions you can use to evaluate a workload. In an AWS Well-Architected Review, SUE evaluates your workloads against all six pillars.
In a hybrid cloud, you connect a private environment—whether on-premises or hosted by a provider—to one or more public clouds, sharing identities, networking, and management. In a multicloud environment, you use multiple public clouds side by side, typically for a service that one provider delivers best. As a general safeguard against lock-in, a multicloud approach is expensive. SUE keeps workloads portable using Infrastructure as Code and containers, where it’s worth the effort.

Aquasec

Start in audit mode. Policies will then indicate what they would block, without actually stopping builds or deployments. After a few weeks, you’ll know which rules are triggered correctly and which exceptions are needed, and you can set them to block on a per-team or per-namespace basis. This helps developers maintain confidence in the pipeline.
Generate an SBOM for each build—for example, in CycloneDX or SPDX format—and store it alongside the image in your registry. Trivy and the Aquasec Platform automatically generate these SBOMs in your CI/CD pipeline and link any new CVEs back to the images containing the affected component. This allows you to see which products are affected within the CRA’s reporting window: 24 hours for an early warning.
Both are CNAPPs, but they take different approaches. Wiz starts agentlessly with your cloud accounts and establishes connections between configuration, identities, and vulnerabilities. Aquasec starts with containers and Kubernetes, using eBPF agents that intervene in production in the event of drift or malware, along with scans integrated into your pipeline. If you run a lot of Kubernetes in production, runtime protection is more important; if your risk lies primarily in cloud configuration, then Wiz is a better fit. SUE works with both and provides recommendations based on your environment.
This is possible if your pipeline ran Trivy v0.69.4, Docker tags 0.69.5 or 0.69.6, or a compromised tag from trivy-action or setup-trivy on 19 or 20 March 2026. Aquasec recommends rotating all secrets that the pipeline could access and pinning GitHub Actions to a full commit SHA. We can help you perform that check and clean up your pipelines.
Trivy is Aquasec’s open-source scanner for images, IaC, and SBOMs. The commercial Aquasec Platform adds runtime protection, KSPM, centralized policies, and reporting, and uses a custom build of Trivy with separate pipelines. According to Aquasec, that build was not affected by the Trivy attack in March 2026.

AWS

With AWS consultancy , we design, build, or migrate solutions that have a beginning and an end. With Managed Cloud, we manage your AWS environment on an ongoing basis, under an SLA.
For larger migrations, AWS can provide support through the Migration Acceleration Program (MAP), which consists of three phases: assess, mobilize, and migrate. AWS determines on a project-by-project basis whether support will be provided and, if so, to what extent. SUE prepares the business case and requests the support in collaboration with AWS. Learn more on the AWS Migration Acceleration Program page.
In addition to migration, SUE works on AWS in the areas of High Performance Computing, Kubernetes on EC2 and EKS, End User Compute, FinOps, Well-Architected Reviews, and modernization. NXP migrated its HPC environment to AWS with SUE’s help; Textkernel now runs on Kubernetes on AWS following a migration carried out by SUE.
An AWS consultant from SUE will first assess your applications, dependencies, and compliance requirements. Based on that assessment, we’ll select a migration strategy for each application—such as rehost, replatform, or refactor—along with a business case and a roadmap. We’ll then set up a landing zone and perform a controlled migration, with managed services as the next step if you’d like.

The biggest savings usually come from rightsizing oversized instances and databases, cleaning up unused resources, using Savings Plans or Reserved Instances for stable usage, reducing data traffic, and making architectural adjustments. SUE tackles this in four steps: (1) analyzing your AWS environment, from usage and architecture to procurement; (2) prioritizing measures based on savings, risk, and effort; (3) implementing the measures in a controlled manner together with your team, without compromising performance or availability; (4) sustaining the savings with FinOps: cost allocation by team, budgets, alerts, and regular reviews. Learn more about Our Approach for cloud cost optimization.

A Well-Architected Review assesses your AWS environment against the AWS framework, which consists of six pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability. You’ll receive an overview of risks for each pillar and a prioritized list of improvements. This often leads to immediate cost savings and security improvements. The review can be completed in a few days, and the results are delivered in a report. SUE conducts the review and assists with the improvements. → AWS Well-Architected Review
A landing zone is the foundational setup of your AWS environment: how accounts are configured, how networking, access, and logging are managed, and which security and cost policies apply across the board. It’s often set up using AWS Control Tower. You need a landing zone before migrating your production workloads; cleaning up an environment that has grown organically afterward takes much more time. SUE builds landing zones according to AWS best practices, tailored to your compliance requirements. Read more about setting up an AWS landing zonehere.
There are several paths. Rehost: Move VMs to Amazon EC2 using the AWS Application Migration Service; this is the fastest way out of the data center, and you no longer need VMware licenses. Continue running VMware on AWS: With Amazon Elastic VMware Service (available starting in August 2025), you run VMware Cloud Foundation on AWS infrastructure; you manage everything as you’re used to, but retain your VMware licenses. Modernize: Convert applications to containers or managed services; this requires more work, but offers the greatest flexibility and the lowest costs in the long run. Most organizations combine these approaches on a per-workload basis. SUE handles this planning and carries out the migration, potentially within MAP.
The AWS Migration Acceleration Program (MAP) is a program through which AWS reimburses a portion of the costs associated with migrating to AWS, typically in the form of credits. It consists of three phases: (1) Assess: determining the business case and migration readiness; (2) Mobilize: preparation, including a landing zone and pilot migrations; (3) Migrate & Modernize: the actual migration. Whether you’re eligible and how much funding is available depends primarily on your expected annual AWS spending after the migration. MAP is administered through an AWS partner. SUE has extensive experience with this program and can guide you through the MAP process and help you prepare your application. You can read about how SUE approaches a MAP project on the AWS Migration Acceleration Program page.
The AWS European Sovereign Cloud is a separate AWS cloud within the EU, available starting in January 2026. The first region is located in Brandenburg (Germany). It is physically and logically separated from other AWS regions, is managed by employees residing in the EU, and is governed by European entities with their own management. AWS has announced sovereign Local Zones in the Netherlands and other countries. It is intended for government agencies, healthcare providers, financial institutions, and other organizations with strict data sovereignty requirements. Please note that not all AWS services are available there yet. Based on your needs and requirements, SUE recommends whether the Sovereign Cloud, a standard EU region, or another solution is the best fit for each workload.

Cloud Cost Optimization & FinOps

At AWS, most of the waste is in databases, compute, and networking: together, these account for more than three-quarters of the waste in the environments analyzed by SUE. At Azure, significant savings can be found in licensing (Azure Hybrid Benefit), procurement (reservations and the Savings Plan for Compute), and rightsizing.
The assessment is free.
5 business days from the time SUE gains read access to your cost data. After that, we’ll discuss the Cloud Cost Savings Plan with your team.

At least once a month with engineering and finance, with automatic alerts for deviations. You review commitments on a quarterly basis.

Residual capacity with up to a 90% discount, which the provider may reclaim at short notice. Suitable for batch processing, CI/CD, and stateless Kubernetes workloads that can tolerate interruptions.

Allocate costs by application, choose the smallest model that is sufficient, use prompt caching and batch processing, and measure GPU utilization. Focus on costs per outcome, such as per query processed.

The FinOps Open Cost and Usage Specification: an open standard for cost and usage data from the FinOps Foundation. AWS, Azure, Google Cloud, and an increasing number of SaaS providers deliver their data in this format, allowing you to compare costs across multiple sources.

Starting 12 January 2027, cloud providers will no longer be allowed to charge fees for transferring your data when you switch to another provider or move to an on-premises solution. Until that date, they may only pass on their own costs. You will still be charged for regular data traffic during use.

By serving data closer to the user (CDN, caching), limiting traffic between zones and regions, compressing data, and using gateway or private endpoints instead of NAT gateways.

The team that uses the resources is supported by the finance department and a FinOps manager. Ownership must be explicitly assigned; otherwise, no one will feel responsible.

Cloud costs expressed per unit that matters to your business, such as per customer, transaction, or order. This lets you see if you’re becoming more efficient as you grow.

With showback, teams can see their costs without having to pay them. With chargeback, the costs are charged to their budget. Start with showback and switch to chargeback once cost allocation is reliable.

A common target is 70–80% of steady-state baseline usage. Never commit to peaks or to workloads that will disappear within the contract term, and clean up and rightsize before you buy.

All three offer discounts in exchange for a one- or three-year commitment. A Reserved Instance on AWS or a reservation on Azure is tied to a specific resource type in a region, with discounts of up to 72% on AWS. A Compute Savings Plan on AWS, or the savings plan for compute on Azure, is a fixed hourly rate that applies to other instance types and regions as well—and on AWS, it also applies to Fargate and Lambda—with discounts of up to 66%. Google Cloud offers committed use discounts: resource-based for fixed vCPUs and memory, and spend-based for a fixed amount of usage. The more predictable your usage, the more you’ll benefit from the fixed-rate option.

Not necessarily. You can gain a lot of insight from the tools that AWS, Azure, and Google Cloud offer as standard, and all three provide cost data in the FOCUS format. Additional tools are especially worthwhile when dealing with multiple clouds, Kubernetes, or SaaS costs. We’ll recommend what’s right for your organization’s size.

Yes. The approach is the same; the tools and procurement models vary by cloud. We include multi-cloud environments, Kubernetes clusters, and AI workloads in the same analysis.

Not if you understand the risks associated with each measure. The provider can reclaim Spot capacity at short notice, and resource requests and limits set too tight can lead to CPU throttling or OOM kills. That’s why we assess the risk of each measure, test changes, and implement them in consultation with the team. Often, performance actually improves because resources are better aligned with usage.

Quick savings—such as decluttering, rightsizing, and shutting down test environments—often show up on the bottom line within a few weeks. At Colect, the first savings were realized within a month. Architectural changes take more time, so we implement them in phases.

In the AWS environments analyzed by SUE, 34.9% of the waste is in databases, 23.4% in compute, 18.9% in networking, 12.2% in storage, and 6.6% in unused resources. The greatest savings, therefore, require a technical review of databases and architecture. Simply cleaning up yields the least benefit. We are examining the same categories on Azure and Google Cloud.

That varies greatly depending on the environment. In the AWS environments analyzed by SUE, customers save between 4% and 80% on their bills, with an average savings of 37%. An environment that has grown over the years without being reviewed typically yields greater savings than one that has already been optimized. For Azure and Google Cloud, the assessment shows what savings are possible in your environment.

A Cloud Cost Optimization Assessment is a technical analysis of your environment on AWS, Azure, or Google Cloud. SUE examines your invoice and what lies behind it: architecture, workloads, usage, and procurement agreements. You’ll receive the Cloud Cost Savings Plan: a breakdown of costs by account, service, and team; recommended actions ranked by savings potential, effort, and risk; and a plan for the first 90 days. After that, we’ll implement the cost-saving measures together with your team.

Cloud Migration

On 11 October 2027, Broadcom will discontinue general support for vSphere 8 and ESXi 8. Your options are listed on the vSphere 8 end-of-life page.
Nothing. The Cloud Readiness Assessment is free. The Migration Roadmap is yours: you can carry out the migration with your own team, with SUE, or with another provider.
Usually two weeks. Your team will spend about 8 hours on it, mainly on two or three meetings with the owners of the key applications.
In addition to migration, SUE works on AWS in the areas of High Performance Computing, Kubernetes on EC2 and EKS, End User Compute, FinOps, Well-Architected Reviews, and modernization. NXP migrated its HPC environment to AWS with SUE’s help; Textkernel now runs on Kubernetes on AWS following a migration carried out by SUE.
An AWS consultant from SUE will first assess your applications, dependencies, and compliance requirements. Based on that assessment, we’ll select a migration strategy for each application—such as rehost, replatform, or refactor—along with a business case and a roadmap. We’ll then set up a landing zone and perform a controlled migration, with managed services as the next step if you’d like.

Well-known European providers include STACKIT, OVHcloud, IONOS, and Scaleway. In addition, hyperscalers offer sovereign options, such as the AWS European Sovereign Cloud. A European provider operates under European jurisdiction but offers fewer Managed Services and less tooling. You choose based on each dataset.

Moving workloads back from the public cloud to an in-house data center or private cloud. Organizations do this for reasons of cost, sovereignty, or performance. Just as with migration, you make that decision on a per-workload basis: if something works well in the cloud, you leave it there.

Not necessarily. Workloads with fluctuating demand are often cheaper in the cloud, while workloads that run 24/7 at a constant load are sometimes more expensive. The difference lies in rightsizing, reservations, shutting down what you’re not using, and factoring in management and hardware replacement costs.

You can migrate a single application in a matter of weeks. A data center with hundreds of servers is migrated in phases, often spread out over a year or longer. Gartner estimates that a complete migration away from VMware will take three years or more. A thorough assessment beforehand ensures reliable planning.

The terms are often used interchangeably. Cloud transition typically refers to the broader change—encompassing not only technology but also processes, management, costs, and your team’s expertise. Cloud Migration refers to the migration of applications, data, and the infrastructure itself.

By defining in advance how you’ll leave. SUE captures the environment as Infrastructure as Code, uses containers and open standards wherever possible, and writes an exit plan that outlines the sequence and costs of a migration. Operating completely independently of providers is expensive. Therefore, decide for each workload which managed services are worth the dependency.

A good partner advises on which cloud and which approach are best suited for each workload, rather than just selling a single cloud. They can also customize applications themselves if migration alone isn’t enough, and continue to manage costs after the system goes live. Ask about migrations similar to yours. SUE has been working on infrastructure since 1997, migrating to AWS, Azure, Google Cloud, and European clouds, and modernizing applications—all within the same team.

To AWS, Microsoft Azure, Google Cloud, European cloud providers, and private clouds. SUE does not favor any single provider: for each workload, we consider costs, the services required, compliance requirements, and your team’s expertise. Many organizations end up with a mix of public cloud and on-premises solutions.

Cloud Security

The Cybersecurity Act has been in effect since 15 August 2026. The duty of care requires, among other things, risk analysis, incident response, business continuity and backups, supply chain security, secure development with vulnerability management, encryption, access management with multi-factor authentication, and training. In the cloud, this involves identities and permissions, logging and detection, and the requirements you establish for your suppliers.
BIO2 was adopted on 23 September 2025, and is mandatory for the national government, the provinces, and the water boards; municipalities use it as a guideline. BIO2 builds on ISO 27001 and ISO 27002:2022 and takes a risk-based approach: the fixed baseline security levels have been eliminated. In the cloud, this means: determining the risks for each system, selecting measures, and demonstrating that they are effective—including at your cloud provider. BIO2 will serve as the framework for the government’s duty of care under the Cybersecurity Act.
Yes. A provider like SUE can set up your security tools, monitor your environment, and address any issues found. However, the ultimate responsibility for your data and for compliance with regulations such as the Cybersecurity Act remains with your own organization. Therefore, be sure to document who does what, how quickly an incident is reported, and how you will demonstrate during an audit that the system is working. See Managed Cloud Security.
A one-week assessment in which two SUE consultants review the security of your cloud environment: code and pipelines, applications in production, and the infrastructure. You’ll receive a report, an opportunity and impact matrix, and a roadmap that starts with the risks that have the greatest impact. Learn more on the Cloud Security Health Check page.
Nothing. The Cloud Security Health Check is free. The Security Report is yours: you can implement the improvements with your own team, with SUE, or with another provider.
One week, with two consultants from SUE. Your team will spend about 4 hours on this, mainly on the intake and reviewing the report.
Under DORA, you must evaluate your IT service providers, document agreements regarding security and business continuity, and have an exit strategy in place. SUE is ISO 27001- and ISO 9001-certified and makes the certificate and scope available for your supplier evaluation.
Yes, for the basics. Managed Cloud includes 24/7 monitoring, vulnerability management, and compliance controls. If you also want to outsource threat detection, security incident response, and container security, then Managed Cloud Security is the right choice for you.

Significant incidents: an early warning within 24 hours, an incident report within 72 hours, and a final report within one month. In the Netherlands, the Dutch Cybersecurity Act has governed this since 15 August 2026.

The agreement between the cloud provider and the customer regarding who is responsible for securing what. The provider is responsible for the cloud infrastructure. The customer remains responsible for identities, configuration, and data at all times, even with SaaS.

CSPM checks your cloud configuration for errors. A CNAPP combines CSPM with workload protection, access management, and frequent scans in the pipeline. This allows you to see …combine into an attack path.

The infrastructure of major providers is usually more secure than the average in-house data center. But in the cloud, a single configuration error can immediately expose data to the public. The difference lies in the design: with guardrails, least privilege, and continuous monitoring, the cloud can be secured effectively.

Cloud security is the set of measures, processes, and tools that protect data, applications, and infrastructure in the cloud: identities and access, configuration, networking, encryption, logging, and workload security. The provider secures the infrastructure; you secure what runs on it. With cloud native applications—using containers, Kubernetes, and serverless—this is largely done through code: policies as code, image scanning in the pipeline, and runtime detection in the cluster.
The risks most likely to lead to an incident include: publicly accessible resources, overly broad permissions, and disabled logging. A new tool won’t automatically solve these issues. In a Cloud Security Health Check, SUE assesses your environment within one week and maps each risk onto a risk-and-impact matrix, so you know which issues to address first.
SUE uses Wiz for CNAPP, Cloudflare for Zero Trust access, Aquasec for containers and Kubernetes, and the cloud’s own security services, such as Amazon GuardDuty and Microsoft Defender for Cloud. We start with what’s already in place and only add what’s missing. We reduce the number of overlapping tools so your team receives fewer duplicate alerts.

Cloudflare

With self-management, your own team sets up and maintains the policies, rules, and integrations. With Managed Cloudflare, SUE handles that for you: 24/7 monitoring, updating policies and firewall rules, access management, vulnerability management, and incident response, with agreed-upon response times. You retain control over what is allowed and why. If you choose self-management, SUE is available for support and advice.
The first applications can often be migrated to Cloudflare Access within a few weeks. A full migration—including deployment on all devices and phasing out the VPN—depends on the number of applications, the variety of devices, and how well your identity provider is configured. By migrating application groups one at a time, the organization will hardly notice the transition. SUE creates a schedule in advance based on your environment.
NIS2 requires organizations to take appropriate measures against cyber risks and to report incidents promptly. Cloudflare helps with several of these measures: identity-based access (zero trust), multi-factor authentication, protection against DDoS attacks and web application attacks, internet traffic filtering, and centralized logging for detection and investigation. But that alone doesn’t make you compliant: NIS2 also covers risk management, policies, vendors, and incident response processes. SUE helps you implement the technical measures and align them with your broader NIS2 approach.
Cloudflare provides the tools needed to operate in compliance with the GDPR. It has been validated under the EU Cloud Code of Conduct and enters into a data processing agreement. By default, Cloudflare processes traffic in the data center closest to the user, anywhere in the world. With the Data Localization Suite, you can restrict this: Regional Services ensures that traffic for selected domains is decrypted and processed only within the EU, and the Customer Metadata Boundary keeps logs and metadata within the EU. However, Cloudflare is a U.S. company. Have the legal implications of the U.S. CLOUD Act assessed for your specific situation. SUE will configure the appropriate settings.
Both are robust platforms for zero-trust and secure internet access, each with a different background. Zscaler began as a security service and excels at web filtering and inspecting user traffic for large organizations. Cloudflare combines networking, security, and performance into a single platform: it also offers DDoS protection, a web application firewall (WAF), a CDN, and WAN replacement. If you want to secure not only user access but also your websites, APIs, and network on a single platform, Cloudflare is the obvious choice. Also consider your existing tools, the pricing model, and the management overhead. SUE helps you make the comparison based on your needs and requirements.
In many cases, yes—with Cloudflare Magic WAN. You connect branch offices, data centers, and cloud environments to the Cloudflare network via standard internet connections. Traffic, routing, and security (firewall, gateway) are managed centrally there. This is usually cheaper and more flexible than MPLS contracts, and new locations can be connected more quickly. Please note that applications with strict requirements for latency or fixed bandwidth must be evaluated in advance. You’ll transition in phases, location by location, while MPLS remains a fallback option until the end of the contract. SUE will perform the comparison and carry out the migration.
With Cloudflare Zero Trust, users gain access to individual applications rather than the entire network. With each request, Cloudflare verifies the user’s identity (through your existing identity provider, such as Microsoft Entra ID) and the device’s status. The transition is a phased process: (1) connect your identity provider; (2) place an initial group of applications behind Cloudflare Access; (3) roll out the Cloudflare client on devices; (4) migrate the remaining applications in groups; (5) disable the VPN. The VPN can remain in place during the transition. SUE designs the policies and guides the deployment.

Dynatrace

Dynatrace Intelligence supports three phases: recommendations, human-supervised actions, and autonomous actions within defined guardrails. You choose the level of automation for each type of incident. We recommend starting with recommendations and approval, and only automating once the results are demonstrably accurate.

Dynatrace helps with the technical aspects of DORA, such as rapid incident analysis, insight into vulnerabilities in third-party software using Runtime Vulnerability Analytics, and change validation with Site Reliability Guardian. The Compliance Assistant aggregates relevant metrics and events for reporting. Policies and reporting processes to the regulator remain your responsibility, and we’re here to help you navigate them.

Costs depend on what you monitor and how much data you store and retain. With OpenPipeline, you filter data before it is stored in Grail, and you can set how long to retain each type of data. We provide an estimate upfront based on your environment and then track your usage on a monthly basis.

Yes. Dynatrace maps the entire topology of your Kubernetes environment and identifies the responsible service or infrastructure component in the event of an incident. You can import data that you’re already collecting with OpenTelemetry into Dynatrace, including data for AI workloads using the GenAI conventions.

You can purchase Dynatrace through a partner such as SUE or through your cloud provider’s marketplace. When you purchase through SUE, you combine the license with implementation, management, and assistance in aligning usage with what you’re monitoring. If you purchase through the marketplace, it may count toward your existing agreements with AWS, Azure, or Google Cloud. We’ll work with you to determine which option is most cost-effective for you.

Elastic

Elastic Cloud or Serverless is the fastest option if you don’t want to manage clusters and your data can be stored in a European cloud region. A self-managed setup using the ECK operator on your own Kubernetes (including OpenShift, AKS, EKS, and GKE) is a better fit if your data must remain on-premises or air-gapped. We’ll help you choose based on data location, management overhead, and costs, and can take over management if you’d like.

Yes. Elasticsearch stores dense and sparse vectors and combines vector search with keyword search and filters (hybrid search). Forrester named Elastic a Leader in *The Forrester Wave: Cognitive Search Platforms, Q4 2025*. With Agent Builder, you can build agents that communicate with other systems and language models via MCP and A2A.

First, determine which logs you need and for how long, and define this in index lifecycle management using hot, warm, and cold tiers. According to Elastic, the logsdb index mode—available starting with Elastic 8.17—reduces log data storage by up to 65%. This feature is fully available in the Serverless and Enterprise licenses, so your choice of license is a factor in your calculations.
Yes, in two ways. With Elastic Cloud, Elastic runs the platform in a European cloud region of your choice, and we manage the configuration, setup, retention, and detection rules. If your data needs to remain on-premises or in your own cloud account, we run Elasticsearch in a self-managed configuration and handle upgrades, snapshots, and cluster management. We tailor shards and sizing to your growth, so you don’t have to keep resharding over and over again.

Start by taking stock of your data sources, detection rules, and dashboards. Elastic offers Automatic Migration for detection rules (generally available since Elastic 9.2) and for dashboards (technical preview). We recommend running both platforms in parallel for a period of time so that your SOC can validate the new detections.

GitLab

Yes. With Managed GitLab, SUE handles upgrades, patches, backups, monitoring, and runner management—whether in your own data center or on AWS, Azure, or Google Cloud. GitLab releases a new version every month, and we schedule the upgrades so they don’t disrupt your teams. You retain control over access, data, and configuration.

Yes. With GitLab Duo Agent Platform Self-Hosted, you can run models on your own infrastructure; since GitLab 19.0, this also includes open models such as Mistral Devstral 2 and GLM-5.1 via vLLM. With an offline license, this works entirely without an internet connection.

GitLab.com is a multi-tenant SaaS solution that requires the least amount of management. GitLab Dedicated is a single-tenant SaaS solution where GitLab manages the platform for you on AWS in a region of your choice, with BYOK and a monthly update to the N-1 release. With the self-managed option, you run the platform yourself or have SUE manage it for you, in your own data center or cloud. This is also the option for air-gapped environments.

Atlassian will discontinue Jira and Confluence Data Center on 28 March 2029; starting 30 March 2026, new customers will no longer be able to purchase Data Center subscriptions. Bitbucket and Bamboo Data Center are not subject to this end date and will remain available through a Bitbucket Hybrid License. If you still want to move to a single platform for code, CI/CD, and issues, GitLab’s Bitbucket Server importer will migrate your repositories, pull requests, and comments.

Start by taking inventory of your Jenkinsfiles, shared libraries, and plugins, and select a few representative pipelines as a pilot. The "Convert to GitLab CI/CD Flow" feature in the GitLab Duo Agent Platform converts Jenkins syntax to GitLab CI/CD YAML and creates a merge request for it. SUE reviews and standardizes that output into reusable templates, so you can then migrate on a team-by-team basis.

Google Cloud

The Gemini Enterprise Agent Platform is the environment in which Google has been consolidating its tools for building and managing AI agents since Next 2026, including Vertex AI Agent Builder and the Agent Development Kit. You can select models such as Gemini 3.1 Pro and manage permissions and monitoring through Agent Identity, Agent Gateway, and Agent Observability. According to Forrester, Agent Identity is generally available, while many other components are still in preview.

RaMP (Rapid Migration & Modernization Program) is Google Cloud’s migration program. It begins with an assessment that includes a TCO analysis and can subsequently provide service funds and Google Cloud credits, depending on the expected usage of the migrated workloads. We’ll evaluate whether RaMP is a good fit for you on a per-migration basis.

Data Boundary keeps your data in the public Google Cloud within a selected region, with dedicated key management and control over administrator access. Google Cloud Dedicated runs on separate infrastructure managed by a local partner, such as Thales in France and, starting in late 2026, in Germany. Google Distributed Cloud (air-gapped) is located in your own data center, with no connection to the internet.

The Dutch Google Cloud region is called europe-west4 and operates in Google's data center in Eemshaven. Using organizational policies or the EU Data Boundary feature in Assured Workloads, you can enforce that new resources are created only in EU regions such as europe-west4.

Start by gaining insights on a per-project and per-team basis, using labels and exporting your billing data to BigQuery. Next, perform rightsizing based on Recommender’s recommendations, clean up unused resources, and take advantage of committed use discounts for stable workloads. For GKE, Autopilot—where you pay per pod instead of per node—can be more cost-effective with fluctuating workloads. To learn how SUE implements these steps with you, read “Reducing Cloud Costs with FinOps.”

High-Tech & Manufacturing Industry

Yes. MES vendors such as Critical Manufacturing provide their application layer as containers for Kubernetes, OpenShift, AKS, and EKS. Run the cluster on-premises at each factory so that operations continue uninterrupted if the connection to the cloud or headquarters is lost. With multiple nodes and rolling updates, you can implement updates without halting production. Databases and some components often still run on Windows servers outside the cluster; be sure to include these in your design.
If your computing demand spikes around projects or releases, or if your on-premises cluster needs to be replaced, cloud HPC can handle those spikes without requiring you to purchase hardware specifically for peak demand; for constant, high workloads, on-premises solutions may remain more cost-effective. With SUE, NXP migrated its HPC environment to AWS.
The edge handles tasks that must continue even if the connection is lost or that require a response within milliseconds: data collection from machines, vision inference on the production line, and data buffering. Real-time control remains on the PLC. The cloud handles tasks that require significant computing power or storage but aren’t real-time: model training, cross-factory analyses, and long-term storage. With GitOps, you manage both using the same approach.
As of 11 September 2026, you must actively report actively exploited vulnerabilities in your products within 24 hours (early warning) and 72 hours (notification) via ENISA’s reporting platform. Starting 11 December 2027, the full requirements will take effect, including vulnerability management during the support period. To comply, you must know which software components are included in each product, and that starts in your CI/CD pipeline.
Start by taking inventory of everything connected to the OT network, because you can’t secure what you don’t know about. Next, divide machines and systems into zones according to IEC 62443, and allow traffic between zones only via fixed, controlled connections. Data to MES, ERP, or the cloud travels through an intermediate zone, not directly from the machine. SUE exposes machines using the Cilium Egress Gateway, with fixed outbound IP addresses per workload and without physical NAT routers.

Kubernetes

For software companies and SaaS teams that run Kubernetes in production and want to keep their engineers focused on the product. Stormin, Onyx One, and Monaliro have SUE manage their Kubernetes environments. Their own teams focus on software development, the product, and their customers.
SUE handles day-to-day management, upgrades, and troubleshooting. We monitor pods, nodes, and services in real time based on metrics, logs, and traces; manage autoscaling based on demand; and scan container images. Through policy enforcement, we control what is allowed to run in the cluster.
No. EKS, AKS, and GKE are Kubernetes services offered by AWS, Microsoft, and Google. The cloud provider manages the control plane. Workloads, add-ons, security settings, monitoring, and upgrade planning remain your responsibility. SUE takes care of that part, whether on EKS, AKS, and GKE or on clusters in your own data center. With SUE’s Managed Kubernetes, you hire a management team; the platform itself remains with AWS, Microsoft, Google, or in your own data center.
With Managed Kubernetes, a specialized provider takes over the management of your Kubernetes clusters—including upgrades, security, monitoring, and incident resolution. SUE manages clusters in the public cloud and on-premises and monitors them 24/7. Your engineers can focus their time on the product rather than the platform.

OpenShift is a comprehensive enterprise platform with extensive built-in functionality and support from Red Hat, and it is well-suited for regulated and hybrid environments. Rancher excels at centrally managing multiple clusters across different infrastructures, and it is lighter and more flexible. Existing expertise, requirements, and budget are usually the deciding factors.

Container orchestration is the automatic deployment, distribution, scaling, and recovery of containers across multiple servers. You describe how your application should run, and the orchestrator ensures that it continues to do so: it starts containers, moves them if a server fails, and adds more when demand increases. Kubernetes is the industry standard for this. Alternatives include Docker Swarm, HashiCorp Nomad, and services like Amazon ECS. Without container orchestration, you manage containers manually on a per-server basis.

EKS, AKS, and GKE all scale automatically—both the number of pods and the number of nodes. The difference lies in how much you configure yourself. With GKE Autopilot and EKS Auto Mode, the provider fully manages the nodes. With AKS and standard EKS, you choose the node pools and the autoscaler yourself—often Karpenter for EKS. In practice, realistic resource requests and well-configured autoscalers have a greater impact on how smoothly a cluster scales than the choice of provider.

There is no single platform that is best for everyone. The well-known distributions are all certified by the CNCF, so the core of Kubernetes is the same across the board. The choice depends mainly on five factors: where you run your workloads, your compliance requirements, whether you need to run VMs on the platform, your team’s capabilities, and how many clusters you manage. As a rule of thumb:
  • primarily in a single public cloud: EKS, AKS, or GKE;
  • Managed and hybrid: Red Hat OpenShift;
  • many clusters on different infrastructure: SUSE Rancher Prime with RKE2;
  • on-premises or at the edge with many identical nodes and a minimal OS: Talos Linux with Omni;
  • Data that must remain in Europe: a European cloud provider or on-premises.
The weighting for each question is listed in Section 5.

Start with your cloud provider’s managed Kubernetes service: Amazon EKS, Azure AKS, or Google GKE. The provider manages the control plane, and all you need to do is set up the nodes and applications. With GKE Autopilot or EKS Auto Mode, the provider also manages the nodes. To learn Kubernetes on your own laptop or a test server, k3s or MicroK8s will suffice. Installing it yourself using kubeadm or a minimal platform like Talos Linux requires more platform knowledge and is better suited for an experienced team.

In phases, starting with the simplest applications. For each application, you decide whether to place it in a container, run it as a virtual machine, or phase it out. Next, you move on to stateless web applications and APIs. You extract configuration and secrets from the code, test in a separate cluster, and let the old and new systems run side by side for a while before switching over. Applications that don’t yet fit into a container can run as VMs on the same platform using KubeVirt. The complete step-by-step plan is in Section 11.

Choose a container for applications that you are actively developing, deploy frequently, and want to scale automatically. Choose a VM for software that requires a proprietary or legacy operating system, that a vendor only supports as a VM, or whose license is tied to a VM. With KubeVirt, OpenShift Virtualization, or SUSE Virtualization, you can run both on a single Kubernetes platform.
Docker is a tool for building and running containers on a single machine. Kubernetes manages the running of containers across multiple machines: distributing, scaling, recovering, and deploying them.

Yes. Kubernetes runs on any infrastructure, including in your own data center or with a European cloud provider. We manage those environments the same way we do in the public cloud.

Yes. With OpenShift Virtualization or SUSE Virtualization, you can run virtual machines and containers on the same platform. This allows you to transition from VMware in phases, without having to move everything to containers right away. SUE guides the migration and can manage the platform afterward.

Especially for Kubernetes in your own data center, at the edge, or with a sovereign European provider. Talos has no SSH, no shell, and no package manager: every node is identical, and the attack surface is small. We upgrade the operating system and Kubernetes in a single step, and that step is reversible. If you primarily run your environment in a single public cloud, the managed service offered by that cloud (EKS, AKS, or GKE) is usually simpler.

Amazon EKS, Azure AKS, Google GKE, Red Hat OpenShift, SUSE Rancher (RKE2), Talos Linux, and Multistax—in the public cloud, on-premises, at the edge, or in a sovereign environment.

Linux

Monitoring runs around the clock. Your SLA specifies what happens when a report is received outside of business hours. With 24/7 support, a SUE “ engineer ” will handle the report even at night.
Yes. In addition to RHEL and SLES, we manage Ubuntu, Debian, Rocky Linux, and AlmaLinux. If an error occurs in RHEL or SLES, SUE also involves Red Hat or SUSE. To find out which distribution is right for your environment, see the guide “Choosing a Linux Distribution.”
The price depends on the number of servers, the distributions, and whether you need support on business days (8x5) or around the clock (24x7). For environments with up to 150 servers, we offer Linux management outsourcing, a fixed-price package. For larger environments, SUE will prepare a customized proposal following an initial consultation.
Monitoring runs 24/7. Support included in the standard package is available 8x5, on business days during business hours. You can add 24/7 support, as well as security scanning, hardening, and IAM automation.
Having your own administrator makes sense if Linux is your core business and you have enough work to fill a full-time position. If that’s not the case, having just one administrator becomes a risk in the event of vacation, illness, or resignation. SUE works with over 70 certified Linux engineers and follows established processes in accordance with ISO 9001. If you already have an administrator, SUE can supplement your team with on-demand support.
For organizations with 1 to 150 Linux servers where Linux is essential but not a core business activity. Often, the expertise lies with one or two engineers, and managing the servers is done in addition to their other work.
Linux Management Standard covers monitoring, patching, and backup checks for 1 to 150 Linux servers. SUE monitors CPU, memory, disk space, and availability, with alerts via email or Slack. We apply patches monthly with pre- and post-patch checks, and you’ll receive a health check report every month. Also included are an initial security baseline scan and 6 hours of Linux OS management per month.
Outsourcing Linux management is a fixed-price package for 1 to 150 servers at a fixed monthly rate, including patching, monitoring, and backup checks. Managed Linux is a customized solution for larger or more complex environments, featuring 24/7 monitoring, proactive incident response, and a custom SLA.
With Managed Linux, SUE takes over responsibility for your Linux servers: monitoring, vulnerability management, incident response, and day-to-day management. SUE has been providing Linux engineering services since 1997. You’ll have direct access to engineers who are familiar with your environment, with an SLA that we agree upon with each organization.

Broadcom will support vSphere 8 and ESXi 8 through 11 October 2027. Those who do not wish to migrate to VMware Cloud Foundation 9 after that date can choose from platforms based on Linux and KVM:

  • KVM with libvirt on RHEL or SLES: the foundation of nearly all alternatives. Suitable for smaller environments with in-house Linux expertise.
  • SUSE Virtualization (formerly Harvester): virtualization on Kubernetes, managed from Rancher.
  • Red Hat OpenShift Virtualization: virtual machines alongside containers on OpenShift.
  • Proxmox VE: Based on Debian, with its own web interface and optional paid support. Popular among smaller teams.
  • Apache CloudStack: a KVM-based cloud platform for large private clouds serving multiple departments or customers. With SUE, NXP replaced its virtualization software with CloudStack.

SUE supports migrations to any of these platforms. Nutanix, Hyper-V, and Azure Local are also options. The best choice depends on the number of VMs, your management expertise, and whether you also want to run containers on the same platform. Learn more in the Kubernetes guide.

Ansible is an open-source tool from Red Hat that captures server configurations as code. You describe in playbooks what a server should look like, and Ansible brings each server into that state. No agent runs on the servers: Ansible works via SSH. During a migration, you can set up each new server identically, test the configuration in advance, and repeat the process. This also makes subsequent migrations easier. For larger environments, there’s the commercial Red Hat Ansible Automation Platform, which includes a web interface, access control, and logging. To learn how to write an Ansible role, check out our blog post on Ansible best practices.

Each major release of Red Hat Enterprise Linux receives updates for ten years. After that, you can extend support by purchasing Extended Life Cycle Support (ELS).
Version Full support until Maintenance (updates) until
RHEL 6 10 May 2016 30 November 2020
RHEL 7 6 August 2019 30 June 2024
RHEL 8 31 May 2024 31 May 2029
RHEL 9 31 May 2027 31 May 2032
RHEL 10 31 May 2030 31 May 2035
If you're still running RHEL 6 or 7 without ELS, you will no longer receive security updates. In that case, plan an upgrade or migration. As of October 2026; Red Hat provides approximate future dates.

Yes, especially for cloud native and developer workloads, and with Ubuntu Pro for extended support. Just make sure your core software is certified for Ubuntu.

Yes, and that happens often—for example, RHEL for general-purpose servers and SLES for SAP. Keep the number to a minimum and set everything up using the same automation tools.

Both are free, RHEL-compatible successors to CentOS, with a similar lifecycle. Rocky Linux is supported by a community centered around the founder of CentOS; AlmaLinux is supported by a foundation backed by CloudLinux. For most workloads, the technical differences are minor.

Both are enterprise distributions with long-term support. RHEL has the broadest certification for enterprise software and forms the basis of OpenShift. SUSE excels in SAP environments and high availability, and forms the basis of Rancher and SUSE Virtualization. The decision often depends on what your software vendors support.

Red Hat Enterprise Linux and SUSE Linux Enterprise Server, for which we are a partner, as well as community editions such as Ubuntu, Debian, Rocky Linux, and AlmaLinux.

Yes. We start with an assessment and health check, automate the configuration, and then take over management.

This depends on the number of servers, the service level, and whether you need 24/7 incident response. Linux Management Standard is a fixed-price package for 1 to 150 servers, with a fixed monthly fee. Compare that to the cost of 24/7 management with your own staff: for a full on-call service, you’ll quickly need five to six engineers.

Yes. First, we identify which applications are running on the servers and what support their vendors provide. Then, we use automation to migrate to RHEL, SUSE, or an RHEL-compatible distribution, and we test each application individually. At Rijk Zwaan, we did this for the entire CentOS environment.

Managed Services

Monitoring runs around the clock. Your SLA specifies what happens when a report is received outside of business hours. With 24/7 support, a SUE “ engineer ” will handle the report even at night.
Yes. In addition to RHEL and SLES, we manage Ubuntu, Debian, Rocky Linux, and AlmaLinux. If an error occurs in RHEL or SLES, SUE also involves Red Hat or SUSE. To find out which distribution is right for your environment, see the guide “Choosing a Linux Distribution.”
The price depends on the number of servers, the distributions, and whether you need support on business days (8x5) or around the clock (24x7). For environments with up to 150 servers, we offer Linux management outsourcing, a fixed-price package. For larger environments, SUE will prepare a customized proposal following an initial consultation.
Monitoring runs 24/7. Support included in the standard package is available 8x5, on business days during business hours. You can add 24/7 support, as well as security scanning, hardening, and IAM automation.
Having your own administrator makes sense if Linux is your core business and you have enough work to fill a full-time position. If that’s not the case, having just one administrator becomes a risk in the event of vacation, illness, or resignation. SUE works with over 70 certified Linux engineers and follows established processes in accordance with ISO 9001. If you already have an administrator, SUE can supplement your team with on-demand support.
For organizations with 1 to 150 Linux servers where Linux is essential but not a core business activity. Often, the expertise lies with one or two engineers, and managing the servers is done in addition to their other work.
Linux Management Standard covers monitoring, patching, and backup checks for 1 to 150 Linux servers. SUE monitors CPU, memory, disk space, and availability, with alerts via email or Slack. We apply patches monthly with pre- and post-patch checks, and you’ll receive a health check report every month. Also included are an initial security baseline scan and 6 hours of Linux OS management per month.
Outsourcing Linux management is a fixed-price package for 1 to 150 servers at a fixed monthly rate, including patching, monitoring, and backup checks. Managed Linux is a customized solution for larger or more complex environments, featuring 24/7 monitoring, proactive incident response, and a custom SLA.
With Managed Linux, SUE takes over responsibility for your Linux servers: monitoring, vulnerability management, incident response, and day-to-day management. SUE has been providing Linux engineering services since 1997. You’ll have direct access to engineers who are familiar with your environment, with an SLA that we agree upon with each organization.
Yes. SUE manages cloud environments that are integrated with systems in your own data center. If the majority of your systems still run on-premises, Managed Infrastructure is a better fit.
Yes, for the basics. Managed Cloud includes 24/7 monitoring, vulnerability management, and compliance controls. If you also want to outsource threat detection, security incident response, and container security, then Managed Cloud Security is the right choice for you.
SUE uses Prometheus and Grafana for monitoring. We define deployments as Infrastructure as Code in Terraform, so that each environment can be built in a repeatable manner. In Kubernetes, we use Kubernetes-native automation.
With managed cloud services, an external provider manages your cloud environment—including monitoring, incident response, security, automation, and waste reduction. SUE manages environments on AWS, Azure, and Google Cloud, including those combined with on-premises systems. We act as an extension of your team, with direct access to the engineers who know your environment.
For software companies and SaaS teams that run Kubernetes in production and want to keep their engineers focused on the product. Stormin, Onyx One, and Monaliro have SUE manage their Kubernetes environments. Their own teams focus on software development, the product, and their customers.
SUE handles day-to-day management, upgrades, and troubleshooting. We monitor pods, nodes, and services in real time based on metrics, logs, and traces; manage autoscaling based on demand; and scan container images. Through policy enforcement, we control what is allowed to run in the cluster.
No. EKS, AKS, and GKE are Kubernetes services offered by AWS, Microsoft, and Google. The cloud provider manages the control plane. Workloads, add-ons, security settings, monitoring, and upgrade planning remain your responsibility. SUE takes care of that part, whether on EKS, AKS, and GKE or on clusters in your own data center. With SUE’s Managed Kubernetes, you hire a management team; the platform itself remains with AWS, Microsoft, Google, or in your own data center.
With Managed Kubernetes, a specialized provider takes over the management of your Kubernetes clusters—including upgrades, security, monitoring, and incident resolution. SUE manages clusters in the public cloud and on-premises and monitors them 24/7. Your engineers can focus their time on the product rather than the platform.

Yes. SUE is certified to ISO 27001 (information security) and ISO 9001 (quality management). Both certifications apply to consultancy, projects, Managed Services, products, and research and development. The certificate numbers are 211802/A/0001/UK/En (ISO 9001) and NL 1519.1.1 (ISO 27001).

Because there may come a time when you want or need to switch partners. Make sure to establish in advance that the configuration, code, documentation, and data belong to you, how the handover will take place, and what support the partner will provide during the process. That way, you can leave without disrupting operations.

That depends on the contract. Common remedies include service credits (a discount on the invoice) and a corrective action plan. If the partner repeatedly fails to meet the SLA, you should be able to terminate the contract. More important than the penalty is ensuring that the root cause is resolved permanently.

Typically one to three years, with a notice period of several months. A longer term may result in a lower price, but be sure to consider the option to adjust the scope and service level during the term.

A model in which your own team and a partner manage operations together, with a fixed division of responsibilities. Often, your own team handles the work during the day, while the partner takes care of nights, weekends, and specialized topics.

With staff secondment, you hire people whom you manage; you pay by the hour. With Managed Services, the partner is responsible for the results—as set forth in an SLA—at a fixed price. Staff secondment provides more direct control, while managed services offer greater continuity, since management does not depend on a single person.

Yes. With co-managed support, your own team handles support during business hours, and SUE takes over monitoring and incident response outside of business hours. To that end, we establish agreements in advance regarding runbooks, access, and handoffs.

Yes, for the part that deals with the platform: patch policy, hardening, logging, access management, backups, and incident procedures. You’ll receive reports that you can use during an audit. Responsibility for compliance remains with your own organization.

Yes. We’ll start with an assessment and health check, make arrangements for the handover with the current provider, and take over management in phases. We’ll address any missing documentation during the transition.

Yes. You set the priorities, make changes, and determine the budget. You’ll have access to monitoring and reports; the configuration is stored in a repository that belongs to you; and during the service meeting, we’ll discuss what happened and what could be improved.

This depends on the scope, the service level, and whether you need 24/7 incident response. After the assessment, you’ll receive a fixed monthly price—with no surprises later on.

Microsoft Azure

Start by gaining insights on a per-subscription and per-application basis using Azure Cost Management and the FinOps hubs from the Microsoft FinOps toolkit. Next, focus on right-sizing, cleaning up unused resources, buying Azure Reservations for stable workloads, and making architectural choices such as using PaaS instead of VMs. With Cloud Cost Optimization, we’ll carry out these steps with you and embed them within your teams.

Yes, Microsoft Foundry offers Global, Data Zone, and Regional deployments, and hosted agents in Foundry Agent Service support regional data residency in approximately twenty Azure regions. With VNet integration and Entra ID, the agent communicates with your on-premises systems without a public endpoint.

With the EU Data Boundary, scheduled for completion in February 2025, customer data and support data from most Azure services will be stored and processed within the EU and EFTA. However, Microsoft remains a U.S. company, so the risk posed by extraterritorial legislation such as the CLOUD Act does not disappear as a result. In a Data Sovereignty Assessment, we evaluate whether the Sovereign Public Cloud, External Key Management, or Azure Local is sufficient for each workload.

Start with the version: .NET 8 and .NET 9 will no longer receive updates after 10 November 2026; .NET 10 will be supported until November 2028. Next, identify the business logic within the application and how it is tied to the interface and database. Upgrade, decouple, and containerize each component, using AKS, Azure Container Apps, or App Service as the target. SUE has modernized .NET applications to Azure using this approach.

Microsoft will discontinue the pay-as-you-go versions of AVS that include the VMware license on 31 October 2026, and the license-included service as a whole on 30 August 2027. After that, you’ll only be able to run AVS with your own transferable VCF licenses from Broadcom. We’ll help you choose, on a per-workload basis, between AVS with your own license, rehosting to Azure VMs, or modernizing to AKS and PaaS.

Research & R&D

Yes. You run an open-source model on your own GPUs or in your own cloud account—for example, using vLLM on Kubernetes—so that the data never leaves your environment. An alternative is to use a language model via a cloud service in a European region, such as Amazon Bedrock, which does not use your input to train models.

In both cases, you connect the retrieval-assisted generation (RAG) model to your own documents and data, with the same access permissions as the source. SUE’s Data & AI team starts with a use case workshop so you can first determine which question you want to answer and with which data.

Pay only for the actual computing power you use. Let clusters scale up and down automatically so that no nodes sit idle between runs. Run jobs that can be restarted on spot instances, and save intermediate steps of long computations so that an interruption doesn't result in lost work.

Categorize costs by project or grant, and you’ll see how much each research project costs. When it comes to GPUs, first assess how well they’re being utilized before scaling up. Using cloud cost optimization and FinOps, SUE identifies these costs and works with you to implement the necessary measures.

Start by understanding, not by rewriting. Computational models that are decades old contain formulas and assumptions that aren’t documented anywhere else. Re:App loads the codebase, build configuration, and documentation into a knowledge graph, allowing developers to ask questions in plain language about call trees, dependencies, and formulas. At Deltares, this involved about six million lines of code spanning forty years of software history. After that, you decide for each module what to keep, modify, or replace.

AWS will no longer accept new users for Research and Engineering Studio (RES) as of 29 September 2026. The latest version, 2026.09, will be supported through 30 September 2027. After that, you have three options: continue managing RES yourself or with a partner (it is open source), switch to AWS services such as Amazon WorkSpaces or AWS Parallel Computing Service, or switch to another portal such as Open OnDemand.

None of these options is a direct replacement, so plan the transition well in advance of September 2027. SUE has built test environments on RES and understands the dependencies involved in a transition.

Separate the working layer from the archive. A parallel file system such as Amazon FSx for Lustre provides the throughput a pipeline needs during computation. Object storage such as Amazon S3 serves as your data lake and archive, where you can store data cost-effectively for the long term. You can connect FSx for Lustre directly to S3, so you only pay for high throughput as long as computations are running. Be aware of large numbers of small files: they slow down a parallel file system. Bundle them before the computation step or move them to a different storage tier.

Government & Public Sector

Haven is the VNG standard for platform-independent cloud hosting for municipalities, based on Kubernetes. An application running in one Haven environment will work in any other, whether it’s hosted by a hyperscaler, a Dutch provider, or in your own data center. Municipalities either adopt the standard or explain why they do not.

The Haven Compliancy Checker verifies that your cluster meets requirements such as a recent Kubernetes version, multiple availability zones, at least three control plane nodes and three worker nodes, RBAC, Linux hardening, ReadWriteMany storage, logging, and monitoring. SUE builds and manages Kubernetes platforms and configures them to pass these checks.

The Cybersecurity Act has been in effect since 15 August 2026, and applies to municipalities, provinces, water boards, and the national government. The governing body is explicitly responsible for managing cyber risks, and serious incidents must be reported. BIO2 is the standard used to fulfill the duty of care.

At the municipal level, the municipal council oversees operations, while the National Inspectorate for Digital Infrastructure oversees the entire government. The Information Security Service (IBD) assists municipalities in the event of incidents.

Yes, under certain conditions. A stricter government cloud policy has been in effect since 3 July 2026. If you use a public cloud service, you must first set out in a cloud strategy why you are using it, what risks it entails, and how you will mitigate those risks. Consider, for example, dependence on a single provider or on a provider governed by non-European law. An exit plan is mandatory for critical cloud services.

Source files from core registries such as the BRP and the BRK may not be stored in the public cloud, and the government advises against using the public cloud for email and documents. Existing services have four years to comply with the policy.

Under BIO2, you demonstrate that measures have been designed, are in place, and are effective. Start with the risk analysis, as that determines which measures you need. In the cloud, the easiest way to provide this evidence is through the platform itself: a landing zone as code, policies that block or report anomalies, centralized logging as an audit trail, and encryption using your own keys.

This way, you don't have to keep track of separate documents for an audit. SUE built a BIO-compliant cloud environment for a government organization using this approach.

BIO2 is the new Government Information Security Baseline and has replaced BIO 1.04 as of 23 September 2025. It is based on ISO 27001 and ISO 27002 from 2022. The three fixed baseline security levels are being phased out: you select measures based on a risk analysis and supplement them with the government measures that apply to you.

BIO2 is legally linked to the Dutch Cybersecurity Act and thus fulfills the duty of care for government organizations.

Platform Engineering

One week. Each of your developers will spend about two hours on an interview and the validation session. At the end of the week, we’ll present the Platform Vision and roadmap to your team and the budget manager.

Adoption by developers, continuing to maintain the platform, and demonstrating its benefits. Having multiple platforms running side by side and a platform designed without input from developers are the most common causes of problems.

Four metrics from the DORA study for measuring software delivery: deployment frequency, time from commit to production, the percentage of changes that lead to an incident, and recovery time after an incident. They show whether a platform makes delivery faster and more stable.

No, but it's the most commonly used foundation because Kubernetes standardizes deployment, scaling, and recovery. A platform can also run on managed container services or serverless infrastructure. Learn more in the Kubernetes guide.

Backstage is an open-source framework for developer portals, originally developed by Spotify and now a project of the Cloud Native Computing Foundation. It offers a service catalog, templates, and plugins. It is flexible, but requires in-house development resources to set up and maintain.

An Internal Developer Platform (IDP) is the set of tools, services, and automation that development teams use via self-service to build, test, and deploy software. It often includes a developer portal, golden paths, CI/CD, Kubernetes, security policies, and observability.
DevOps is a culture and way of working in which teams build and run their own software. Platform engineering makes this feasible at scale: a platform team provides the tools and automation, so that not every team needs to have all the infrastructure knowledge itself.

Ownership. Your team determines the roadmap, the standards, and what the platform delivers. SUE collaborates on the development, contributes its expertise, and can take over the day-to-day management of clusters and tooling, freeing up your team’s time for the developers.

Treat an agent as an additional user of the platform. SUE grants agents access through the platform itself, with their own identity, only the permissions required for the task, and logging of every action. Changes made by an agent go through the same pipeline, scans, and reviews as those made by developers.

We use the tools your teams are already using, whenever possible. Where something is missing, we use GitLab for CI/CD and Argo CD for GitOps, among other tools. Kubernetes usually serves as the foundation, whether on AWS, Azure, Google Cloud, a European cloud, or in your own data center. For developers, the platform looks the same everywhere.

That depends on the number of teams using the platform and the level of platform expertise you have in-house. Building it yourself offers the most flexibility, but requires a dedicated platform team. SUE supports both approaches: we can help your team build its own platform, or provide one— Multistax —that we manage for you. In the workshop, you’ll make that choice based on your roadmap.
Make sure that both the people who use the platform and the people who pay for it are at the table. That includes a few developers from different teams, the platform or operations team, security, and someone with budget authority, such as the CTO or IT manager. Without developers, the roadmap lacks support. Without someone in charge of the budget, it remains nothing more than a wish list.
A platform engineering roadmap outlines the capabilities your Internal Developer Platform will gain, in what order, and why. These include self-service environments, CI/CD templates, secrets management, and observability. Each step has a milestone and a measurable goal. In SUE’s Platform Roadmap Workshop, you’ll create this roadmap in just one week.
Platform Engineering involves building and managing an Internal Developer Platform: a self-service layer that enables development teams to build, test, and deploy on their own, following golden paths and staying within guardrails. Teams save time because they no longer need to submit a ticket to request an environment or pipeline. At Booking.com, the deployment time for SAP environments went from days to less than an hour.

Red Hat

Ansible Automation Platform is the supported enterprise version of Ansible from Red Hat. Version 2.6 added three features: an automation dashboard for time savings and ROI, a self-service automation portal, and the Ansible Lightspeed intelligent assistant. You’ll notice this especially when you want to deploy automation on a large scale and be able to audit it.

With Leapp, you perform an in-place upgrade for each major version—so first from RHEL 8 to 9, and then to 10. For servers with a lot of configuration drift, a fresh installation is often faster, especially if you’re working with Ansible or image mode. SUE migrated the entire CentOS environment to RHEL at Rijk Zwaan. We determine the best approach for each server role.

Start by taking stock of your vCenter environment: What VMs, networks, and dependencies—such as NSX—do you have? Then migrate in waves using the Migration Toolkit for Virtualization, which transfers VMs from vSphere to OpenShift Virtualization. Ansible playbooks validate each wave and keep a rollback ready. Plan ahead, because general support for vSphere 8 ends on 11 October 2027.

OpenShift Virtualization Engine is an edition of OpenShift designed exclusively for virtualization workloads, and it includes the Migration Toolkit for Virtualization. If you want to run containers in addition to VMs, or modernize your applications in the future, choose an edition of OpenShift that supports containers. We’ll help you choose based on your roadmap.

OpenShift Virtualization runs your VMs on the KVM hypervisor within OpenShift, with live migration and, starting with version 4.21, cross-cluster live migration as well. Red Hat is positioned as a Leader in the 2026 Gartner Magic Quadrant for Server Virtualization Platforms. Whether it’s the right fit depends on your workloads and dependencies, such as NSX. We’ll assess that for you in advance.

Software & SaaS (ISV)

Make your application portable using containers, Kubernetes, Infrastructure as Code, and your own key management. That way, you can run the same codebase per customer or per region with a European provider or in an EU region of your current cloud. First, identify which components are currently tied to a single cloud provider—such as managed databases, identity, or messaging—as these will determine the scope of the work involved. Gartner expects spending on sovereign cloud infrastructure in Europe to increase by 83% by 2026. With the Data Sovereignty Assessment, SUE identifies which dependencies are currently blocking EU hosting.

Make your choice based on your product roadmap, not on which team is shouting the loudest. Compare the platforms based on architecture, technical debt, business logic, API maturity, cloud costs, and security. With “ reverse architecting ,” you can see which functionality is unique to a single product’s code and therefore needs to be migrated to the platform you choose to keep. SUE uses the same six pillars for this as in the Technical Due Diligence on the Private Equity page, but after the deal rather than before it.

That’s a business risk: if one of them leaves, your roadmap and support come to a standstill. First, document what’s in the code before you make any changes. Re:App organizes the codebase, dependencies, and business rules into a knowledge graph. New developers can ask questions there in plain language, and the knowledge is no longer confined to just a few people’s heads. Then you can modernize in a targeted way: start with the parts that change most often or that only one person is familiar with.

Yes, as long as you don’t rebuild everything all at once. Take one component at a time from the old code and deploy it as a service with an API alongside the existing product. The old application calls that service until the old part can be phased out. Start with the components you’ll need to tweak anyway as part of your roadmap; that way, each step delivers both modernization and a new feature at the same time. CarWise operates this way with two parallel tracks: the desktop software remains in operation while the new SaaS version grows. Just make sure to determine in advance how much of your development capacity will go toward modernization; otherwise, the roadmap will always take precedence.

SUE, a cloud native solutions partner based in Geldermalsen, has been modernizing mission-critical software since 1997, with over 150 engineers and more than 500 projects. For software companies, we start with Re:App, our proprietary tool for AI-driven reverse architecting. It reveals the business logic embedded in the code and how it’s tied to the interface and database. We then modernize each component individually. CarWise, for example, is migrating a .NET desktop application with millions of lines of C# code to SaaS. With SUE’s help, Colect reduced its AWS costs by 43% and improved performance by 20%.

SUSE

Yes. SUSE is a European company (SUSE S.A.), originally from Nuremberg, Germany, where it still has a major office. For organizations that want to reduce their dependence on non-European suppliers—for example, for reasons of digital sovereignty—this is often a key consideration. Combine this with a European or on-premises infrastructure, and you keep both your software and data within the EU. SUE helps you set up such a sovereign environment.
Yes. With SUSE Multi-Linux Support (formerly SUSE Liberty Linux), you get a single support contract for mixed environments, including RHEL and CentOS systems. This is useful if you’re running multiple distributions or need time to replace CentOS 7, which will no longer receive community updates as of 30 June 2024. Think of it as a stopgap; for outdated systems, migration remains the solution. SUE helps you choose between extended support and migration. The support itself is provided by SUE, which has been managing Linux environments since 1997, with engineers who know RHEL, CentOS, and SUSE inside and out.
Not right away, but do plan for it. SLES 16 has been available since November 2025 and, according to SUSE, will receive 16 years of support. SLES 15 will continue to be supported for a long time (until 2037, according to SUSE), so there’s no rush due to security updates. Key changes in version 16: SELinux is the default instead of AppArmor; a new installer (Agama); Cockpit for remote management instead of YaST; 64-bit timestamp handling, prepared for the Year 2038 problem. These changes will require adjustments to your management and automation processes. Therefore, start by deploying new servers on version 16 and upgrade existing servers in phases. SUE will test and plan the transition together with you.
Rancher Prime is SUSE’s platform for centrally managing multiple Kubernetes clusters on any infrastructure: in the cloud, on-premises, or at the edge. You can manage access, policies, monitoring, and upgrades from a single location. Prime is the commercial version of the open-source Rancher, featuring enterprise support, a fixed lifecycle, and additional security and compliance features. You’ll need it as soon as you have more than a few clusters or are running clusters in different locations. SUE implements and manages Rancher Prime.
In four steps: (1) inventory of VMs, dependencies, storage, and network; (2) a pilot with a group of less critical workloads; (3) migration of VMs in waves, with testing per group; (4) phasing out vSphere once everything has been migrated. A mandatory refactor on day one is not necessary: VMs remain VMs. Modernization to containers can follow afterward, on an application-by-application basis. The turnaround time depends primarily on the number of VMs and interconnections and ranges from a few weeks to several months. SUE carries out the migration and can manage the platform afterward.
For many organizations, yes. SUSE Virtualization is based on the open-source Harvester project and runs virtual machines using KubeVirt on Kubernetes. This allows you to manage VMs and containers on the same platform. It’s a good fit if you want to eliminate VMware licensing costs while transitioning to containers. It’s less suitable if you rely on specific VMware features or third-party integrations; we’ll assess that upfront. In 2026, Gartner named SUSE a “Visionary” in the Magic Quadrant for Server Virtualization Platforms. SUE guides the transition from assessment to management.
Both are open-source alternatives to VMware, each with its own distinct character. Proxmox is an accessible virtualization platform with a large community, excelling in small and medium-sized environments. SUSE Virtualization is built on Kubernetes, is centrally managed with Rancher, and offers enterprise support with a fixed lifecycle from SUSE. If you only want to run VMs on a limited scale, Proxmox is often sufficient. If you want to combine VMs and containers, centrally manage multiple clusters, and have vendor support for business-critical workloads, then SUSE Virtualization is a better fit. SUE can help you make that decision based on your current environment.

Careers

Yes. You’ll receive a study budget, paid study days…, and time to earn certifications. Every Thursday evening is study night. Collectively, our colleagues hold more than 1,150 certifications.

Yes. If you don't see a suitable job opening, please send your resume and tell us what you're looking for using the form on the job listings page. A recruiter will contact you.

You'll take a personality test. If you're applying for a technical role, you'll also take a technical test. We'll discuss the results during the second interview.

The process from application to job offer takes a maximum of two weeks. It consists of five steps: you submit your resume and cover letter, an initial interview, an assessment, a second interview, and the job offer.

Wiz

Wiz continuously assesses your environment against frameworks such as CIS and PCI DSS and identifies who is responsible for resolving each finding. You can use these reports as evidence during an audit or when reporting to your board. Payment service providers Buckaroo and Huisman use SUE in this way. Compliance remains a matter of policy and processes, and we work with you to develop those.

Start by taking inventory of what’s running. Wiz uses AI-BOM to identify which models, agents, and AI tools are running, and uses AI-SPM to check their configuration and permissions. Next, restrict the permissions of agents and set up monitoring for the attack vectors that Wiz identifies.

Not for the basics. Wiz connects agentlessly via your cloud providers’ APIs and scans workloads without installing anything. For runtime detection—such as suspicious behavior in a running container—there’s the optional Wiz Runtime Sensor, which runs on eBPF. We recommend starting with the agentless scan and adding the sensor only to clusters where you need runtime protection.

CSPM (Cloud Security Posture Management) checks the configuration of your cloud accounts for errors and deviations from standards. A CNAPP such as Wiz adds, among other things, workload and container security, identities, IaC scanning, and runtime protection to a single platform. In Q1 2026, Forrester named Wiz a Leader in the Wave for Cloud Native Application Protection Solutions.

Yes. Google completed the acquisition on 11 March 2026, and announced that Wiz will retain its brand and remain available on AWS, Microsoft Azure, Google Cloud, and Oracle Cloud. The European Commission approved the deal in February 2026 without conditions, explicitly addressing the risk that Google might offer Wiz exclusively on its own cloud platform.

Health Care & Hospitals

Yes, but as a healthcare provider, you remain responsible under the Dutch Cybersecurity Act and NEN 7510. Your managed service provider must therefore demonstrably meet the same requirements. Specify in the contract who is responsible for patching and monitoring, how quickly an incident must be reported to you so that you can meet your own reporting obligations, and where your data and the administrators are located.

If the supplier handles personal data, you’ll also need to enter into a data processing agreement. With Managed Services, SUE takes over the management of Linux, Kubernetes, and the cloud, with terms and conditions that you can include in your own audit. For more details on what to include in the contract, see the guide on outsourcing IT management.

A Landing Zone is the solid foundation for your cloud applications: account structure, network, identities, logging, and policies. For a hospital, you define within it which region data may be stored in, ensure that all access is routed through your own identity management system with MFA, and that logging is stored centrally and immutably. Define these rules as Infrastructure as Code. Then, every new application automatically receives the same security, and the evidence for your NEN 7510 audit comes directly from the platform itself. SUE builds Landing Zones for AWS and Microsoft Azure in this way.
Start by conducting an assessment for each application. Is it already running in containers? Does the vendor support Kubernetes? And which integrations with the EPD are critical? Applications with medical certification or strict vendor agreements often remain on virtual machines initially. Next, migrate each application to a single platform where logging, backups, access management, and network segmentation are configured according to NEN 7510 from the start. That way, you won’t have to set these up again for each application. SUE builds such Kubernetes platforms—both on-premises and in the cloud—and manages them with Managed Kubernetes.
Yes, there is no legal ban. However, you must comply with the GDPR, NEN 7510, and the duty of care under the Cybersecurity Act, and you must manage the risks associated with your cloud provider: in which region is the data stored, who has access to it, and which jurisdiction governs the provider. Many hospitals deliberately choose to host their systems in the Netherlands; in 2025, Bernhoven opted for a Dutch healthcare cloud for its EHR. Using a Data Sovereignty Assessment, SUE determines for each application which data may be stored where.

If you have a NEN 7510 certificate, you must transition to NEN 7510:2024 by 20 February 2027. After that date, certificates based on the old standard will expire. The new version follows the structure of ISO 27001 and 27002 from 2022, with new and restructured controls, including those for cloud services and suppliers.

Since 15 August 2026, the healthcare sector has also been subject to the Dutch Cybersecurity Act. This Act imposes a duty of care on the boards of medium-sized and large healthcare providers. NEN 7510:2024 is the most logical way for the healthcare sector to demonstrably fulfill this duty of care.

SUE Cloud Native Solutions
Privacy overview
This website uses cookies. We use cookies to ensure that our website and services function properly, to gain insight into the use of our website, and to improve our products and marketing. For more information, please read our privacy and cookie policy.