Cloud services: FaaS, SaaS, PaaS, IaaS

Cloud services: FaaS, SaaS, PaaS, IaaS

Cloud computing has radically transformed the way organizations consume technology. What once required the purchase, installation, and maintenance of physical servers has now become a service that is rented by the minute, scales automatically, and is paid for only what is used. Behind this transformation are four fundamental models —SaaS, PaaS, IaaS, and FaaS— that represent different levels of abstraction and control. Understanding what makes software a service, how these models differ, and what their risks and future are is essential for any technology professional in 2026.

1. What makes software a service?

The classic definition of cloud computing, established by NIST in 2011, identifies five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service (NIST, 2011). Software becomes a service when it meets these characteristics and, in addition, transfers responsibility for infrastructure, maintenance, and updates to the provider.

The pizza metaphor, widely used in the industry, illustrates the differences well. IaaS is like buying the ingredients and baking the pizza at home: you have total control, but also all the responsibility. PaaS is like ordering a take-and-bake pizza and baking it in an oven that someone else maintains: you handle the preparation, but not the infrastructure. SaaS is like going to a restaurant and eating the pizza already made: you just consume it. FaaS is like ordering a single slice every time you are hungry: you pay only for what you eat at the exact moment (TechTarget, 2022).

2. The four service models

2.1. IaaS (Infrastructure as a Service)

IaaS provides access to virtualized computing resources —servers, storage, networks, and operating systems— over the internet. The user rents the infrastructure and has control over the operating system, middleware, runtime, and applications, but not over the physical hardware (Google Cloud, 2026).

The first successful software: Amazon Elastic Compute Cloud (EC2), launched in August 2006. EC2 allowed, for the first time, any developer to rent enterprise-scale computing capacity by the hour. Its launch marked the beginning of the modern cloud era (AWS, 2026).

Representative platforms in 2026: AWS EC2, Microsoft Azure Virtual Machines, Google Compute Engine, IBM Cloud, Oracle Cloud Infrastructure, DigitalOcean, and OpenStack (Encore Cloud, 2026).

2.2. PaaS (Platform as a Service)

PaaS provides a complete environment for developing, testing, and deploying applications without managing the underlying infrastructure. The user focuses solely on code and data (Google Cloud, 2026).

The first successful software: Google App Engine, launched in April 2008. Although Zimki (2005) was a precursor, App Engine was the first PaaS platform to achieve mass adoption, allowing developers to run web applications on Google's infrastructure without managing servers (TechTarget, 2022).

Representative platforms in 2026: Google App Engine, Heroku, Microsoft Azure App Service, Red Hat OpenShift, Railway, Render, Fly.io (Encore Cloud, 2026).

2.3. SaaS (Software as a Service)

SaaS delivers complete, ready-to-use applications over the internet. The user only consumes the functionality; the provider manages everything else: infrastructure, platform, maintenance, and updates (Google Cloud, 2026).

The first successful software: Salesforce.com, launched in 1999. Salesforce pioneered the subscription model for web-based CRM, proving that companies were willing to rent software instead of buying and installing it (ACM, 2009).

Representative platforms in 2026: Salesforce, Microsoft 365, Google Workspace, Slack, Zoom, Dropbox, Notion (Atal Networks, 2026).

2.4. FaaS (Function as a Service)

FaaS is a serverless computing model where the developer writes individual functions that run in response to events. The provider manages all infrastructure and scales automatically, even down to zero when there are no events (Google Cloud, 2026).

The first successful software: AWS Lambda, launched in November 2014. Although hook.io was a precursor, Lambda was the first FaaS platform to achieve mass commercial adoption, popularizing the "pay-per-execution" model at the millisecond level (Microsoft Learn, 2017).

Representative platforms in 2026: AWS Lambda, Azure Functions, Google Cloud Functions, Cloudflare Workers, Vercel Edge Functions (Encore Cloud, 2026).

3. Diagram: Hierarchy of service models

flowchart TD
    subgraph Layers["Cloud abstraction levels"]
        direction TB
        IaaS["IaaS\nInfrastructure as a Service\n(User manages OS, runtime, apps)"]
        PaaS["PaaS\nPlatform as a Service\n(User manages only apps)"]
        SaaS["SaaS\nSoftware as a Service\n(User only uses the app)"]
        FaaS["FaaS\nFunction as a Service\n(User only writes functions)"]
    end
    
    IaaS --> PaaS
    PaaS --> SaaS
    IaaS --> FaaS
    FaaS --> SaaS
    
    style IaaS fill:#e3f2fd,stroke:#1565c0
    style PaaS fill:#e8f5e9,stroke:#2e7d32
    style SaaS fill:#fff3e0,stroke:#ef6c00
    style FaaS fill:#fce4ec,stroke:#c62828

4. Comparative table of service models

5. Risks of cloud services

The massive adoption of cloud services has introduced risks that organizations must actively manage.

Excessive vendor lock-in. When an organization builds its architecture on a provider's proprietary services, migrating to another becomes costly and complex. The market concentration in a few hyperscalers (AWS, Microsoft Azure, Google Cloud) aggravates this risk. European regulators have warned that dependence on U.S. providers threatens financial stability and digital sovereignty (CEFPro, 2026).

Cascading failures. Cloud infrastructure is fragile. In 2025, AWS and Azure suffered high-profile outages that affected critical services across multiple industries. Forrester predicts that data center upgrades for AI will cause at least two multi-day severe outages in 2026 (Forbes, 2025).

Misunderstood shared responsibility. The shared responsibility model establishes that the provider secures the infrastructure and the customer secures their data and configurations. However, approximately 99% of cloud security failures are the customer's responsibility, usually due to misconfigurations (Revolgy, 2025).

Concentration bias. Dependence on a small number of cloud service providers and third parties creates systemic exposure: the disruption or compromise of a single provider can have cascading effects globally (Mallory, 2026).

6. The future of cloud services

The future of cloud computing in 2026 is marked by three main trends.

Private clouds for AI. At least 15% of enterprises will seek private AI options on private clouds to counter the capture of corporate data by large providers. The cost of AI, data lock-in, and operational risk are driving this migration (Forbes, 2025).

Rise of neoclouds. GPU-specialized providers such as CoreWeave, Lambda, and Nebius are capturing AI demand. Neoclouds are expected to generate $20 billion in revenue in 2026, eroding the dominance of hyperscalers in generative AI (Forbes, 2025).

Migration from single-cloud to multi-cloud strategies. Enterprises are abandoning single-provider strategies once favored for efficiency and cost savings. The complexity and dependencies that hindered recovery from AWS and Azure outages are forcing organizations to deliberately diversify (Cloudflare, 2025).

7. Conclusion

Cloud services have gone from being a technological curiosity to becoming the infrastructure on which the digital economy is built. SaaS, PaaS, IaaS, and FaaS represent different levels of abstraction, each with its own advantages, risks, and use cases. Choosing the right model is not an isolated technical decision but a strategic one that affects an organization's agility, cost, and resilience.

The future points toward greater diversification, with private clouds for AI, specialized neoclouds, and multi-cloud strategies. The cloud is no longer a single destination but a complex ecosystem that requires governance, sovereignty, and resilience.

References

ACM. (2009). The rise, fall, and resurrection of software as a service. Communications of the ACM, 52(5), 23-25. https://cacm.acm.org/opinion/the-rise-fall-and-resurrection-of-software-as-a-service/

Atal Networks. (2026, April 19). Types of cloud computing: Public, private, hybrid & multi-cloud (2026 guide). https://atalnetworks.com

AWS. (2026, July 8). The history of AWS: How Amazon built the cloud. AWS Builder Center. https://builder.aws.com

CEFPro. (2026). Europe tightens grip on financial technology sovereignty. https://connect.cefpro.com

Cloudflare. (2025, December 13). SaaS fading as AI agents take center stage in 2026. https://newsbytes.ph

Encore Cloud. (2026, May 4). IaaS vs PaaS vs BaaS vs FaaS: Cloud service models explained (2026). https://encore.cloud

Forbes. (2025, November 28). The future of cloud: Outages, private AI, and the rise of the neoclouds. https://www.forbes.com

Google Cloud. (2026, August 14). What is Function as a Service (FaaS)? https://cloud.google.com

Mallory. (2026, January 19). 2026 cybersecurity outlook emphasizes AI-driven risk, identity attacks, and operational resilience. https://mallory.ai

Microsoft Learn. (2017, March 19). Azure Functions: Intro to serverless applications in Azure. https://learn.microsoft.com

NIST. (2011). The NIST definition of cloud computing (Special Publication 800-145). National Institute of Standards and Technology. https://csrc.nist.gov

Revolgy. (2025, December 2). Cloud security in 2026 (part 1): From shared responsibility to shared fate. https://www.revolgy.com

TechTarget. (2022, January 31). The state of the PaaS business model and market in 2022. https://www.techtarget.com