Equifax goes all in on the public cloud

Ask almost any CIO whether they would re-platform their business in the cloud, given the budget, time and technical resources, and the answer would unequivocally be yes. But standardizing on a cloud platform during a global pandemic adds an unexpected wrinkle to the culture change required for building a new technical foundation for the business.

That was one of the many hurdles confronting Equifax CTO Bryson Koehler in March when the consumer reporting agency ordered its employees to work remotely amid the coronavirus outbreak. Even so, employees exhibited excellent productivity in facilitating the company’s digital transformation while working from home, Koehler recalls.

For instance, Equifax engineers have delivered more story points — a metric used in agile software development to estimate the difficulty of implementing a digital experience for users — while working around family disruptions that often bog down deliverables.

“We’re seeing a higher software capitalization rate,” Koehler says. “The COVID-19 outbreak has helped us maintain, if not improve our focus and productivity.”

In hindsight, it’s fair to say that Koehler’s challenges have been a cut above those of his peers since he joined Equifax in 2018, less than a year after a devastating data breach. Equifax spent hundreds of millions of dollars bolstering cybersecurity after the breach and lured CISO Jamil Farshchi from Home Depot. In accepting a daunting job many would shy away from, Koehler was gifted a $1.2 billion budget to modernize aging technology and restore the public’s trust.

The greenfield advantage

Koehler elected to take a novel approach to rearchitecting Equifax’s technical stack, which ingests and churns through massive amounts of data from disparate sources to determine credit scores for mortgage and other loans.

Like most IT leaders, Koehler bet big on agile processes, building applications with microservices and shipping software via orchestrated containers running in the cloud. But unlike many of his peers who prefer a hybrid approach, Koehler is rebuilding Equifax’s tech stack entirely on public cloud services.

Koehler is moving Equifax’s apps, analytics, decisioning, machine learning engines and other tools that comprise a data fabric into Google Cloud Platform (GCP), where software is provisioned as infrastructure-as-code and applications are deployed in continuous integration/continuous delivery (CI/CD) pipelines. Software updates, including application upgrades, tuning and patches, are fully automated. In a nod to the current multi-cloud trend, Equifax runs some workloads in Amazon Web Services and Microsoft Azure. For instance, the data layer integrates with a network fabric hosted by GCP and Amazon Web Services (AWS) to facilitate better uptime and resiliency.

Equifax product teams are now much more closely aligned with engineering, consistent with the current trend toward scaled agile and DevOps practices. “The beauty of agile is that you can adopt and adapt according to mission; we’ve just made it a total approach — everyone has to do it,” Koehler says.

Koehler says the cloud-native approach enables Equifax to eschew many of the scenarios with which practitioners of hybrid cloud models are now familiar. Rather than migrate legacy apps, a practice known colloquially as “lift and shift,” or refactor them to run in the cloud, which courts its own unique risks, Koehler is foregoing most of the “legacy baggage” associated with on-premises operations — albeit with select exceptions that will be retrofitted as cloud-native apps later.

Koehler says that migrating legacy systems over time, which often results in incomplete hybrid implementations, thus adding more complexity and boosting operating costs, puts enterprises in a “worse place” than where they were running on-premises. In fact, any Equifax engineer who insists on running apps locally must make a compelling argument to do so. But Koehler says he makes it difficult for engineers to deviate from the cloud strategy.

Security plays a big role in the public cloud’s value proposition, Koehler says.. “The cloud sets you up for more secure services than anything on-prem can offer,” he adds.

Cybersecurity, business agility and a quicker path to innovation are among the reasons why confidence in the cloud is so high. This has proved particularly true during the pandemic, as many organizations are bound by social distance constraints. Forty-two percent of IT leaders said their investment in cloud would increase during the pandemic, according to a survey of 373 CIOs polled for IDG’s CIO.com COVID-19 B2B study released earlier this month.

Yet Equifax’s cloud-native posture makes it an outlier, according to experts. Many enterprises would love to stand up cloud-native environments to modernize their applications, but “few have the time and money to do so, or the effort doesn’t outweigh the cost,” says Gartner analyst Raj Bala. Rather, many organizations package legacy software in containers or wrap Java and other apps in platform-as-a-service services from AWS or Microsoft to give them a “little bit of modernization.”

Shifting business dynamics

Koehler is confident that Equifax’s public cloud environment will better position the agency to serve customers who have come to expect seamless digital environments as they seek approval to make purchases. A proliferation of financial activity is driving massive load on Equifax systems.

The pandemic has throttled many sectors in the economy, particularly travel and hospitality, which are undergoing seismic shifts in employment. This has forced Equifax to adjust its risk scoring to account for the explosion in transactions, including people buying new homes, asking for forbearances on mortgages and refinancing existing mortgage agreements.

Equifax must also address the challenge associated with creating “highly confident risk models to operate and improve in a radically different world,” Koehler says. The company is leveraging ML-based analytics to help make sound, equitable decisions.

As Equifax refines its scoring models, Koehler continues to unwind the company’s legacy environments, which he continued to operate as his teams raced to rearchitect on GCP and AWS. The company will decommission about a dozen data centers of various sizes — a significant chunk of its overall footprint — around the world by year’s end.  “Significant validation needs to occur to migrate complex data sets in a secure and compliant way,” Koehler says. “Our mantra has been, ‘Run what you have well, while you build the new.’”

Meanwhile, Koehler looks forward to the day when most of his teams can return to the Equifax headquarters in Atlanta, which like most enterprises is admitting employees at a reduced capacity in accordance with most corporate coronavirus practices. “There’s an energy that comes from seeing each other in person,” Koehler says.