Paying for PaaS: Calculating TCO

Aug 29, 2012 | App Modernization, Cloud, Fresh Ink

By Chris Haddad, WSO2

When building a cloud, it’s important to consider how to pay for any new technology, environments and tooling. One of the biggest factors affecting total cost of ownership (TCO) for cloud middleware is not simply the choice of the software, but also the model of deployment. The two primary platform-as-a-service (PaaS) deployment models are multi-tenant shared container and a single-container.

Within traditional cloud models, provisioning and deployment operations bind a tenant application to a set number of application servers. Infrastructure sharing and resource pooling do not extend to the middleware platform components, and the application server container instances are dedicated to specific applications. This model is referred to as a single-container PaaS deployment.

More recently, cloud-native models have emerged in which tenant applications simultaneously share a common pool of Java server containers. This approach is known as a multi-tenant shared container PaaS deployment. Here, Java Virtual Machine (JVM) instances use Open Service Gateway Initiative (OSGI) based partitioning, tenant-specific resource context, and on-demand tenant artifact loading to share JVM resources while maintaining quality of service (QoS), performance, and security. The Java server container is dynamically shared across multiple tenant applications, which serves to reduce the software license cost, infrastructure-as-a-service (IaaS) expense, and operational management effort.

With a single-tenant, dedicated container, significantly more TCO is associated with running a PaaS environment compared with a multi-tenant, shared application container PaaS.

Calculating TCO

To determine the expected TCO, the equation should consider the expected number of tenants, known tenant load (e.g. Web requests, transactions, memory, CPU, and latency), and the mapping between tenant load and server capacity. Cost analysis variables that can affect the calculation include the vendor-specific license expense, maintenance expense, subscription investment amounts, and IaaS compute node cost.

The environment sizing and cost analysis variables are used to derive the following variable values:

▪   Required number of application platform service JVMs

▪   Tenant density per JVM

▪   JVM density per IaaS node

When determining the required count of JVM instances to deliver application platform services, the analysis should consider redundancy, failover, and service performance. The JVM count will typically vary based on the type of hosted application platform service, throughput, and expected load. For example, an identity management service can often accommodate a greater number of tenants compared to an enterprise service bus service.

Tenant density per JVM will vary based on the vendor product and workload profile. In single-tenant PaaS scenarios, a single tenant is mapped per dedicated JVM or JVM cluster. In a multi-tenant shared container PaaS, tenant isolation, partitioning strategies, and service performance will influence the tenant density per JVM.

Tenant density significantly impacts the number of IaaS nodes and licensed application platform servers.  For example, a single tenant per JVM could yield a single tenant density of eight tenants per IaaS node.  In a multi-tenant shared JVM scenario, the worksheet specifies a maximum of seven tenants per JVM, which yields forty-two tenants per IaaS node.

The Bottom Line

Let’s look at how the differences between multi-tenant shared container and a single-container deployments play out in both large-scale and small-scale cloud deployments.

In large-scale, single application platform service deployments (i.e. 100 tenants and 10 services), a multi-tenant shared container PaaS is 1,300% more efficient than a single-container deployment when measuring the number of JVM instances. A positive financial TCO is achieved after just 21 tenants subscribe to the environment. After all 100 tenants have subscribed, the multi-tenant shared container PaaS is 475% more cost-efficient than single-container deployments.

In small-scale, single application platform service deployments (i.e. eight tenants and one service), a multi-tenant shared container PaaS is 220% more efficient than a single-container deployment when measuring the number of JVM instances. A positive financial TCO is achieved after five tenants subscribe to the environment. After all eight tenants have subscribed, the multi-tenant shared container PaaS is 166% more cost-efficient than single-container deployments.

Conduct Your Own TCO

We’ve all seen the warnings, “Don’t try this at home.” However, in this case, I strongly encourage IT professionals to conduct a cloud TCO analysis for their own organizations.

I recently published a PaaS cost evaluation white paper, which provides an architecture decision framework, including the complete TCO methodology and sample scenarios. The white paper compares the total cost of ownership of a multi-tenant, shared application container PaaS versus a single-tenant dedicated container PaaS across multiple tenant counts and application platform service combinations.

With this framework in hand, IT professionals have a simple cost-analysis tool for determining the cloud deployment model that best meets their needs.

# # #

Chris HaddadChris Haddad, WSO2 vice president of technology evangelism, works closely with developers, architects, and C-level executives to increase WSO2 technology adoption, improve the middleware platform, and maximize customer value. He has been charting a vision toward “Cloud 2020,” both in his current role and as a former research vice president at the Burton Group and Gartner. In his previous analyst roles, Chris also led research teams in advising Fortune 500 enterprise organizations and technology infrastructure vendors on adoption strategies, architecture, product selection, governance, and organizational alignment.

Top 10 Cybersecurity Stories This Week: PHP2Shell Threatens 5.1 Million Internet-Exposed PHP Servers With Unauthenticated RCE, Eight eMudhra CA Private Keys Cracked From Public Certificates, CISA and FBI Warn SafePay Ransomware Has Hit 600+ Critical Infrastructure Organizations

Top 10 Cybersecurity Stories This Week: PHP2Shell Threatens 5.1 Million Internet-Exposed PHP Servers With Unauthenticated RCE, Eight eMudhra CA Private Keys Cracked From Public Certificates, CISA and FBI Warn SafePay Ransomware Has Hit 600+ Critical Infrastructure Organizations

October 23, 2026 | ITBriefcase.net Why it matters: Tuesday, October 21 delivered one of the heaviest single-day security disclosures of the year: PHP2Shell, GitLab CVE-2026-110264, and Node.js security releases all shipped simultaneously, each carrying unauthenticated...

read more
Top 10 Cybersecurity Stories This Week: Microsoft’s Largest Patch Tuesday Ever Tops 1,411 CVEs With Live Windows Shell Zero-Day, GhostAction GitHub Supply Chain Wave Hits 500+ Accounts and Tens of Thousands of Repositories, Ransomware Smashes Monthly Record at 1,073 Victims in August

Top 10 Cybersecurity Stories This Week: Microsoft’s Largest Patch Tuesday Ever Tops 1,411 CVEs With Live Windows Shell Zero-Day, GhostAction GitHub Supply Chain Wave Hits 500+ Accounts and Tens of Thousands of Repositories, Ransomware Smashes Monthly Record at 1,073 Victims in August

October 16, 2026 | ITBriefcase.net Why it matters: Microsoft's October 2026 Patch Tuesday is the largest software security release in the company's history — 1,411 flaws, three zero-days, 75 critical vulnerabilities, and a live Windows Shell security feature bypass...

read more
Top 10 Cybersecurity Stories This Week: FBI Warns FortiBleed Is Locking Admins Out of Their Own Firewalls, Attackers Hijack Three Country-Code Domain Registries to Obtain 12 Google HTTPS Certificates, ShinyHunters Suspect Arrested in Jordan

Top 10 Cybersecurity Stories This Week: FBI Warns FortiBleed Is Locking Admins Out of Their Own Firewalls, Attackers Hijack Three Country-Code Domain Registries to Obtain 12 Google HTTPS Certificates, ShinyHunters Suspect Arrested in Jordan

October 9, 2026 | ITBriefcase.net Why it matters: The FBI and US Secret Service issued a joint advisory on October 6 confirming that the FortiBleed credential-harvesting campaign — which has compromised credentials for 86,644 Fortinet FortiGate firewalls and SSL VPN...

read more
Top 10 Cybersecurity Stories This Week: Citrix NetScaler Dual Zero-Days Under State-Sponsored Attack, Pentagon DMDC Breach Exposes 3 Million Military Personnel Records for Nine Months, AI Agent Breaches Dutch Vulnerability Disclosure Organization Using Zammad Zero-Days

Top 10 Cybersecurity Stories This Week: Citrix NetScaler Dual Zero-Days Under State-Sponsored Attack, Pentagon DMDC Breach Exposes 3 Million Military Personnel Records for Nine Months, AI Agent Breaches Dutch Vulnerability Disclosure Organization Using Zammad Zero-Days

October 2, 2026 | ITBriefcase.net Why it matters: Citrix disclosed two critical remote code execution zero-days in NetScaler ADC and NetScaler Gateway on September 27 — CVE-2026-88771 (CVSS 9.5, unauthenticated RCE in default configuration, no special setup required)...

read more
Top 10 Cybersecurity Stories This Week: Brevo Supply Chain Attack Serves Malware to 100,000+ Websites via Stolen CDN API Key, Revolut Discloses Breach via Fake Government Requests, Gyazo 23.6 Million User Records Stolen

Top 10 Cybersecurity Stories This Week: Brevo Supply Chain Attack Serves Malware to 100,000+ Websites via Stolen CDN API Key, Revolut Discloses Breach via Fake Government Requests, Gyazo 23.6 Million User Records Stolen

September 25, 2026 | ITBriefcase.net Why it matters: Attackers compromised Brevo — the email marketing and CRM platform used by eBay, Louis Vuitton, Michelin, Amnesty International, and more than 100,000 other businesses — by exploiting a hardcoded, long-lived...

read more