TL; DR;
New research reveals IT projects face "infinite" cost risk, unlike other project types. This means extreme overruns are likely, not just rare. To navigate this, don't plan for average outcomes. Instead, build in significant contingencies, prioritize modular architecture, and use short, impact-driven iterations with continuous feedback to mitigate unpredictable failures.
Background
If you lead cloud transformation or hybrid infrastructure modernization projects, you already know they’re complex. But new data reveals they may also be uniquely dangerous. A 2025 study published in Project Management Journal by Flyvbjerg et al. shows that IT projects are the only project type among 23 studied that exhibit infinite and unpredictable cost risk. Yes, even riskier than nuclear waste disposal.
What makes IT so risky? Understanding the type of risk
What sets IT projects apart isn’t just that they sometimes fail - it’s that they fail in ways that are fundamentally unpredictable. According to Flyvbjerg et al, most project types follow a pattern of "thin-tailed" risk: cost and schedule estimates may miss the mark, but usually within a reasonable margin. IT projects, however, behave differently. They follow a "fat-tailed" or even power-law distribution. This means the most extreme failures are not only possible - they are statistically likely over time.
This “infinite risk” is not about poor forecasting or bad luck. It’s structural. Here’s how the type of risk manifests in IT, with examples from real-world scenarios:
- Extreme Outliers Dominate Outcomes: Imagine a cloud migration project where a key dependency - like integrating with a legacy payroll system - fails during final deployment. This one issue can stall operations across finance, trigger compliance penalties, and require custom patchwork that multiplies cost tenfold.
- Low Predictability from Historical Data: Even if similar migrations were done in the past, changing platforms (e.g., from on-prem SAP to Azure-hosted Dynamics) means historical benchmarks are invalid. The learning curve and toolsets change, making forecasting unreliable.
- Lack of Reference Class Forecasting: Many IT programs are treated as "first of their kind," like developing a new data lake from scratch. Even if other clients have done similar things, internal teams often believe, “ours is different,” so cross-project learning isn’t applied.
- Interconnected Complexity: In one case, a seemingly routine data warehouse update at a public-sector agency inadvertently broke downstream analytics pipelines. That, in turn, delayed critical funding decisions by two months and required multiple rollbacks.
What this means for cloud modernization
For those leading digital infrastructure change, such as Innofactor's clients in the Nordics, these findings highlight the importance of:
- Architecture Modularity: Projects like those at the Finnish Defence Forces avoided large overruns by using composable architecture blocks.
- Impact-Driven Governance: At Joab, Innofactor helped unify sales, service, and operational data on Microsoft Dynamics 365—giving the CIO real-time visibility and control across functions. This enables governance by design, where every decision is backed by actionable insight and aligned with strategic goals.
- Tail-Risk Awareness: In cloud transformations, you can't assume that most projects will cluster around the average outcome. Unlike in traditional project types, IT project performance doesn’t follow a bell curve (normal distribution). Instead, there's a high probability of extreme outcomes (both success and failure), especially on the failure side.
“Regression to the tail” means that over time, the likelihood of encountering a very large cost or schedule overrun is not only possible - it’s expected. Forecasting should therefore assume significant deviation, not just minor slippage.
What this looks like in practice:
- Don’t base plans on median cost or time estimates - incorporate realistic worst-case scenarios that reflect historical challenges in similar projects, such as 20–40% overruns.
- Apply contingency budgets and buffers specifically for rare but high-impact risks.
- Prioritize early detection of errors and fast recovery mechanisms.
- Use short, feedback-rich iterations and checkpoints to stay ahead of cascading failures.
By planning for the tail - not the average - you design systems and teams to be resilient, not just efficient.
Practical strategies to mitigate IT risk
- Use Half Double's three core elements:
- Impact: Define success in terms of real business outcomes. Measure value creation every week.
- Flow: Ensure fast progress with high intensity and frequent deliveries. Use visual boards to maintain team focus.
- Leadership: Actively involve key decision-makers throughout the project. Anchor ownership and reduce drift.
- Run simple, recurring value assessments every sprint: Teams should be asking: What business outcome did we move closer to this week? How did our changes impact user experience, operational efficiency, or compliance posture?
Examples of business impact indicators include:
- Reduction in time-to-insight for dashboards
- Improved case handling speed in service desks
- Uptime consistency of new cloud-hosted services
We pair this with throughput tracking (e.g., stories completed, lead time trend) to monitor delivery health. This tight feedback loop lets us course-correct before risks become crises.
- Standardize what you can: Cloud templates, automation, and reusable components reduce bespokeness and enable faster deployment with less risk.
- Plan for the tail, not the average: Break down projects into modular components with independent testability. Shorten feedback loops and make error detection continuous. Shift planning logic from “most likely outcome” to “what happens if this fails?”
Final Thought:
If you're modernizing IT with cloud-first strategies, the real risk isn't cost overrun - it’s failing to account for the type of risk you're facing. Knowing that IT projects regress to the tail should fundamentally reshape how we plan, govern, and deliver these projects.
Want to go deeper? Read the Joab customer story and other Innofactor customer stories
