Many larger corporations have strict rules on keeping things like their source code in-house, so that means no external services for code reviews or CI, etc.

> current corporate dogma is to not host anything

Do you mean that they prefer using managed services? Or do you mean that the services managed by their internal IT utlize AWS/etc for servers as opposed to on premises.

They prefer to use managed services through third parties. Even to their detriment as those third parties basically own their customer lists. If for instance the auth provider goes out of businesses the business would end. Same with code, most new companies are using something like gitlab or github. But it's not as dangerous as many people will have a copy of the source code cloned.

The former. It’s pretty insane.

Like you are able to launch Adobe Photoshop because Okta says so. :)