This type of answer has managed to talk me out of some amazing roles (and dodge some horrible people).
Apparently the correct answer is "there is a magic formula whereby you dont need to understand anything or do any analysis and it will deliver you sunshine and rainbows"
The talk boiled down to: know your network. Know the traffic on it. Then you have a chance of being secure.
$Corp who sells Worlds Best network intrusion detection firewall will be telling a different story.
One of the biggest benefits besides egress should be people and wages. When I consulted in this space, clients on AWS were gold dust, because they tended to spend far more.
A significant reason is that you tend to be able to drastically simplify when you can pick hardware that fits your workloads rather than what fits your cloud provider, and can forego all the multi-tenancy complications your cloud provider needs to account for.
But a little more info I remember:
It arose under a project suggestion three or four students took me up on, and that was "Long term resilience".
The obvious antecedent being "If Google goes down tomorrow....."
"De-clouding" was in the title. And the conclusions, perhaps predictably, were that hybrid systems were the sweet spot across a range of business types, with no panaceas, or even decent maxima to be found in fully on-prem or total cloud.
The students artifact IIRC was a "matrix" (a graph theoretical model) of the edge-costs for traversing well modular systems into different states - something that could be used to plan a "repatriation"
FWIW the student was African and we had a good laugh at the racist undertones of that language and it's subtle implications about "Empires".
When you can spin up cloud instances, that capability in itself means you can justify loading individual servers closer to 100%. Couple that with managed / leased capacity in data centres rather than "true" on prem, and managed providers often delivering many server models very rapidly, and in most hybrid setups I've worked on, we've ended up using the ability to spin up cloud instances very little, while slowing down the rate of growth of new server capacity overall.
So I agree, they're the sweet spot, but in terms of dollars spent my hunch is that most people deploying them will find their spend dominated by "more fixed" servers, ranging from own/leased servers via managed hosting depending on local power and real estate costs (last placed I ran a physical hosting facility, what finally tipped it towards managed hosting for us was that the price of land grew to a point that empty rack space near us vs. at the managed hosting provider we chose was so much more expensive that the difference paid for our servers).
Know your system, every part. Big cost savings are often made at this stage just discovering a shit-ton of obsolete stuff.
Don't just map the network, map the _function_ of the network. Then look at its logical versus physical topology for anomalies (also a great security exercise).
What you bring back on-prem must be systematically viable.
Factor in on-prem energy costs, they are not trivial.
The biggest overall factor is people and wages. Any significant repatriation project ends up needing to hire back the system administrator you fired a couple of years ago.