There are two levels, IaaS and PaaS. For IaaS, I agree that you're responsible for some sysadmining, but you start from a known good point in that bare VM OS i

There are two levels, IaaS and PaaS. For IaaS, I agree that you're responsible for some sysadmining, but you start from a known good point in that bare VM OS images (for CentOS, Ubuntu, Windows, etc) will probably have all the appropriate patches applied and up to date. Of course you're on your own when it comes to spinning up your programs to make sure SQL injection doesn't work, etc etc. PaaS is another thing. In that case, if you're using AppEngine or ElasticBeanstalk or Heroku, you don't have to worry about the base infrastructure or the datastore at all. They should have all the relevant security patches applied at all times, which really cuts down the attack area to just your app, not the web server, datastore, or OS vulnerabilities.