As long as more than a trivial number of people need to access your application from a network that is bigger than one room, your application is at risk. But d

As long as more than a trivial number of people need to access your application from a network that is bigger than one room, your application is at risk. But definitely running in public shared cloud exposes you to certain kinds of attack vectors that are not present in an on-prem deployment. But it also protects you from certain types of attack vectors that your on-prem may not. For example, you can be a co-incidental victim of a mass hack of public cloud. But it would be difficult to target your specific machines in the cloud (assuming your application surface is secure) but it might be easier when you are on-prem (easy to locate, isolate and infiltrate etc).