That's the SaaS sales mantra repeated. It may or may not be true no matter how appealing the argument is. Ultimately, your weakest point ends up being humans w

That's the SaaS sales mantra repeated. It may or may not be true no matter how appealing the argument is. Ultimately, your weakest point ends up being humans who are prone to mistakes. You can mitigate some of those mistakes with technology but you can't mitigate all of them. So SaaS may help shore up certain attack vectors but it may increase focus on the remaining vectors and may potentially make failure points more significant (more impact for a security breach from a large provider vs less impact of a security breach from systems of independent providers). Some of that can be mitigated with smart designs, but you lose some advantage of traditional "security through obscurity" which has some value (though it shouldn't be relied on as a failsafe).