What you forget here is these SaaS companies are just that - companies. Sure, you probably are not going to exceed Microsoft’s security controls internally but

What you forget here is these SaaS companies are just that - companies. Sure, you probably are not going to exceed Microsoft’s security controls internally but there are a LOT of SaaS companies with awful security. Cloud Risk Assessments are a joke half the time because the information available/what they will share is usually pretty limited. I have also seen fuckery comparable to exposed XP. Most companies WOULD be better trusting the black box that is the cloud.