I don't know which companies/CISOs you've worked with but in my experience it's the opposite: CISOs tend to be wary of transferring corp data to 3rd-parties, fo

I don't know which companies/CISOs you've worked with but in my experience it's the opposite: CISOs tend to be wary of transferring corp data to 3rd-parties, for both legal/compliance and security reasons. It's generally engineering/IT management that tend to be more wary of self-hosting maintenance.