Cloud security comparison: the parts worth your attention

The useful cloud security comparison runs along arrangements. The parts worth your attention are the six splits below, because the arrangement decides how much of the security work remains yours, and that division stays invisible until something goes wrong.

Six comparisons follow. Each names the products on either side, what changes hands, what stays with you regardless, and the situation that decides it.

What to take away

Hosted software, rented platform, or rented machines

Buying finished software as a subscription leaves you the accounts, the sharing settings, the integrations and the data. The provider runs everything else, and you cannot change most of it even if you want to.

Microsoft 365 Business Premium lists at $22 per user per month on an annual commitment and includes Defender for Business, so email filtering and endpoint antivirus sit on the provider's side. Google Workspace Business Standard lists at $14 per user per month and leaves sharing defaults and Drive content with you.

Renting a platform to run your own application on adds your code and its dependencies to your side of the line. AWS Elastic Beanstalk, Google App Engine and Azure App Service patch the runtime for you, but your libraries and your configuration settings stay yours to keep current.

Renting machines adds the operating system, the patching, the network rules and the backups. AWS EC2, Microsoft Azure Virtual Machines and Google Compute Engine place the guest operating system, the security groups and the backup schedule on your side.

It looks like the most control and is in practice the most work, which is why small businesses that choose it often end up with the least secure result.

What decides it: whether anybody in the business will do the operational work. For most small firms the answer is nobody, and finished software is therefore the safer choice despite offering fewer controls. The line between what the provider owns and what remains yours is set out in cloud security, and the boundary is the whole subject.

Provider tooling or something added

Platform-native controls are already integrated, already paid for, and usually switched off. AWS Security Hub, Microsoft Defender for Cloud and Google Cloud Security Command Center all pull the findings that matter inside their own platform, and each one is a toggle away from use.

Microsoft Defender for Cloud's foundational posture management is free, and Defender for Servers Plan 1 lists at $5 per server per month, Plan 2 at $15. Google Cloud Security Command Center keeps its Standard tier free and bills Premium by resource volume. AWS Security Hub bills per security check and per finding ingested, with a 30-day free trial.

Added products cover several platforms at once and bring a console of their own. Wiz and Orca Security scan AWS, Azure, Google Cloud and Kubernetes without installing agents. Palo Alto Networks Prisma Cloud bundles posture and workload protection under a credit-based license. All three price by quote, with mid-size annual contracts typically in the tens of thousands of dollars.

What decides it: how many platforms you actually run. With one main platform, native tooling configured properly beats an added product left half-configured. With three, the inventory and evidence problem starts to justify something that spans them, and the evaluation questions are in best cloud security software 2027.

Whichever way it goes, the added product becomes a standing integration with broad permissions, which is a new thing to protect rather than a neutral addition.

Shared tenancy or dedicated

Sharing infrastructure with other customers is the ordinary arrangement and it is not the risk most people imagine. AWS, Microsoft Azure and Google Cloud all run multi-tenant hosts by default, and a cross-tenant escape is rare against the hypervisor boundary.

Dedicated arrangements cost more and remove a class of concern that is rarely the one that materializes. AWS Dedicated Hosts and Azure Dedicated Hosts bill per host rather than per instance, which typically runs to several hundred dollars a month for an entry-level host.

What decides it: a contractual or regulatory requirement, which is a question for your own advisers rather than a general one. Absent such a requirement, the money is better spent on the configuration and identity work that actually causes small business incidents.

The National Institute of Standards and Technology's definition of cloud computing is the plain reference for what these deployment terms mean when a proposal uses them loosely.

One provider or several

One provider means one console, one bill, one set of controls to learn, and one blast radius: a single account compromise or a single contractual dispute touches everything. Microsoft pairs Microsoft 365, Azure and Entra ID in one tenant. AWS keeps its own console and IAM model. Google Cloud sits beside Google Workspace.

Several providers give independence and a pile of integration work nobody owns, plus several sets of sharing defaults, several audit logs with different retention, and several administrator accounts. AWS IAM Identity Center and Microsoft Entra ID can federate sign-in across clouds, at the cost of another directory to run and license.

What decides it: whether anybody will maintain the second one. For a business without a dedicated administrator, one provider configured properly usually wins on the only axis that matters, which is whether the configuration happens at all.

Two exceptions are worth carving out regardless. Keep an independent copy of anything you could not recreate, outside the platform holding it, for the reasons in backup and recovery. And think hard before the domain registrar sits behind the same sign-in path as everything else.

Signing in through the platform or through your own identity provider

Separate logins per service are simple to start and impossible to end cleanly: somebody leaves and the accounts they held are discovered over the following year.

A single identity provider in front of everything makes joining and leaving one action, applies one second-factor policy, and produces one place to look at sign-ins.

Microsoft Entra ID P1 lists at $6 per user per month and adds conditional access. Okta's single sign-on tier lists at $2 per user per month, with minimum user counts attached. JumpCloud gives 10 users and 10 devices away free.

It also concentrates everything behind one account, which then deserves the strongest protection in the business.

What decides it: the number of services and the number of people. Past a handful of both, the departure problem alone settles it. The mechanics are in identity and access.

Provider retention or your own copy

Every platform keeps something: deleted items for a while, previous versions for a while, an audit log for a while. All three are convenience features with windows set by the provider, sometimes shortened by your own administrator. Microsoft 365 keeps deleted mailbox items for 14 days by default and deleted SharePoint or OneDrive files for 93 days.

What decides it: nothing. This is not a real fork. Provider retention handles the Tuesday deletion and does not survive a lost tenant, a departing administrator, or a deletion nobody noticed for months.

An independent copy of anything you could not recreate is the answer in every arrangement. Microsoft 365 Backup lists at $0.15 per GB of protected data per month. Veeam Backup for Microsoft 365 typically runs around $4 per user per month on a small annual subscription.

Backblaze B2 charges $6 per terabyte per month, and Wasabi charges $6.99 per terabyte with a one-terabyte minimum.

Its absence is the most common gap in businesses that moved to cloud services and assumed the move settled it.

The comparisons at a glance

What none of them change

Your accounts, your sharing settings, your integrations, and knowing which subscriptions exist. Those four remain yours in every arrangement on this page, and they are where small business incidents actually come from. The United Kingdom National Cyber Security Centre's cloud security collection organizes its guidance around exactly this division and is worth reading before any migration.

Common questions

Is moving to the cloud more secure or less?

Different. It removes work you were doing badly and adds a configuration surface that is easy to leave open. For most small businesses it is a net improvement, and only after the four items above are handled.

Do we need a copy of data held in a service we pay for?

For anything you could not recreate, yes. Providers protect against their own failures, not against your deletion or a departing administrator's.

How do we compare two providers we have not used?

On the division of responsibility, the retention windows, the identity options and the exit terms, all of which are knowable from documentation and a trial. Feature comparisons age badly and these four do not.

What should be decided before signing anything?

How you would get everything out, how long that would take, and what it would cost. An exit that has never been examined is the most expensive thing on the contract, and the general purchasing sequence in security foundations puts it in the same category as any other unmeasured assumption.