The Shared Responsibility Model: Who Actually Secures What in the Cloud
Cloud providers secure the cloud. You secure what's in it. The line between the two is where most breaches happen.
Ask any cloud provider “is your platform secure?” and they’ll say yes — and they’re telling the truth. Ask “is my workload secure?” and that answer depends entirely on you.
This split is called the Shared Responsibility Model, and misunderstanding it is one of the most common causes of cloud security incidents.
Security “of” the cloud vs security “in” the cloud
- Security of the cloud — the provider’s job. Physical data center security, the hypervisor, the host operating system, the underlying network infrastructure.
- Security in the cloud — your job. Data encryption, identity and access management, network configuration (security groups, firewalls), operating system patching (on IaaS), and application-level code.
The line moves depending on the service model
The exact split shifts depending on what you’re consuming:
| Service Model | Provider Handles | You Handle |
|---|---|---|
| IaaS (e.g. EC2, Azure VMs) | Physical, hypervisor, network | OS patching, app, data, IAM |
| PaaS (e.g. App Service, Cloud Run) | + OS, runtime | App, data, IAM |
| SaaS (e.g. Microsoft 365) | + Application | Data, user access, IAM |
Notice one row is constant across all three: identity and access management is always your responsibility. No cloud provider can stop you from misconfiguring an IAM policy that exposes an S3 bucket to the public internet.
Where this actually bites teams
The overwhelming majority of cloud breaches are not the provider’s infrastructure getting hacked — it’s misconfiguration on the customer side:
- Publicly exposed storage buckets
- Overly permissive IAM roles (“just give it admin, we’ll fix it later”)
- Unencrypted data at rest
- Security groups open to
0.0.0.0/0on sensitive ports
None of these are the cloud provider’s fault. All of them are squarely in the “security in the cloud” half of the model.
The secret ingredient
Every time you provision something in the cloud, ask: “Which half of this am I responsible for?” If the answer is “identity, data, or configuration” — assume it’s on you, because it almost always is.