Moving to the cloud feels like handing off a huge chunk of risk to somebody else. A major provider runs the data centers, so surely they are the ones keeping your business safe. That assumption is exactly where most cloud security gaps start.
Fortinet’s 2026 State of Cloud Security Report, based on a survey of over 1,100 cybersecurity leaders worldwide, found that nearly 70% of organizations name tool sprawl and unclear visibility as their biggest obstacle to effective cloud security.
A lot of that confusion traces back to one simple question nobody answered clearly enough: who is actually responsible for what in the cloud? This guide answers that question in plain language.
What Is the Cloud Shared Responsibility Model?
The cloud shared responsibility model explains the division of security responsibilities between the cloud provider and the customer. Both play important roles here, and neither side is entirely responsible for securing the entire cloud environment on its own.
A common misunderstanding is that the cloud provider handles the entire security part because they own and manage the underlying infrastructure. In reality, that isn’t the case. Major providers such as AWS, Microsoft Azure, and Google Cloud clearly define what they’re responsible for securing and what they’re not for.
Security of the Cloud
This is the provider’s half. It covers protecting the physical infrastructure, hardware, and global network that the entire cloud platform runs on.
Security in the Cloud
This is the customer’s half. It covers everything you build, store, configure, and control once you are using that infrastructure, including your data, your users, and your settings.
Every question about cloud security ultimately comes back to which side of that line a given issue falls on.
What Is the Cloud Provider Responsible For?
Cloud providers are responsible for securing the infrastructure that runs their cloud services. This is often referred to as “security of the cloud.” Their responsibilities generally include:
- Physical data centers: Securing buildings, servers, power, cooling, and physical access.
- Underlying infrastructure: Protecting physical servers, storage systems, and networking equipment.
- Virtualization layer: Securing the systems that allow multiple customers to safely use shared infrastructure.
- Core cloud services: Maintaining the security, availability, and resilience of the underlying cloud platform.
- Infrastructure maintenance: Applying necessary patches and updates to provider-managed systems.
The exact scope varies by cloud service, but the basic principle remains the same: the provider secures the cloud infrastructure, while customers remain responsible for how they use it.
What Is the Customer Responsible For?
Customers are responsible for securing what they put into and how they use the cloud environment. This is often called “security in the cloud.” Depending on the service, customer responsibilities typically include:
- Data: Protecting the business and customer information stored in the cloud.
- User access: Managing accounts, passwords, permissions, and authentication methods such as MFA.
- Applications: Securing applications and workloads the business deploys or manages.
- Configurations: Setting cloud resources, security controls, and access permissions correctly.
- Operating systems: Applying updates and security patches when the customer manages the OS.
- Backups and recovery: Ensuring critical data and systems can be recovered when required.
The exact responsibilities vary by cloud service, but using a cloud provider does not transfer all security responsibility to the provider.
How Responsibility Changes Across Cloud Service Models
The boundary is not identical across every cloud environment. The more a provider manages on your behalf, the more your side of the split narrows, though it never disappears completely.
| Cloud Model | Provider Mainly Manages | Customer Mainly Manages |
|---|---|---|
| IaaS (Infrastructure as a Service) | Physical hardware, network, virtualization, storage | Operating system, applications, data, identity, firewall rules |
| PaaS (Platform as a Service) | Infrastructure plus the operating system and runtime | Applications, data, identity, and access configuration |
| SaaS (Software as a Service) | Infrastructure, operating system, and the application itself | User access, the data you put into the app, and configuration settings |
The key takeaway is that even with SaaS, where the provider manages nearly everything technical, you still own your data and who has access to it. That distinction is important because customer-controlled data, identities, permissions, and configurations can still introduce security risks even when the underlying cloud infrastructure is managed by the provider.
The right cloud setup depends on what your business needs to manage and what you want the provider to handle. For businesses evaluating their options, our cloud services provider offers the infrastructure, applications, and support needed to run day-to-day operations without managing every underlying technology yourself.
What Happens When Cloud Responsibilities Are Misunderstood?
This is why the model actually matters to a business, beyond being a theoretical split written into a contract.
- Sensitive data gets exposed through a storage container or database setting nobody realized was the customer’s job to secure
- Incident response stalls because two teams both assume the other side is monitoring for suspicious activity
- Compliance audits fail when a business cannot prove who owns backup, encryption, or access decisions
- Budget disputes follow a breach, since fixing customer-side misconfigurations is not covered under any provider’s infrastructure guarantee
- Security investments get misdirected toward provider-level concerns while the actual gap sits in configuration and identity management
These outcomes can often stem from misunderstanding which responsibilities belong to the provider and which remain with the customer.
If you want to see how these responsibilities can become security risks in practice, our guide on cloud misconfiguration explains how configuration errors can contribute to cloud data exposures.
Conclusion
Cloud security is a partnership, not a complete handoff. Providers secure the platform underneath your environment. You secure your data, your users, and how everything is configured on top of it.
Understanding exactly where that boundary sits, and confirming your team has actually covered its half, is essential before assuming any cloud environment is secure simply because it is hosted by a major provider.
Need Help Managing Your Cloud Environment?
Managing cloud responsibilities can become complicated as your environment grows. PennComp can help businesses evaluate, manage, and secure their cloud infrastructure based on their specific needs.
Talk with our Houston cloud services team to discuss your environment and goals.
Frequently Asked Questions
1. Does the shared responsibility model work the same way across AWS, Azure, and Google Cloud?
The underlying principle is the same across all major providers: they secure the infrastructure, and you secure your data, identities, and configurations. The specific documentation and terminology differ slightly, so it is worth reviewing each provider’s own shared responsibility page for the exact wording that applies to your account.
2. If a cloud provider has an outage, is that a shared responsibility issue?
If an outage is caused by the provider’s infrastructure, maintaining that infrastructure is the provider’s responsibility. The customer is still responsible for having business continuity and recovery plans that account for potential provider downtime.
3. Do small businesses using mostly SaaS applications still need to worry about this model?
Yes, although the customer’s share of the responsibility is generally smaller. Even with SaaS, businesses typically remain responsible for areas such as user access, permissions, and the data they place in the application.
4. Where can a business actually find its cloud provider's shared responsibility documentation?
Every major provider publishes this information publicly, usually under a security or compliance section of their website, and it is worth reviewing the specific version for each cloud service.
5. Does the responsibility split ever shift if a business adds managed services on top of a cloud platform?
Yes. A managed service can shift specific operational tasks, such as patching or monitoring, to another provider. However, the exact division of responsibilities should be defined in the service agreement, while the business typically retains responsibility for decisions about its data, users, and security requirements.
