I've been on a kick mentioning to particular clients to quit managing their own dns, email, blogging platform, file transfer setup, etc. This from observing how poor they are at practicing good defense (e.g. promptly applying security patches) and the maturing of security conscious providers.
My conjecture is for security immature companies it’s better to outsource to the likes of:
http://www.zerigo.com/ for dns
http://www.dropsend.com/ for secure file transfer
http://mediatemple.net/wordpress-webhosting.php for blogging
http://chargify.com/ for accepting payments
...plus many more
I still believe sensitive information is better kept in-house (e.g. source code), then again it depends on the org.'s capabilities. But I also say it’s better to let the other guys server get popped versus you having to block lateral movement of an attacker within your network.
From what I’ve seen recently, many SaaS vendors play better defense (they will die if they have too many security incidents).