This is a key issue with using cloud services. Since you do not own the equipment you cannot simply run your own penetration testing without the cloud provider giving consent, and most likely support. Therefore you will likely have to use softer, more qualitative measures.
- Ensure that if you are deploying your own software via a cloud provider to operate as SaaS that you have done every kind of security check you can in house, since you are not likely to get free access to the provider's systems.
- Work with the provider before you sign a contract to ensure that you know what security testing methods either they use or you will be able to use. This would be an indicator of the level of trust and support you will have with them.
- If you do not have a pre-existing agreement through the contract you will need to work directly with the provider. They may offer information from their own vulnerability scans, or some other testing. It is likely they will highly object to you trying to run vulnerability scans yourself since there may be other business' applications or data on the systems you scan.
- Evaluate which of the cloud certifications you believe best shows you the right level of trust. Many of these certs are granted only after independent review, so they do offer some assurance.
The CSA's STAR Registry may help with some level of quantification, but you also should look for others such as, ISO 27000 series, SSAE, and PCI certifications.
Straight forward quantification of security levels is much harder than it sounds, and unfortunately there aren't many options.