I have been looking for a while to find out the number of malicious attacks that have been successful against internal vs externally hosted web and SQL solutions.
When I say internal, I mean the server and resources are provided by the company, possibly with some 3rd party apps, and mostly internally built. When I say external, I mean a SaaS or PaaS such as Amazon, Paypal payments, or Azure Web and SQL. I understand that depending on how it is hosted, you may still be responsible for some security, but let us pretend that we give the responsibility to the vendor as much as possible.
We need some numbers ammunition as to why hosting in the cloud with a proper service/vendor is more secure than trying to run everything internally. We do not want to talk about the pros and cons of anything but security. This could be a company with one or two security and network experts or none. We are not talking about big IT companies with a lot of security resources.
It is entirely true that internal hosting can be more secure, but in general we believe it is not due to the number of experts within the company and the ability to track current vulnerabilities. (i.e. why do most people buy virus scanners vs building their own.)
EDIT: Let's get this more specific. Our current concern is that the data is not sensitive and cannot really be tied to anything of importance. Also, we are stuck trying to sell external hosting to older non-IT folk who will "never go to the cloud", when we believe the local solution is not nearly strong enough. We have tried to argue specific points, but none seem to stick.
Let us take the Azure platform with a website on app services and a database one SQL vs a small IT shop, be it 1-4 total employees with no more than 1 security expert (most likely none). So a comparison of a large hosting company vs a small IT team.
I found this very interesting, I just wish I could see how they were hosted. I also know that any numbers I do find will be skewed by the lack of reporting breaches and ability to track these breaches for small companies. Think data hostage situations. http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
Everyone says it depends, and you are right, but where are the numbers to prove your depends? Whose to say that one truly isn't more secure than the other?