Chris Hughes: IaaS and SaaS have different zero trust and shared responsibility model. A SaaS doesn’t comntrol the operationg system, yet at the same time you can get one tool, like SSO that spreads too far in SaaS.

Perry: Security is about what you can influence. With SaaS and IaaS you give up control and infliuence, you need to compensate with architecture.