Cloud services are not secure... do not believe them to be secure, treat them as the screen door in front of your house. Anyone can open it, and they will use that to knock on your inner door to get into your systems.
The fact that companies want to trade insecurity for a known cost (which isnt, as they always go up in cost), over a KNOWN 3-5 year single purchase, is amazing to me.
Accountants can assume a hardware cost based on policies of the company, this isnt the excuse hill they should die on and investors need to be smarter on this front.
Especially when the cloud services cost 3x that of in house in a single year vs the 3-5 year hardware refresh standard they may set.