Is On-Premises Really Safer? What the Cloud Comparison Reveals About Legacy Weaknesses

I'm Ryuta Hamamoto from TIMEWELL Inc.

When you receive a system proposal, you will sometimes hear it said that on-premises is safer than entrusting your data to the cloud, because it stays under your own control. I understand the instinct. Having something close at hand feels reassuring.

But that claim does not always match what actually happens. A note on scope: this article draws on Japanese statistics and Japan's institutions, including the National Police Agency and IPA, so the figures describe the Japanese situation. The general point, though, applies anywhere. When I lined up the public data, the dividing line turned out to be not where a system is placed but whether it is kept updated. I am not arguing against on-premises as a whole. The aim is to set out a point that sits outside the question of location.

The short version

• Safety depends not on on-premises versus cloud, but on whether responsibility is clear and updates and monitoring continue
• Recent ransomware gets in through missed updates and weak authentication on equipment the victim operates
• The older and less maintained a system is, the more established the attack methods against it
• The cloud lets you hand off physical security and platform updates to the provider, but responsibility for configuration and permissions stays with you

What the National Police Agency's statistics show

According to the 2026 edition of the White Paper on Police, the National Police Agency received reports of 226 ransomware cases in 2025. Of the 92 respondents who answered the survey question on how the attackers got in, 61 (66.3%) said VPN devices were used for the intrusion, and 19 (20.7%) said remote desktop services were used¹.

The agency's analysis is that the large majority appear to have been intrusions that exploited vulnerabilities in equipment used for remote work, or weak authentication passwords¹.

One caveat: these statistics do not split the cases by on-premises and cloud. Still, a VPN device is usually something the user installs and runs. The weak point being exploited is work that remains on the customer's side, namely keeping the entrance device current and keeping passwords strong. The claim that a system is hidden from the outside because it sits inside the company stops holding once you see that these entrances face outward.

IPA's "10 Major Security Threats 2026" also places "attacks that exploit system vulnerabilities" fourth in the organizational category². First is damage from ransomware, and second is attacks on the supply chain and outsourcing partners².

Being old is itself a risk

Software that is out of support receives no patches, so any vulnerability that is found simply stays. In its "Bad Practices" list, the US CISA names the use of unsupported software in systems that support critical infrastructure and says it raises risk to national security, economic security, and public health and safety³.

This is not limited to critical infrastructure. After years of use, the people who designed a system have moved on, and no one can say with confidence which change will bring it down. Updates get put off. Attackers look for exactly those unpatched targets, because they can reuse published techniques as they are.

I think it fits reality better to define "legacy" by update practice than by age. A system becomes legacy when it no longer meets all three of the following.

• The vendor still supports it and patches are being issued
• There are a procedure and a team for applying patches without stopping operations
• You can see in a single inventory what exists and where

Many on-premises environments meet all three. Conversely, a cloud environment that is a lift-and-shift of an old configuration with no update procedure carries the same weakness.

Two risks specific to on-premises

Back to the question of location. Keeping things under your own roof also creates risks that are real.

The first is physical. People being able to get close to a server room or to the equipment is itself an attack route. Access control, equipment removal, theft and disaster preparedness all have to be handled in-house. With the cloud, the physical security of the data center falls within the provider's responsibility, and the AWS shared responsibility model likewise states that AWS handles the physical security of the facilities that run its services⁴.

The second is insiders. In IPA's 2026 list, "information leaks caused by internal wrongdoing" ranks seventh in the organizational category². It fell from fourth the year before, but it remains in the top ten. In an environment you manage yourself, administrators hold strong privileges and the logs are kept by the same people. If the person operating the system can erase the record of what they did, wrongdoing is hard to notice. Without a design that separates privileges and sends operation records to a place administrators cannot reach, the assumption that it is safe because it is internal becomes the weakness.

The cloud has a different weakness

After reading this far, you might conclude that the cloud wins. It does not.

The AWS shared responsibility model splits responsibility in two: AWS is responsible for security of the cloud, and the customer is responsible for security in the cloud. How much falls to the customer depends on which services they choose⁴.

So even if you can leave the physical layer and the updating of the platform software to the provider, the following remain your work:

• Designing who can access which data
• Distinguishing settings that may be made public from those that must not
• Enforcing multi-factor authentication and managing keys and credentials
• Updating the applications you run yourself

Data exposed to the outside by a configuration mistake, or permissions set too broadly, are typical cloud failures. The sturdier the provider, the more the customer's own configuration becomes the last weak point.

Side by side

Aspect	Modern design kept up to date (on-premises or cloud)	Legacy design where updates have stopped
Fixes for vulnerabilities	Issued by the vendor and applied through a set procedure	Not issued, or put off because applying them might stop the system
Entrance devices	Inventoried, with deadlines managed	Hard to say what is where
Authentication	Multi-factor assumed	Old authentication methods remain
Operation records	Kept where administrators cannot reach them	Kept where administrators can delete them
Resilience to change	Automated and reversible	Manual, and nobody wants to touch it

Whether a system is on-premises or in the cloud does not decide which column it belongs to. Either placement can land in the right-hand column, and either can sit in the left.

Seven questions to ask when you receive a proposal

Here are questions the buyer can ask, whether the proposal is for an on-premises or a cloud system. If the answer is vague, that is where the weakness is.

1. How long will the vendor support this? What happens after support ends?
2. Within how many days of publication are vulnerability fixes applied? Is there a track record?
3. Do you keep an inventory of entrance devices (VPN, remote access) and manage update deadlines?
4. Is multi-factor authentication mandatory for everyone, administrators included?
5. Are administrators' operation records kept somewhere the administrators themselves cannot erase them?
6. How are physical entry and the removal of equipment controlled?
7. When an incident occurs, are there a procedure and drills that say who does what within how many hours?

When we are the ones making proposals to customers, we believe we have to be able to answer the same questions.

How we think about it

Our ZEROCK runs in AWS's Japan regions. The division is that we leave the physical layer and platform updates to the provider, and concentrate on application updates, permission design and the management of operation records. TIMEWELL holds ISO/IEC 27001 certification (the registered scope is the planning, development and provision of SaaS products that use AI technology).

That said, using the cloud does not make us safe. We believe the only way to get closer to safe is to keep answering the seven questions above ourselves.

Summary

• Neither "it's on-premises, so it's safe" nor "it's the cloud, so it's safe" describes what actually happens
• In the National Police Agency's 2025 figures, 66.3% of ransomware intrusions came through VPN devices. Updating entrance devices and strengthening authentication remain the customer's job
• On-premises has physical and insider weaknesses, and the cloud has configuration and permissions weaknesses. They are different weaknesses
• The dividing line is not location but whether a system is kept updated or has become stuck as legacy

Start by answering the seven questions for your own setup and see which side it is closer to. If you would like to talk about building criteria for choosing a platform, or designing security training that involves your executives, get in touch. We will listen to your situation and think it through together.

References

The figures in this article are based on official materials from the National Police Agency, IPA, CISA and AWS.

Footnotes

1. 2026 White Paper on Police, Chapter 3: Ensuring the Safety of Cyberspace — National Police Agency (in Japanese) ↩ ↩²

2. Information Security 10 Major Threats 2026 Announced (press release) — Information-technology Promotion Agency, Japan (IPA) — 29 January 2026 (in Japanese) ↩ ↩² ↩³

3. Bad Practices — CISA (Cybersecurity and Infrastructure Security Agency, US) ↩

4. Shared Responsibility Model — Amazon Web Services ↩ ↩²