It’s team- and manager-dependent. I’ve seen good and bad security in cloud and on-prem. The key is management recognizes and budgets for the fat tail risk, just like the fat tail risk of financial fraud is treated by the finance teams. Much of the response is proforma, and only intended to secure from drive-by opportunistic raids, and insider attacks are still difficult to defend against, for example, so no silver bullets in this story.

Is that always true?

If you're doing heavy R&D and you keep things on isolated networks, might not your R&D be at least similarly secure on-premises, if you follow secure practices?

How much visibility do you have into your cloud provider's security? For email, sure go with a known cloud provider. Some SaaS services on the back-end can be less than ideally secure.

Security is easier in the cloud. It comes with good access management, audit trails, inventory of active resources and it enforces a lot of good practices.

All companies who don't have cloud tools have to re invent everything, it's hard and a lot of effort so the result is always terrible. Poor UI, poor security, full of bugs, pick any three.

AWS is better for isolated networks, it can manage strict network access rules way beyond anything iptables can achieve. In fact, cloud is the only way to have well isolated networks, unless we're talking about a computer unplugged from any network.

There are many stories of AWS users setting their access rules improperly because they weren't given sufficient time or resources to understand how to use them, in some cases leaving S3 containers for example wide open. It isn't just the technology, it's the incentives, people and processes as well.