Exactly. The reasons to adopt (or not adopt) cloud, like any technology, should revolve around business questions, not technical ones. Of course, technical ones are critical to business success, so you can't ignore them, but they are subservient to the business concerns.

Security is certainly and quite clearly not a reason to use clouds. If they are any reason at all it is to avoid them.

But the others are spot on.

Being able to blame someone else for a security problem is a reason to use the cloud.

Security is complex but many companies find it easier to offload it to managed services and best-practices/reference architectures in the cloud compared to janky internal systems.

Offload what exactly? You mean making the same decisions, but through an opaque badly documented panel? Or you mean paying somebody to keep your OS up to date?

Going into the cloud does not alleviate any security decision. You can't buy security.

> "You can't buy security."

Of course you can. In this case, many of those decisions are already made for you in the cloud.

A simple example would be using RDS for a database service. It's secure by default and only the credentials are an issue, compared to running a database of your own somewhere internally that may be exposed in dozens of ways. Less decisions, less surface area, more documented reference setups to follow, more scanning and analysis tools means better overall security posture with less work.