So there's a lot on security out there. But running a SaaS, is there a particular vector at risk?

I currently regularly upgrade packages, and servers, run a firewall (UFW), have SSH only server access, and shortly adding Snort as an IPS and run code analysis on each PR.

But rank order where's the risk and where should the focus be?