Answering from a customer point of view- sensitive, regulated or simply old fashioned industries will want to avoid using SaaS for sensitive material like credentials. I think that the main challenge I faced, again as a customer, is support and maintenance- your software will run on an endless variety of platforms using different versions of it by people with varying competence levels and you'll need to support all of them