Cloud adoption among South African SMEs has accelerated dramatically. Microsoft 365, cloud-hosted ERP systems, offsite backup solutions, hosted telephony most businesses today operate with a significant portion of their IT infrastructure outside of their own four walls. And load-shedding has only accelerated the trend, pushing businesses toward cloud-delivered services that remain available during power disruptions.
This is, broadly, a good development. Cloud infrastructure, when properly configured, offers resilience, scalability, and access to enterprise-grade capabilities that SMEs could never afford to build in-house.
But there is a misconception that is costing South African businesses dearly: the belief that moving to the cloud transfers security responsibility to the cloud provider.
It does not.
The Shared Responsibility Model What Your Cloud Provider Actually Covers
Every major cloud provider Microsoft Azure, AWS, Google Cloud operates on what is called the shared responsibility model. The provider is responsible for the security of the cloud: the physical infrastructure, the underlying hypervisor, the availability of the platform. You the business are responsible for security in the cloud: your data, your user accounts, your configurations, your access controls.
In practical terms, this means that Microsoft is responsible for ensuring Azure doesn’t go down. You are responsible for ensuring that your Microsoft 365 environment isn’t compromised through a weak admin password, a misconfigured sharing permission, or an unreviewed third-party application with excessive privileges.
Most cloud breaches are not the result of the cloud provider being hacked. They are the result of customer misconfigurations, stolen credentials, or inadequate access controls on the customer’s side. The attack surface has shifted it hasn’t disappeared.
Zero Trust: The Right Security Model for a Cloud-First World
Traditional network security was built on a perimeter model: trust everything inside the network, distrust everything outside. In a world where your staff access business systems from home, from coffee shops, from mobile devices and where your data lives in data centers you don’t own the perimeter has dissolved. The old model no longer works.
Zero Trust is the security architecture designed for this reality. Its core principle is simple: never trust, always verify. Every user, every device, and every access request is authenticated and authorised, regardless of whether it originates inside or outside the corporate network.
In practice, implementing Zero Trust means:
Multi-factor authentication (MFA) on everything. Passwords alone are no longer adequate. MFA requiring a second verification step beyond the password dramatically reduces the risk of account compromise even when credentials are stolen. This single control prevents the majority of cloud account takeover attacks.
Conditional access policies. Access to business systems should be granted based on context: who is the user, what device are they using, where are they accessing from, what are they trying to do? Anomalous access a staff member logging in from an unfamiliar country at 3am should trigger additional verification or be blocked automatically.
Principle of least privilege. Users and systems should have access only to the resources they need for their specific role. Admin privileges should be tightly controlled, time-limited where possible, and subject to additional authentication requirements.
Regular access reviews. Former employees with active accounts, third-party applications with excessive permissions, service accounts with stale credentials these are the vulnerabilities that attackers actively seek. Regular access reviews identify and remediate them before they can be exploited.
Load-Shedding, Cloud, and the Resilience Argument
South Africa’s energy environment has made cloud adoption a resilience imperative as much as a technology choice. Cloud-delivered services are available during load-shedding. Staff can continue working from home or on mobile devices when the office has no power. Backups stored off-site survive a physical incident at your premises.
But resilience requires proper architecture. Cloud services that are not correctly configured for failover don’t provide the uptime you need. Backups that aren’t regularly tested don’t recover when you need them. And cloud environments accessed without proper security controls create attack vectors that persist whether the power is on or off.
Choosing the Right IT Partner for a Cloud-First Environment
One of the most consequential decisions a business makes is selecting an IT managed service provider and the evaluation criteria are more complex than they used to be. The gap between what providers claim and what they deliver in terms of cloud security capability is wide.
When evaluating a managed IT partner, look beyond response times and pricing. Ask specifically: how do you secure our Microsoft 365 or cloud environment? What is your approach to identity and access management? How do you monitor for threats in cloud workloads? What does your incident response process look like for a cloud compromise?
At RubiBlue, our approach to cloud security is grounded in Zero Trust principles and continuous monitoring. We configure and harden cloud environments, implement MFA and conditional access, conduct regular vulnerability assessments, and provide ongoing monitoring through our managed security practice. We also understand the specific constraints of the South African environment bandwidth variability, load-shedding, and the local regulatory landscape under POPIA.
Moving to the cloud is a smart decision for most SMEs. Moving to the cloud without the right security architecture is an expensive mistake.
RubiBlue provides managed IT, cloud security, and network management services for businesses with up to 250 devices across Johannesburg, Midrand, Centurion, and Pretoria. Speak to our team about securing your cloud environment.
