[kem]

I agree with the "not necessarily" part, but one thing that concerns me is in seeing large, critical institutions, like large hospitals and universities, outsourcing critical infrastructure off-premises.

If you look at operational costs per se, and licensing fees in a scenario like that, you're missing a huge proportion of the most threatening costs. Consider hospitals, for example, and recent problems with ransoming electronic health system data.

What concerns me with SaaS is that the biggest costs are very catastrophic or serious risks (like lock-in dependencies, or hacking due to monocultures--by the way, is that a formal, modeled concept in computer security, like it is in agriculture? The vulnerability of a market to "infection" due to monocultures?) that are maybe high probability over a very long-term period, but very low over a short-term period, and hidden.