IaaS vs PaaS vs SaaS
Also known as: cloud service models, IaaS PaaS SaaS
IaaS, PaaS, and SaaS describe three levels of cloud services.
Infrastructure as a Service (IaaS) rents virtual servers, storage, and networks, and you manage everything on top. Platform as a Service (PaaS) also handles operating systems and runtimes, so developers just deploy code. Software as a Service (SaaS) delivers finished apps, such as Microsoft 365 or Salesforce, that you simply use. While the labels are handy, many modern services blend them, and your security responsibilities change at each level.
IaaS vs PaaS vs SaaS, explained at three levels
At home
Think of pizza. IaaS is renting a kitchen: the oven is supplied, but you bring ingredients, cook and clean. PaaS is a meal kit: the kitchen and ingredients are ready, and you just assemble. SaaS is ordering delivery: you simply eat. Cloud services work the same way, from renting raw computers to using a finished app such as Gmail, with the provider doing more at each step.
At work
IaaS, PaaS and SaaS are the three main ways to buy cloud services. IaaS rents raw virtual servers and storage that your team manages. PaaS also runs the operating system and runtime, so developers just deploy code. SaaS delivers finished applications, such as Microsoft 365, that staff simply use. Businesses care because each model shifts cost, control and security duties between them and the provider.
At home
The three models differ in how much the provider runs for you. Think of food. IaaS is renting a kitchen: you bring the ingredients, cook and clean. PaaS is a meal kit: the kitchen and prepared ingredients are supplied, and you assemble the dish. SaaS is ordering at a restaurant: you just eat. Gmail, Dropbox and Netflix are SaaS, because you simply use them while the company handles everything underneath.
At work
With IaaS, such as AWS EC2 or Azure Virtual Machines, you manage the operating system, runtime, applications and data on rented virtual hardware. With PaaS, such as Azure App Service, Heroku or Google App Engine, you deploy code and the provider runs the operating system, scaling and patching. With SaaS, such as Microsoft 365, Salesforce or QuickBooks Online, you configure and use a finished application. Serverless functions and managed databases sit between IaaS and PaaS.
At home
With SaaS, your data lives in the provider's system, in their format. Leaving can be hard: some services offer full exports, others only partial ones or formats no other app can read. If the service raises prices, changes terms or shuts down, you need a way out. In my view, check whether you can export your data in a usable format before committing, and do it once as a test so you know it works.
At work
Map shared responsibility for each model. With IaaS you patch operating systems, configure networks and harden hosts. With PaaS you secure application code, dependencies, secrets and configuration. With SaaS you remain responsible for identities, access permissions, sharing settings, data retention and backup, since many SaaS providers do not protect you from accidental or malicious deletion. Use SaaS security posture management to monitor configurations across many applications.
Real-world examples
At home
Lena uses SaaS apps for school, but for a coding class she deployed a website to a PaaS service without managing any servers.
At work
Carlos is IT director at a Montreal manufacturer. He moved email to SaaS, a custom app to PaaS, and a legacy system to IaaS virtual machines.
How it compares
| feature | IaaS | PaaS | SaaS |
|---|---|---|---|
| You manage | OS, apps, data | Apps and data | Data and users |
| Provider manages | Hardware, networking | Hardware, OS, runtime | Everything else |
| Examples | AWS EC2, Azure VMs | Heroku, App Service | Microsoft 365, Salesforce |
| Control | Most | Medium | Least |
Moving from IaaS to SaaS trades control for convenience.
For analysts
For each system in a cloud strategy, I'd document which model fits and who owns security tasks. It prevents gaps where everyone assumes someone else is responsible.
History & origin
Hosted software, through 'application service providers' in the late 1990s, preceded SaaS, which Salesforce popularized from 1999. Amazon's EC2 in 2006 defined IaaS, and Google App Engine in 2008 and Heroku, founded in 2007, popularized PaaS. The US National Institute of Standards and Technology formalized the three models in its 2011 cloud definition. Since then, newer categories such as serverless functions and containers as a service have blurred the boundaries. In my view, the three models are best used as a way to ask 'who manages what?' rather than as strict categories.