Platform as a service (PaaS) is a cloud model where you deploy your own applications onto a provider's platform, using the languages, libraries and tools it supports, without managing the servers, network or operating system underneath. You still own your code, its dependencies, its data and its access settings.
What does the NIST definition say?
NIST SP 800-145 defines three cloud service models. For PaaS, the capability provided to the consumer is to deploy onto the cloud infrastructure applications that the consumer created or acquired, built with programming languages, libraries, services and tools that the provider supports. The consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems or storage. The consumer does control the deployed applications and possibly configuration settings for the application-hosting environment.
Compare the neighbors. In software as a service, the consumer only uses the provider's application. In infrastructure as a service, the consumer provisions processing, storage and networks, and controls operating systems, storage and deployed applications, and possibly limited networking components such as host firewalls. PaaS sits between: more control than SaaS, less to maintain than IaaS.
Who secures what in PaaS?
The provider secures the facilities, hardware, network, host operating system and the platform runtime. You secure everything you put on top:
- Your application code and its logic flaws.
- Third-party libraries your code pulls in.
- Secrets and credentials your app uses.
- Who may deploy, configure and view logs.
- Your data, including what you store and how you protect it.
- Public exposure settings, such as which endpoints are open.
The split is the reason PaaS feels easier and why people sometimes over-trust it. Provider-managed does not mean vulnerability-free for your code. A dependency flaw in your app is yours to fix, even when the platform patches its own operating system without you noticing.
What are the common mistakes?
A constructed example: a startup deploys an API to a PaaS in an afternoon. The platform handles servers, certificates and scaling. A month later, a vulnerability is published in a web framework the API uses. The platform's operating system is patched, but the app's dependency is not, because no one on the team tracks libraries. The exposure is in the part the team controls.
Other typical gaps:
- Environment variables holding database passwords visible to everyone with dashboard access.
- A deployment token stored in a build pipeline with permanent, broad rights.
- Test apps left running with real data and public URLs.
- Logs that include personal data or tokens.
- Relying on platform defaults for access without reading what they are.
How do you evaluate a PaaS provider?
Read the provider's shared responsibility documentation and match it against your own list. Ask which security reports or attestations they publish, how they notify customers of incidents, how tenants are isolated, where data resides and how you export your data if you leave. Check how the platform handles build and runtime patching, and whether you can pin versions. Lock-in is also a risk. A platform that supports only its own proprietary tools is harder to leave.
How to check or apply this
- Write down, for each PaaS you use, what the provider secures and what you do. Use their documentation.
- Generate a software bill of materials for each app and track vulnerabilities in its dependencies.
- Move secrets from plain environment settings to a managed secret store where available.
- Restrict who can deploy and who can read configuration, using named roles.
- Use short-lived deployment credentials in pipelines.
- List public endpoints and confirm each is intended. Delete unused apps.
- Review logs for sensitive data, and set retention.
Quick check
Is PaaS the same as serverless?
They are related but not identical. Both reduce server management. Serverless typically runs individual functions on demand, while PaaS commonly hosts long-running applications. Providers blur the line.
Does PaaS remove my need to patch?
It removes patching of the infrastructure and operating system layers the provider manages. You still patch your own code and the libraries it depends on.
Sources
Last reviewed: 18 October 2026.
