In which cloud services model is the customer responsible for scanning for and mitigation of application vulnerabilities?

VMaaS (Vulnerability Management as a Service) is a specific security service, not a general cloud service model like IaaS, PaaS, or SaaS, and it typically involves outsourcing vulnerability management, not defining responsibility in the cloud shared responsibility model.

In IaaS (Infrastructure as a Service), the customer has more responsibility, including the operating system, middleware, and applications, and would be responsible for application vulnerabilities as well as OS vulnerabilities. However, PaaS specifically highlights application layer responsibility while abstracting more of the underlying stack.

In a PaaS (Platform as a Service) model, the cloud provider manages the operating system, virtualization, servers, storage, and networking, as well as the runtime environment. However, the customer is responsible for the applications deployed on that platform, including writing, deploying, and managing their code, and therefore, scanning for and mitigating any application-specific vulnerabilities within their deployed applications.

In SaaS (Software as a Service), the provider manages almost the entire stack, including the application, meaning the provider is primarily responsible for application vulnerability management, though customers are responsible for their data and usage.