How to compare the options
For each application, record its data, usual resource use, and peak demand. Define integrations, access requirements, and what must be recovered after an incident.
Then compare total cost and who handles updates, monitoring, and backups. Configuration and administration affect security in all three models.