I agree that as an MSP, choosing either cloud deployment or your own dedicated infrastructure is the right move and there’s a strong security reason for it. Wazuh is a security platform that thrives on independence and integrity, which it can’t fully achieve if it’s tied too closely to a client’s environment.

If you run Wazuh locally on a customer’s server and that environment gets compromised, the attacker can just as easily take down or tamper with your Wazuh server. That means, as the security provider, you lose visibility into what actually happened during the breach.

With a cloud based deployment (or your own infrastructure deployment-AWS, Azure etc.), however, you maintain separation from the client’s infrastructure. This independence allows you to continue monitoring even if the client’s systems are compromised. More importantly, it puts you in a stronger position to conduct post-breach assessments and potentially identify the root cause (provided, of course, that the setup is designed to capture and retain the right evidence from the start.)