More and more businesses are migrating internal functions to cloud-based SaaS applications but what assurance do you have over their security — and should you penetration test it yourselves?