On-premises data centers have slightly more security incidents than public clouds, and web applications are particularly vulnerable.