In IaaS, the responsibility is shared; providers secure the infrastructure, while businesses handle application and data security. In PaaS, the provider manages both platform and infrastructure security. SaaS providers handle security for the entire stack but users must ensure secure usage practices.