Its a question we get asked time and time again when providing IT services for small business’s in the Berkshire area.
If you want to be really secure, disconnect your office from the internet and turn your wifi off. Its not very practical as you need emails to run your business, so there is always some risk whether the service is provided in the cloud or within your offices.
The service provider in the cloud knows people are trying to hack into their system so proactively work against this, ensuring there software is always up to date, buying security products and monitoring their system. To match this with your own server you need to do the same, but do you have the resources and is it financially viable?
Some services are best done within the cloud, email is a great example as they are constantly being attacked by spammers. A spammer can try and breach a major supplier or take over your server which is probably simpler!
Other applications are best run within your offices, if you are moving large images about, have many users working on documents or databases there is a performance gain to running the system internally and having access via VPN.
So the answer is they are both as weak and secure as each other! Whatever you do make sure you have a secure and complex password.