A company migrates several application servers to an IaaS cloud provider. During a security review, the team debates which risks are now the cloud provider's responsibility versus their own. In this IaaS deployment model, which threat remains primarily the customer's responsibility to mitigate?