This work adds a new perspective to the stream of organizational IT security risk management literature, one that sheds light on the importance of IT security risk perceptions. Based on a large-scale empirical study of Cloud providers located in North America, the study reveals that in many cases, the providers’ decision makers significantly underestimate their services’ IT security risk exposure, which inhibits the implementation of necessary safeguarding measures. The work also demonstrates that even though the prevalence of IT security risk concerns in Cloud adoption is widely recognized, providers only pay very limited attention to the concerns expressed by customers, which not only causes serious disagreements with the customers but also considerably inhibits the adoption of the services.