Being in the Cloud does not mean being safe. Cloud systems offer a variety of products, but they are all open and must be secured according to precise policies that are based on data security and the compliant of your company.
Office 365 provides many tools and many settings on these issues which, if not applied, make a Tenant attackable.
In the end, you will be able to have a safe and secure Tenant, but above all Compliant with YOUR company policies.