Breaches don’t happen often enough to be a useful metric. Most smaller companies are never breached, despite having basically zero security.