Most transactional websites need access to the core customer database, otherwise they could not function. Just DMZing everything is not always possible. Maybe

Most transactional websites need access to the core customer database, otherwise they could not function. Just DMZing everything is not always possible. Maybe segmentation is the only possible defence - customers A-C served out of this DB with a different stack to limit the damage. But once they get in, they get in, right. Its just a matter of finding the next vulnerability. As long as you are providing a rich customer experience, with the ability to generate reports based on historical information, you have risk.