What I find important to talk about is the narrative that "if you think your company hasn't been broken into, you just don't know it". Of course no system is 1

What I find important to talk about is the narrative that "if you think your company hasn't been broken into, you just don't know it". Of course no system is 100% secure, but the narrative that it's inevitable anyways is often used as a defense for bad practices (like in the Equifax case). Breaches might happen but it is not inevitable. And good practices can still have an impact on how often breaches happen, how much is stolen, and how useful the data is to the intruder. I always get angry when I see some company head like "we will be broken into anyways, why even try?". They won't do that with their physical company location, why with their network? Because they don't really care about other people's data.