If you consider the [admittedly naive] risk equation: (amount of data to protect * number of systems that store or handle data * level of risk) - mitigation .

If you consider the [admittedly naive] risk equation: (amount of data to protect * number of systems that store or handle data * level of risk) - mitigation ...you'll probably agree that the mitigation mechanisms improved 100x but the risk improved even more.