What industry thinks is right? We don't have a sound solution for breaches, 20% of attack surface can be covered with formally verified software, that's a lot o

What industry thinks is right? We don't have a sound solution for breaches, 20% of attack surface can be covered with formally verified software, that's a lot of effort for a smallish gain, so risk should be mitigated somehow and minimization of data hoarding is an available mitigation.