I'd agree with everything you've written but also add that the direction that technology itself is taking (very fast adoption of new technologies, applications

I'd agree with everything you've written but also add that the direction that technology itself is taking (very fast adoption of new technologies, applications being composites of large quantities of 3rd party code with unknown provenance) makes it even less likely that an organisation would be able to resist modern attack methods from a focused well-funded attacker