The State of Exposure Management report by XM Cyber and Centia Institute found that 75% of security exposures do not put critical assets at risk.
https://www.securitymagazine.com/articles/99178-cyberattacks-on-credentials-and-permissions-affect-82-of-organizations