Mainframe security was analyzed in a report finding that 51% of organizations run either all or the majority of core applications on the mainframe.
https://www.securitymagazine.com/articles/100050-62-of-organizations-perform-vulnerability-assessments-and-audits