Most apps/organizations are not secure, they are just “not targeted by a sufficiently motivated/skilled attacker”