That’s 42% with no risk-based security management program for all company sizes — I suspect that number is much higher for small & medium-sized enterprises.
(image from Ponemon Institute via DarkReading.com)