After 500 internal penetration tests conducted from 2021-2023, RSM professionals found only 1.6% of organizations had no vulnerabilities at all. Most had around eight.