What Security Incident Data Can Teach Businesses About Risk Prevention