Earlier in my career, I worked on a risk assessment focusing on customer data systems. The external data appeared typical for the sector, with low breach frequency and standard impact ranges. The internal data was even more reassuring. Their customer database had zero reported incidents in five years, good audit results, and all the right controls on paper.