The vast majority of security incidents happen internally.