Pragmatic Lessons from 15,000 Breach Events