I'm sure this is true to a certain extent, but it'd be interesting to see how it varies in degree. For instance

* do some companies have good enough insider risk controls to make it expensive or risky to access particular kinds of sensitive data?

* not all nation state actors are equally well-resourced (and not all of them have equally large populations of computer science grads from which to recruit potential spies): is there a difference between what (say) KSA or Iran could get, vs US/UK/China/Russia?