I don't know if this is pedantic, but op indicated "attacks" not "vulnerabilities". I would not be surprised if statistics in vulnerabilities are different than statistics in realized attacks?
> Just over half (54%) of cyber incidents involved malicious actors gaining access to accounts using compromised or stolen credentials.
My experience has been that most attacks are not that sophisticated and tend to target poor practices within organisations.