I suspect that a common thread on companies that get less hacked[0] is that they take insider risk seriously.

[0] Everyone gets hacked, but not everyone has all of their most secure data exfiltrated.