This is a bit misleading so how many breaches are caused by exploits of unpatched known vulnerabilities? It cuts both ways. Patching is the simplest and most effective way of mitigating being breached or compromised and it can be easily automated and managed for a majority of systems for lower cost than anti virus which isn't working anyway. Don't believe me than ask the Australian Signals Directorate. Their 'Top 4 Mitigation Strategies' which are:
3.Patch Operating System;
4.Minimise Administrative Privileges.