New data underscores risk facing businesses as attackers side-step traditional security prevention technology