Eighty-five percent of incidents could have been mitigated with patching, multi-factor authentication or least-privilege principles, an IBM study found.