You or your business are much more likely to have your information stolen because of credential theft than someone discovering and exploiting vulnerabilities. This is regardless of whether your attacker is a nation state or a cheating student. Whether you decide to call it "hacking" is irrelevant when they're in your network.