Security and risk (S&R) pros have the challenging task of using finite budgets to protect their business from every possible attack type in the threat landscape. One strategy for approaching this challenge is to use historical attack trends to prioritize protections against attacks that are the most highly probable. This paper analyzes common attack patterns responsible for breaches in 2016 to facilitate this approach.