This question warrants more attention than what it has been given. The OP, perhaps unknowingly so, have identified the Achilles heel of information security, namely accurately determining the probability of a threat being realized.
Granted it would impossible to answer the question without first qualifying the party asking but this question underlies, or at least should underlie, every single security decision made. The answer to this question shouldn't be squirming and awkward silence. We should be able to answer these types questions without hesitation.
Collectively, as an "industry", we've failed miserably at providing our clients with this vital data. Worse still - we've allowed it's importance to be dwarfed by fear, uncertainty, doubt and clever marketing ploys.
Like any other mature industry we should be supported by data that has been analyzed, interpreted, refined, modeled and systematized. Luckily there are a few initiatives that attempt to collect data, but collecting is only part of the solution. The real problem lies within interpreting the data and understanding relationships between sets of data.
Unless we choose to acknowledge that this is a problem there is little hope for the security "industry" to ever reach adulthood and instead we'll be stuck in this pubertal wasteland of lies and deceit.
TLDR; Unfortunately we cannot provide you with an accurate answer due to lack of supporting data. What we can do however is wave our hand in an undefined direction suggesting that an attack is likely to occur where there is low-hanging fruit. There are many types of attackers with various motivations, capabilities and resources.
If you're the victim of a targeted attack you're unlikely to have sufficient protection, just deal with it. If however your attacker is of a more "opportunistic" type and you've failed to cut your low hanging fruit, it is ... probable that he'll find you, and successfully do whatever it is that he decides to do.