I think there's great overlap between servers that aren't monitored and servers that are vulnerable to exploits. If you're monitoring your servers for unknown listening ports, chances are you're keeping your systems up to date. Same with bandwidth, although if bandwidth is expensive (eg. cloud providers), your accounting dept might notice.