You've changed the requirement. To prove a company hasn't been breached, you'd also have to prove that there hasn't been a breach that hasn't been detected (so breached, but not verified). Any given target might already be quietly owned by some state actor or corrupt insider with allies on the outside.