In that case, I didn't suggest that virus penetration be the metric, but attempts at penetration.

Although it is likely that there is a correlation between attempts and the perceived vulnerability of the system, you would also expect a correlation between attempts and expected total success (which goes up with market share).