Leave Those Numbers for April 1st
Over-inflated numbers won't scare me into buying your 'solution'."90% of attacks start with phishing!*" "Cyber attacks will cost the world 6 trillion by 2020!"
We've all seen these sorts of numbers from vendors, and in a sense they're April Fools day numbers: you'd have to be a fool to believe them. But vendors quote insane because there's no downside and much upside. We need to create more and worse downside, and the road there lies through losing sales.
We need to call vendors on these number, and say "I'm sorry, but if you'd lie to me about that, what about the numbers you're claiming that are hard to verify? The door is to your left."
If we want to change the behavior, we have to change the impact of the behavior. We need to tell vendors that there's no place for made up numbers, debunked numbers, unsupported numbers in our buying processes. If those numbers are in their sales and marketing material, they're going to lose business for it.
* This one seems to trace back to analysis that 90% of APT attacks in the Verizon DBIR started with phishing, but APT and non-APT attacks are clearly different.