There is no "best" as you are trying to define it. There is only a "best for you" which is something that you need to determine.
Security can be viewed from a number of different ways. For instance, I was once taught that security is a balance between securing a device and usability. A very secure system is one that is entirely disconnected, embedded in 10' of concrete, and buried 300' underground in an undisclosed location. This would also be very maintainable as you wouldn't have to worry about patches, updates, password refreshes, etc. However it is also a system that is entirely unusable. Your company will need to make the best judgments about where between extremes your own operations and user base would be comfortable.
Beyond that, is the risk vs. cost balance. Much like redundancy (and the redundancy vs. security is another balance to consider when you allocate resources), you will need to evaluate your individual risks, how much risk your company is willing to take, and how much money they have available and are willing to spend on security. Most companies won't want to spend more on securing something than it is worth. You will never walk into a retail store to find a $2 anti-theft tag on a $1 pack of gum.
And of course, when counting the costs there are always the "soft" costs. Extra staff (or more knowledgeable staff) to maintain the required level of security (or redundancy). Support costs. Extra complexity that could result in extra lost time/productivity when there is a problem. End user support issues. And on and on and on.
Unfortunately in life, both security and redundancy also have diminishing returns. By this I mean that you can make fairly significant steps to increase either (or both) for relatively little cost. But the further you want to increase those benefits, the steeper the costs get. For instance, you can get a 90% uptime (at 100% capacity) with relatively few costs, but to get 99% (at 100% capacity) expect to pay quite a bit more. To get to 99.999% (at 100% capacity), will likely cost you at least double your costs to get to 99%.
Beyond the issue of "best" is that you are looking for studies to back your decision up. This is also problematic as most companies do not disclose details of their security. Sure, they may say they use product X or vendor Y, but they generally won't provide a full picture. Why? Because the more information they reveal, the easier it would be to exploit any vulnerabilities in the system. The most secure companies will reveal almost nothing at all.
Trying to get an "average" of all companies is trying to treat apples and oranges the same (as well as bananas, grapes, kiwi, peaches, pears, pineapples, ...). Most knowledgeable professionals will tell you there is a world of difference between how different types of companies/businesses perceive and address security. Retail, financial, banking, web-based, edu, manufacturing, services, software design, intellectual property, and so on have different needs and risks. Trying to lump them all together into some "average" just doesn't work.
In the comments you keep looking for a "magic bullet" answer, so instead let's compare this to something outside IT. Would you try to find out if a property you were interested in buying was priced fairly by averaging all the property sales in the country? No, you look for "comparables" preferably in the same neighborhood, of the same type (residential vs. commercial, single family vs. condo, etc), with a similar number of bedrooms/baths, square footage, etc. You then evaluate how the costs compare based on the features (full finished basement, three car garage, pool, etc), condition (upgraded kitchen, new roof, etc), location (quiet non-busy street, good school district, near shopping or public transit, etc) and any other important aspects of the properties before making your best judgement on how the prices compare.
Does a quantitative study that takes place in New York city providing the average cost of an apartment as $X help if you are looking for an apartment in Chicago? Neither would a study averaging security models of all companies help your company.
