I host several services accessible via the open Web. They are isolated enough that a breach would most likely only compromise that service. They are also kept up to date, and logs are monitored.

There's always a risk when exposing something, and I am limiting some services to access via VPN because either the data in them is too sensitive, or I don't trust them to be secure enough.

You probably also aren't a worthwhile target in most cases.