A truism of cyber-risk is that most events occur because of actions a person takes, not because of the electronic safeguards in place. My favorite is the "Candy Drop", where a USB drive is dropped in a parking lot outside of HQ...