Process

Security problems are usually process problems

You can harden systems all you like. If the process doesn't match how people actually work, security will be bypassed.