• Poor management.

    Take the case of Target. Were IT professionals and responsible aware people in charge of securing their network??. Maybe at some level, but not where the buck stopped or where budgets were decided. The ex-CIO was more interested in social media and marketing than securing their network. They had money to predict pregnancy among customers but not enough to ensure security.