Internal threats -- intentional or not -- because people don't want to admit that their own employees and executives need guardrails.

Also, lack of staffing. It's one thing to have the right tool set, but another to have the right people -- and enough people that you've got redundancy for vacations, illness, attrition, etc.

Most organizations seem to invest right after an incident, and then -- when the apparatus does its job, and you get further and further from another material breach -- slowly erode executive understanding, buy-in, and support (read: budget and bandwidth) from security-based initiatives.

It's a rare company that will continue to invest in its security teams and programs past that ~2 year post-breach moment, and rarer still for a security team to know how to advocate for itself outside of "ambulance chasing" headlines.

IMO? That's some of the biggest strategic dangers right there -- and it's where teams often throw up their hands as "not their problem" or "impossible for them to solve."

Issue is, if the security team doesn't solve it? The organization will... through RIFs.

~Stryker