Investing in products but not people

from here and here

Too many people, especially decision makers in companies, engage in magical thinking when it comes to security software. They think you just have to "have" it or that it just has to be "active" in order to get the security benefits from it. It doesn't work that way. Security isn't a technology problem, it's a people problem, the technology is just a tool to help the people fighting the security threats. If your company doesn't have enough of those for someone to properly monitor and manage the security software...