@brianhonan I'd like to add to your reassessment of "humans are the weakest link".

If you look at airline crashes in the 1960s and 1970s, you'll see a similar pattern: they're frequently attributed to "pilot error". The frequency of such events declined tremendously in the decades that followed. It's not that the pilots got so much better, but rather that many cockpit design flaws that led to "pilot error" were corrected.

I often stress the importance of social engineering in security defense. We tend to think of social engineering as an attack vector, but it works both ways. Design systems to exploit human behavior to make them do the "secure" thing, and the number of incidents will fall. Basically, make the easiest path align with the most secure path, and people will naturally be more secure. This is what "secure by design" looks like.