Most security failings happen because of human actions that are not envisaged when designing systems.