Tools, firewalls, and processes matter — but people matter more. Across audits and security reviews,…