If you do a spot fix, you're not really closing the security hole. There's a lack of companies using automated intrusion-monitoring programs. Companies need intrusion-detection software to determine if someone is hacking them. Companies often incorrectly install and integrate software. Companies will install software but do not use all of the security measures with that software, so there are holes in the system.
Companies often depend on firewalls alone for security.
A firewall is only as secure as the security policies behind them. Companies who sell firewalls have good marketing departments that convince clients that firewalls are secure enough. But depending on firewalls alone is insufficient due to incorrect implementation and ineffective policies. As a whole, there is a lack of management focus on security. I also find that there is a lack of installation of software hot fixes.