We have enough expertise and tools to go far enough to visualize the vulnerabilities and fix them without interfering. Some of the administrative processes I feel manifest into technical security problems. Systems administrators are not being trained properly in security. They are not spending the time to go to conferences and looking at the hacker bulletin boards and learning about what software has vulnerabilities and how hackers are exploiting those vulnerabilities. There's a lack of corporate security and privacy policies, which results in inconsistent implementation of security.
Many companies only conduct spot fixes rather than fixing the root problem.
If you do a spot fix, you're not really closing the security hole. There's a lack of companies using automated intrusion-monitoring programs. Companies need intrusion-detection software to determine if someone is hacking them. Companies often incorrectly install and integrate software. Companies will install software but do not use all of the security measures with that software, so there are holes in the system.