Main web server is frequently secure, but the staging server is wide open and trusted by the main web server. Complex cross organizational security. Lack of configuration management. Systems out of the box are easy to set up, but to make them secure requires conscious effort. Security degrades over time.
Software becomes out of date.
Changes to the system don't get documented. Many administrators don't keep up with the latest updates. Most hacks CERT hears about would have been prevented if the advisories had been followed. After a hacker attacks, most sites don't change the way they do business. IMAP probes and attacks.