Management and security professionals often do not relate with one another. Managers have failed to comprehend risks and consequences, and security policy has often not been integrated well with corporate policy. Your own users. They load their own software and mix personal and business computing. Only fearing the outsider.
Statistics still show that a majority of costly attacks come from trusted insiders.
Poor software quality. The software market maintains pressure on users to standardize on homogeneous solutions. The shortage of experts. There are only a handful of universities where information security is taught. Hackers and crackers are selling themselves as security experts.