Common flaws include unpatched systems and phishing-prone employees. Also, lacking or untested backups play a role.