Humans are a major attack vector. Examples of this are phishing, overly simple passwords or even opening an attachment containing malware which will exploit a given factor.
It is vital to systematically train and sensitise staff about the risks and the simple actions for addressing them.