An important school of thought within security argues that software development is the primary culprit in breaches,
insofar as the development process seems almost helpless to prevent the creation and deployment of software that has significant vulnerabilities.