Other than technical vulnerabilities

I have been somewhat put off by how many security pros sees vulnerabilities as being a technical problem.  It certainly simplifies a huge area but it also ignores at least 90% of the real problem.

People and organizations have complex vulnerabilities that are exploited by clever attacks that are a very significant percentage off all attacks, they largely fall into the social engineering super bucket.