That company's big hack probably wasn't an employee's fault

Companies that blame an employee or human error following a cyberattack often neglect to account for broader security failings.