1) They don't have enough smart programmers. Nobody does, since "enough" means every single one. It only takes one CRUD screen with an SQL injection or buffer

1) They don't have enough smart programmers. Nobody does, since "enough" means every single one. It only takes one CRUD screen with an SQL injection or buffer overrun exploit to get owned. By definition, a large amount of code must tend towards average quality. 2) Selective perception. We only notice when they fail. On the whole maybe they do do a pretty good job and nobody notices when things aren't wrong. 3) Sometimes it's an insider job. 4) Dumb users; no amount of company security can stop a successful phish or keylogger or whatever. 5) Cost-benefit. Sometimes it really isn't worthwhile to pour as much security as you possibly can at a problem. What if a bank guarded every transaction by having a live operator call the customer at a pre-known number? Sure that's pretty stiff security, and completely impractical in a competitive capitalist marketplace. That's an extreme example but it goes to prove the point. Sometimes it's cheaper just to clean up aftewards. Security is a thorny problem; you can't always just magically have more security by throwing more money at it.