An IT attacker needs to find but one gap in your protective armor, while you need to cover all the bases.