Browsing the news about critical vulnerabilities and zero-day exploits, on top of the often politically motivated statements about which vendor is a security risk to which nation, we might easily get the impression that technology and flaws in technology are the main cause of cyber incidents. There is however no data that supports this assumption. In fact, the available data shows the opposite. Technology itself is by far the smallest root cause of cyber-incidents.