The good guys (defenders) have to be right 100% of the time, the bad guys (attackers) only have to be right once.

This is the crux of the entire information security industry.