In my security career, it has become increasingly obvious to me what causes many incidents. At the same time, it is becoming harder to justify investment in solving that problem. I wrote this in the hopes it would help other people facing incidents caused by misconfiguration to advocate for addressing the root cause.