Which of the following statements regarding threats and vulnerabilities in information security is NOT correct?