Critical infrastructure must not only guard against intrusions from organized groups but also unintentional vulnerabilities introduced by employees.