The most underestimated risk is assuming attacks only come from obvious places or that compliance means security.