Companies see security as more of a technical rather than a cultural issue, so organizations rely mainly on their investments in firewalls, antivirus, intrusion detection, and vulnerability assessment and penetration testing to protect their infrastructure and data, Fitzgerald says.