Complexity

Complexity is a security problem in its own right, not just an engineering one.

The reason is simple: you cannot reliably configure, monitor or reason about something nobody fully understands. Systems grow by accretion, each addition sensible on its own, until no single person can say what talks to what. At that point gaps stop being deliberate decisions and start being things nobody knew were there. Reducing complexity rarely feels like security work and frequently does more for your actual safety than adding another tool on top.