A declared priority can still leave an organization exposed when budgets, staffing, and governance do not treat human risk as a first-class control.