Aside from occassional incompetence, it's good to recognise that with sysadmins vs. crackers the odds are stacked in the favour of crackers. Sysadmins need to guard against all attacks to do their job, whereas crackers only need to find one attack that has been overlooked. Also, despite the image of crackers as super tech geniuses, as a group they still know that the path of least resistance is often the best, which relies heavily on social engineering, which is far easier to do.
