There are two orthogonal stacks in an IT ecosystem: Implementation or Doing and Parametric or Directing. A full security assessment covers all aspects of security that impact on an IT ecosystem and its supporting services.
Other than divine intervention, the best answer is to rely on mathematical and statistical models along with computer simulation to help forecast, predict and control risk.
“Passwords are the worse irritating thing since the invention of the PC.” A common response to hear when asking the average computer user what they hate the most about their daily job.