"Quite often risks have more to do with operational process, such as storing in an exposed database in the cloud, than it does with a flaw or vulnerability in code," says Chris Morales, head of security analytics at Vectra.