Quote from Solyent Green "its the people".  While said in jest employees present the biggest risk to a companies information security.   More play on words from the song "just one KISS from you" the nefarious people are singing it as "just one CLICK from you". But this is only one of the hurdles, its hard to pick the biggest!  As others have mentioned, right sizing the products and services, getting employee buy in on changes are right up there on the hurdles list.