Why technology isn't the answer to better security