Many security experts argue that their primary concern isn’t hardware or software.