Attackers keep finding the same gaps in security programs