You went to great lengths to install all the necessary technologies to prevent hacking attacks, such as expensive firewalls, antivirus software, anti-spam systems and intrusion detection/prevention to

Technical defenses such as firewalls, antivirus, and IDS protect against known attack vectors but cannot account for employees who are manipulated through social engineering techniques like phishing, pretexting, or baiting. An attacker who tricks a user into revealing credentials or installing malware effectively circumvents every technical control in place. Security awareness training is the countermeasure because no amount of technology can compensate for uninformed human behavior.

Zero-day exploits are undisclosed technical vulnerabilities, not the human-centric 'weakest link' concept Peter is describing - they are addressed through patch management and behavior-based detection, not by changing human behavior.

Polymorphic viruses are a technical malware category that evades signature-based antivirus scanners; this is a technology limitation, not the human vulnerability that Peter is referencing as the security chain's weakest link.

Spam email is a delivery mechanism for threats, not the fundamental human-factor vulnerability Peter is describing - spam can also be partially mitigated by technical controls unlike the broader human element.