Why technology alone is not enough to mitigate risks