It is so obvious that it hurts
Just found it:
People a big security threat to virtualization, Interop speaker says - Network World
People a big threat to virtualization?? Woo!!!
If you replace "virtualization" by any other hot technology you will see it will also be true.
Security is always designed and deployed in a way that it relies on people's decisions. Security is often a minor priority for people, so they'll make decisions based on other aspects, like time and budget constraints.
That is, you can expect people to make bad security decisions. If security controls are based on people's decisions...there's your "big security threat".