“Even one unhandled misconfiguration can dwindle the whole organization's security level.”