In the handwringing post mortem after a hacker breach, the first point of intrusion usually takes the focus: The phishing email that Clinton campaign manager John Podesta's aide accidentally flagged as legit, or the Apache Struts vulnerability that let hackers get access to an Equifax server.