Hackers of CypherCon

There's too much focus on vulnerabilities and not enough attention on other elements that derive the standard risk equation. Meltdown/Spectre introduced a perfect storm scenario where the vulnerability wasn't easy to fix and the solution broke things. But, there's still persistent vulnerability. What else should we focus on in terms of security if/when the vulnerabilities still remain?