All of the above plus 'user behaviour', which covers a multitude of sins. Even with strong IAM and asset management controls and controls to reduce complexity, it's usually a human that gives me a sleepless night.
I guess the ever expanding supply chains and Cloud solutions gives us more to worry about. Not only do we have to ensure that we have crystal clear visibility and assurance of our own controls, we need to have the same level of assurance that none of our suppliers will be the weakest link.
