Agreed, it doesn't offer a root cause analysis. Remedies are good but how do you prove that it won't happen again? Remember that these are never singular incidents but part of a bad security culture.