I agree with you on SQL injection and poor access control being big risks. I have seen where organizations have lost their customers’ secret information due to forgotten employee accounts, which were never deleted, thus underlining the importance of managing access.