When a report gives misconfiguration as the cause, I suspect one word is covering several different failures: a product that shipped unsafe, nothing in place to stop the mistake, a person who set it wrong, or instructions that weren't clear. I wanted to test that.
I coded seventeen public incidents from the original documents, where a regulator, prosecutor, company, vendor or finder blamed configuration, and wrote the verdict test before collecting any document. In 12 of 17 cases the documents show more than one failure, and in 11 of those the stated cause names only part of it, usually the person who changed the setting. No case was simply a person's mistake against a safe default. Unsafe defaults were rarely demonstrated: the documents state the default in only 4 cases, 3 of them unsafe, and where I could find vendor records, defaults or enforcement were later tightened.
The qualifications are real and I'd rather state them than bury them. The test could be passed two ways, and one code, "nothing stopped it", is met by almost any successful incident, so it could pass the test on its own and the test was therefore hard to fail. All seven checks I set in advance agree, but the only variation that changes the answer, dropping that code, was something I added after I knew the result, and it gives no clear conclusion. The cases were found by search rather than at random, and one AI agent coded all of them, so this can't say how common each failure is.
So the single word really is hiding something most of the time, and some reports and recording schemes already separate these failures, which makes it a solvable problem rather than an inherent one. That doesn't mean the label is worthless, or that checking configurations is.