Is there a weak link?
Is your firewall all patched up? Does it have the latest firmware? Are all ports closed that should be closed? Are the ACL (Access Control Lists) parameters working correctly?
Does the webserver have software running that should not be running?
Who has checked your computers for misconfigurations?
Also at our solutions page: http://oversitesentry.com/?page_id=26
We use Kali-Linux (a penetration test suite to view the status of your computers) to create reports that you can then use to fix the configurations.