My experience is that everyone thinks their defensive controls are air tight until inevitably they're going through a post-mortem on a failure where someone says, "Whelp...Murphy's Law..."
Your phrasing is right.
I was just doing a quick take on this qualifier:
> which is not prevented by a strong engineering control