Employee or employer: who’s to blame for a cyber breach?

Many businesses dismiss employees who enable a cyber attack. But is this a fair reaction? And what responsibility does the employer bear?