By changing security culture, you can reduce human risk easily and get your employees to truly engage in your security awareness programme.