Security awareness is less about training

and more about motivating habit change