A year of historic breaches at RSA, Epsilon, Lockheed Martin and even the Sony PlayStation Network, demonstrates how ineffective the best security technologies can be when people are involved.

Many attackers today leverage the human factor, bypassing most security controls and using techniques such as social engineering to get the information they want by simply luring users to open an email, click on a link or download an attachment.

Information security people think that simply making users aware of security issues will make them want to change their behavior. However, a fundamental problem is that most awareness programs are created and run by security professionals – people who were not hired or trained to be educators.