It's really easy to hand wave and say that we need a better security culture, but it's really hard when you start to drill down on what that actually means.