Security is only as good as the weakest link, employees who do not question legitimacy and authority.