Maybe then security is less to do with individuals and more so company culture ?