Nothing circumvents pricey defense-in-depth faster than people; educating workers about security is essential.
It's one of the hardest jobs a security officer has: teaching users about security. How do you grab an employee's attention during a busy workday? How do you get them to remember, let alone listen, about the need to create strong passwords and to be cautious when opening email attachments?