This report will help users to understand the nature, scope and impact of the threats they face, and will help security teams tailor their program and messaging accordingly. A security awareness program should be an essential component of any organization’s security strategy, but by itself it isn’t enough. Our data shows that 96% of people who took a risky action knew that what they were doing might be risky, so it seems that key information is getting through. However, knowing what to do and doing it are two different things. The challenge is now not just awareness, but behavior change.