You’ve heard it all before: the DBIR tells you people are your biggest risk, your phishing simulations tell you huge numbers of your users fall for social engineering, and simple security measures you deploy are sometimes met with howls of protest if they happen to interact with someone’s workflow. But what if there were a different way?