Insecure human activities represent the single most significant
vulnerability for enterprises.

Business-as-usual security awareness and training isn't enough.  

Human Risk Management: Moving From Activities-Based to Outcomes-Based Cybersecurity Training