Culture and governance are key to drive change around cyber security behaviours, but too many awareness programmes focus simply on superficial technical gimmicks. JC Gaillard from Corix Partners deconstructs 3 clichés which have been dominating the security awareness arena for the past decade.