Conventional approaches to security training are insufficient to meet the rising tide of cybersecurity threats. Conducting a risk assessment is the first step in identifying the highest risks to human behavior, and mitigating those risks is how the security culture of an organization is changed.