We can have a highly secure system with server applications that have been developed under the principles of “secure by design” running in a well-protected network segmented with “zero-trust architecture”. However, all this would be futile if system administrators click on links and open attachments in every phishing email they receive. Culture and human factors are of crucial importance for cybersecurity. Employees in an organization often represent vulnerabilities that can be exploited by external threat actors to attack the organization. Employees can themselves become threat actors that harm their own organization. There are many things we can do to prevent such things from happening.