Awareness is not enough to thwart cybersecurity