The human element is still the most critical vulnerability to CISOs and very often the root of high-profile corporate data breaches. As such, security awareness has become the top concern to many. In a perfect world, security awareness programs would create a culture of security by way of seamless, consistent communication of the importance of information security. In reality, these programs are often a patchwork of materials created in-house and tools purchased from vendors which can lead to a lack of a consistent, coordinated message. Incorporating the results of a new research study examining the effectiveness of security measures used by Fortune 500 companies, Ira Winkler and Samantha Manke will provide a methodology for developing a cohesive security awareness program that will help to establish a strong security culture.