User awareness – Why waste our breath? Users are often referred to as the weakest link, and despite years of talking about security education and awareness, we seem no closer to achieving it on a wide scale. Left to their handle it for themselves users do not appreciate the threats, take wrong decisions at every turn, and readily place themselves into situations that heighten their risk. Some claim to be concerned about security, but seem content to pay lip service, without showing the slightest inclination to apply it in practice. Are people fundamentally incompatible with good security? Are the barriers to entry too high, and is there simply too much to know for the average user to take properly informed security decisions? Is it ultimately better for service providers and CISOs to take the decisions for them?