People are the biggest challenge in information security. They can overcome any technical controls, whether inadvertently or purposefully. I will discuss the security awareness program at RIT, what’s been learned from it, and what may be applicable in a corporate setting.