Andy has been working in IT Security since 1988. Andy has come to realise that successful IT security entirely down to people. The best tools in the world are of little value unless they are used, suitable attention is paid to the output of the tools and finally that appropriate actions are taken as a result. Ultimately it is the motivation of individuals that drives successful IT Security programmes. Furthermore, the earlier in the lifecycle that changes can be made the better the long term outcomes.Andy’s career has spanned the gamut from formal assessment processes of the final product (such as Common Criteria and its progenitors) through to driving adoption of better practices as developers write code and much in between.Andy’s focus has always been on making the IT Security outcome better through driving whatever improvements can be made in the systems and processes at hand, with a particular emphasis on making reasonable security a natural and preferably easy option, rather than a complex task. It is all too common for a failure to address the human factors to lead to perverse incentives and undesirable outcomes that militate against the desired goal. An example of this is password policies which have evolved away from things that are theoretically better (forcing frequent changes, forcing lots of character variation, preventing cut&paste of passwords etc) but which cause adverse behaviours, to things ordinary users are more likely to comply with willingly.