I believe people are our first line of defence when it comes to maintaining cybersecurity posture of the organisation. Contrary to popular belief, widespread by Kevin Mitnick, people can be aware, can be vigilant and can be conscious in their actions, provided they are well-educated, well-trained and given enough responsibility to feel empowered and capable of detecting threats at their very initial phase.Yes, everyone has their weak spots and is prone to manipulation in some areas. And this is exactly what we can leverage in building security awareness trainings.By integrating marketing methodologies and influence techniques with organizational change models, we can effectively manage human risk and build security awareness strategy. A strategy that will not only be a checkmark in some cybersecurity assessment, not only fulfil regulatory requirement, but have a real, long-lasting change in employees' behaviours and habits. The effect that can be measured and continuously built on, improving the actual cybersecurity maturity of the organisation and preventing cybersecurity incidents.