Are employees our biggest cyber security challenge?