People can be seen as the weakest link in the security chain, but often that because it is people that are the focus of threat actors' attention. In a well-prepared organisation where employees are well informed of the risks, they can be the strongest line of defence. Organisations also need to account for the psychological impact a successful attack can have on employees and customers. This presentation looks at how to apply cyberpsychology techniques to help change the behaviour of employees.