Can infosec cure stupid?