“An employee is either an asset to your cyber security or a risk.”