SANS Institute blog post on the purpose of a Security Awareness Program and why should organizations care.