We know eating french fries is bad for our health, but we still do it. Awareness is not sufficient to change user behaviour or build the right security culture. This session will cover the recent research on behavioural psychology, 'habit cycle' and culture formation. Why is it so hard to change culture? How can you use the science of habits to change your IT security culture?