Can organisations accurately measure the changing attitudes of their workforce towards cyber security and monitor behavioural changes using data science? If so, how can advanced metrics provide users with the right information at the right time, and how can security programmes help meet the challenge?