Security Awareness: We say it’s a ‘layer 8 problem’ but are we to blame?