Here’s a great quote I just came across that explains why most users aren’t motivated to follow security policies.
“Without a compelling cause, our employees are just putting in time. Their minds might be engaged, but their hearts are not. Meaning precedes motivation.” – Lee J. Colan
They’re just not in the game…Hence the necessity for strong leadership.