Avoid the number one security awareness mistake