Complacency is IT security's worst enemy