We human beings don’t always do as we have been taught, and organizations are poorly prepared for IT security attacks that target human weaknesses. Since it is difficult to change people’s behavior, it doesn’t help to provide training about how to behave securely. Scientists are studying attacks that are considered social engineering in IT contexts.