A phone company's customer service agent deactivates an account, applies credits to the account, then reactivates it and sells the phone time. The contractor then pleads ignorance of why the work wasn't done, creates a hitch in the project and proceeds to bill the time again to fix it. And while you may recognize this individual, you may not fully understand the scam being run on you and your company. The methodology for security specialists is basically to monitor, detect and respond. The average middle manager's time and attention is consumed by projects.
Any extra time is dedicated to keeping up with the pace of technology change.
Except for the nominal things managers have to do about protecting directories or securing passwords, they're not concerned about security. If front-line managers have no security awareness, it's difficult to expect their reports to have any either. The majority of staff has no significant understanding of the organization's security needs, and as a result, the most effective security attack is simply to ask someone for the information you need. Do you have a personnel policy that reflects your security requirements. There is a conflict of purpose between hiring managers and recruitment professionals.