Employees must come to appreciate and accept that the threat of social engineering attacks is real, and that a serious loss of sensitive corporate information could endanger the company as well as their own personal information and jobs. In a sense, being careless about information security at work is equivalent to being careless with one's ATM PIN or credit card number. This can be a compelling analogy for building enthusiasm for security practices.