Cybersecurity is turning into a social phenomenon. Traditional culture improvement efforts focusing exclusively on awareness are not causing a needed change in priorities among employee benefit plan committees.