Cybercriminals know something that many businesses are still learning: people remain the weakest link in any security system.