Security controls can do only so much. Here's where your employees are usually your first, and only, line of cyber defense.