A recent HBR article highlighted that many of the younger generation knowingly break the IT rules at work, see HBR Article.
Probably the most interesting statistic was: Almost two-thirds (61%) say the responsibility for protecting information and devices falls on IT or service providers, not individual employees.
To me this sounds very wrong. Why should an employee feel that they are immune from certain rules, which are often put in place to protect sensitive corporate information?