Some cynics in the cyber-security industry will tell you that your staff are your biggest risk factor, but for those same staff, their biggest risk factor is often their in-box - and a security team that expects them to be security experts...