How agencies can keep employees cyber safe from themselves