Users pose biggest security threat