Clearly employees are the core of any truely successful security program. Unfortunately, in many businesses, reporting security concerns can also uncover management problems, and most bad managers are highly unlikely to escalate anything that will make them look less than perfect. And, if you have a corporate culture that promotes bad managers, that's the same type of culture that is willing to punish employees for speaking up. Ideally all employees should be able to go to their in-house security team with reports of security concerns or policy violations, without fear of retribution. Unfortunately, I don't that think is the reality, particularly for Information Technology staff. So, those that are the most knowledgeable about security problems, very often are prevented from reporting it. After all, it's easier for a bad manager to lie to the security team than admit to senior managment that "No, we haven't really been doing the security evaluations on our application code for the past 3 years because I wanted to meet or beat every deadline you set on me for code releases, even though I only have only 1/3 of the staff I need to do what you want." In a perfect world, all managers would put the company's security concerns before their own self-interest. But we don't live in a perfect world.