Nobody runs a marathon by accident

## Executive summary This article compares building security culture to training for a marathon, arguing that lasting security comes from repeated small actions, embedded training, low-friction tools and processes, psychological safety for reporting mistakes, leadership that models secure choices, and community support — not one-off campaigns or punitive responses.