The biggest security threat to a company's data is not nefarious hackers but staff who are blissfully unaware they are the problem.