The "human security factor" is one of the most important and at the same time least addressed elements of IT security. Companies often only invest in technical measures for their IT security and often postpone investments in employee training, organisational aspects of IT security and the promotion of a secure corporate culture. This presentation deals with the human factor in IT security. It explores the question of why employees violate security guidelines and presents methods that make it possible to assess and improve the acceptance of security measures a priori.