In the domain of information security management, important innovations that improve an organization's overall security posture are as much behavioral and managerial as they are technical. As effective as a new technology is in blocking viruses or encrypting data, changes in policies, procedures, thinking, and behaviors that have a material effect on an organization's security strategy might represent the greatest innovations of all for some organizations.