I've got a new Tripwire blog post up today: https://www.tripwire.com/state-of-security/define-reinforce-and-track-helping-develop-positive-cybersecurity-habits - it's all about

explore(ing) some ways that an organisation or individual might start building a new security “habit” so that, in time, acting securely becomes automatic.