In my experience, shifting a security culture takes 3 steps:

1. Get management buy-in to do things differently
2. Get personal management engagement to lead the way on what is important
3. Set the tone through training, media, and in-person events that "people like us do things like this"

Here's the thing: management has to be leading the charge on this, with help with the security champions. Management has to want, and encourage, the technical controls to apply to themselves. If management gets special conditions, game over.

Get a manager, the higher up, the better, to personally and publically express their desire to participate in a properly secure environment. Get them to express the frustrations and inconveniences, too. But also communicate that the inconveniences are important for the health of the company.

"I grumble on the mornings when I'm prompted to change my password. I think, I changed it just [1|3] months ago! But, I know that when I do, I'm cutting off a hacker's route to using my credentials to harm me and this company"

[yes, I am aware of the controversy about frequent password changes, but roll with the example for a second]

Then, once you have this great foundation, then start bringing that message to the personal level to everyone.

High Level Culture

In my experience, shifting a security culture takes 3 steps:

1. Get management buy-in to do things differently
2. Get personal management engagement to lead the way on what is important
3. Set the tone through training, media, and in-person events that "people like us do things like this"

Here's the thing: management has to be leading the charge on this, with help with the security champions. Management has to want, and encourage, the technical controls to apply to themselves. If management gets special conditions, game over.

Get a manager, the higher up, the better, to personally and publically express their desire to participate in a properly secure environment. Get them to express the frustrations and inconveniences, too. But also communicate that the inconveniences are important for the health of the company.

"I grumble on the mornings when I'm prompted to change my password. I think, I changed it just [1|3] months ago! But, I know that when I do, I'm cutting off a hacker's route to using my credentials to harm me and this company"

[yes, I am aware of the controversy about frequent password changes, but roll with the example for a second]

Then, once you have this great foundation, then start bringing that message to the personal level to everyone.

Teach Them to Secure Themselves

It can be easy for people to see company policy as disconnected from reality (have you filled in your TPS reports?). So pushing hard on company security can be a losing battle. Instead, consider teaching people how to secure themselves and their families. Show how hackers have and do compromise home computers and mobile devices. By doing this, you get them to really see the dangers involved. Once you have this buy-in, then it is much easier to shift the focus to dangers at work.

Get Some Teeth

If everyone is getting along with the policies, then that's great, but you need to have some worst-case consequences for people who do not comply. This is a tricky subject and you need to work with HR, GRC, and management to make this work.