“If a culture of security does not exist at a specific office or location, it is unlikely that they will take the preemptive and proactive measures necessary to secure their networks, systems, and data,” Amy Chang, a senior fellow of cybersecurity at the R Street Institute, told the Washington Examiner.