5 years of shifting cybersecurity behavior