We were tasked by a global leader in healthcare to look into making the organization more secure by creating a training program that focused on employee habits. By adapting a model from consumer behavior to information security, we were able to find strong correlations between habit creation and security threats such as phishing, unauthorized cloud computing use, and password sharing. We were also able to ascertain that traditional security training and awareness programs need to move away from the “one-size” fits all technique to custom models that need to look at employee groups. This study extends literature in habit and information security.