Companies need to build a culture of security, but this is impossible when employees are afraid to discuss incidents or suggest improvements.