Mitigating the IT risk of employees