True security cultures are created via a transparent process that offers equal parts of praise and punishment, says Experian's Stephen Scharf.