A Data-driven approach to Security Awareness