I worked somewhere where we received a yearly Christmas bonus of some maximum amount reduced by various factors. Maybe the threat of loosing 10% of some yearly bonus for: "fails to meet security standards" would work well as a deterrent.