Airlines don’t “do safety”, they are safe. This wasn’t always the case. By accepting that humans are fallible and building systems that both anticipate human error and poor individual human risk decisions, the airline industry improved safety. Cybersecurity can learn the key lesson from aviation’s experience that security this is all about culture and move from “doing security” to being secure.