Routes to security compliance: Be good or be shamed?