On the diffusion of security behaviours