As cloud security improves, a weak link emerges: people