In my experience, it's important to "make security easy," be present, create opportunities for dialogue, and keep colleagues involved in security measures. At the same time, we need to utilize technology to "make insecure behavior hard."
"Trust but verify" never worked for me because if you know your organization and culture, you don't need to verify. You already know the security gaps, and the struggle is more about how to close them.
Edit:
Some thoughts: Trust ist important, but it has a time limit and requires to be regular renewed. Trust is subjective and cant really be measured and therefore cant be a base for decision makings.
