Many awareness programs focus on telling people what not to do, rather than implementing good security related behaviors. These behaviors should be defined in formal procedures and guidelines. Security awareness programs should be the promotion of behaviors defined in governance. Many awareness efforts attempt to scare people, not to scare them, and paralyze them. A technologist can learn that understanding that understanding behavioral science is more important than understanding the underlying technology, but it is more akin to being a technologist than being a tech expert.”]
Source: https://www.csoonline.com/article/3075722/8-reasons-why-your-security-awareness-program-sucks.html