Many security awareness programs fail because they rely on a “push” mentality. Instead of employees being forced to take training or risk potential punishment, employees do the right things by default and seek out additional training, because they want to. With incentivized awareness, you create a reward structure that incentivizes people to exercise the desired behaviors, which could include seeking out more training. Security Department’s tend to get a bad reputation for being organizations that punish people for bad behavior. Rewarding people for doing the right behaviors gets them to be more security conscious.”]
Source: https://www.csoonline.com/article/2134189/how-to-create-security-awareness-with-incentives.html