Most organizations dont do enough to educate users about computer security. The main purpose of user education programs is to decrease human-factor risk substantially. Most programs consist of a security orientation program for new employees, with an annual update and refresher course lasting 15 minutes to an hour. The Department of Homeland Security is proposing that employees who fail real or fake phishing tests should lose their security clearances. Users also need to understand that if they get duped into providing credentials or installing unauthorized software, they should report it immediately.”]
Source: https://www.csoonline.com/article/2992011/the-most-important-security-question-to-ask-users.html