Schneier on Security: Security awareness is generally a waste of time. Schneier: If security awareness is all about changing behavior, why don’t security awareness tools and processes look anything like other, more mature industries that take behavioral change seriously? Compared to other industries, the information security awareness approach to behavioral influence is an embarrassingly amateur affair. Security professionals persist with the delusion that they can manage the what without understanding the why. Influencing user security behavior is a very important part of any organization’s defense in depth.”]
Source: https://www.csoonline.com/article/2133333/why-security-is-in-denial-about-awareness.html